EXIN Information Security Essentials cheat sheet

Information is data that has been processed, organized, or given context so that it has meaning and value to a recipient; raw data alone carries no interpretation.

The CIA triad defines the three core security objectives: Confidentiality (only authorized parties can read data), Integrity (data is accurate and unaltered), and Availability (data and systems are accessible when needed).

Confidentiality protects against unauthorized disclosure, integrity protects against unauthorized or accidental modification, and availability protects against disruption of access; a control may serve one, two, or all three.

Additional properties often layered onto CIA include authenticity (origin of data or identity of a party is verifiable), accountability (actions can be traced to an entity), and non-repudiation (a party cannot deny a performed action).

Information security protects information in all three states: at rest (stored on media), in transit (moving across networks), and in use (being processed in memory or by an application).

Information security is broader than IT security: it covers paper records, verbal communication, and physical assets, not only computer systems.

An asset is anything of value to the organization (data, hardware, people, reputation, processes); a threat is a potential cause of an unwanted incident; a vulnerability is a weakness that a threat can exploit.

Risk is commonly expressed as the combination of the probability of an event and its consequence; qualitatively risk = likelihood x impact.

Security is a business enabler: it supports legal compliance, customer trust, and continuity of operations rather than being an end in itself.

Threat categories include human (malicious or accidental), technical (malware, system failure), and environmental/natural (fire, flood, power loss); human error is a leading cause of incidents.

Malware families: virus (attaches to a host file), worm (self-replicating across networks without a host), trojan (disguised as legitimate software), ransomware (encrypts data and demands payment), spyware (covertly collects data).

Social engineering exploits human trust rather than technical flaws; phishing, spear phishing, vishing (voice), smishing (SMS), pretexting, and tailgating are common forms.

Phishing is bulk fraudulent email; spear phishing is targeted at a specific person or role and typically uses researched personal details to appear credible.

Ransomware defense relies on tested offline or immutable backups, patching, least privilege, and segmentation; paying the ransom is discouraged because it funds attackers and does not guarantee recovery.

Denial-of-service (DoS) attacks exhaust resources so legitimate users lose availability; distributed DoS (DDoS) uses many compromised hosts (a botnet) to amplify volume.

Risk assessment approaches: quantitative uses monetary values (asset value, exposure factor, single loss expectancy, annualized loss expectancy); qualitative uses scales such as low/medium/high and is faster but less precise.

Risk treatment options are: mitigate (apply controls to reduce risk), transfer (e.g., insurance or outsourcing), avoid (stop the activity), and accept (retain with management sign-off).

Residual risk is the risk remaining after controls are applied; it must be compared to the organization's risk appetite and formally accepted by an accountable owner.

A policy hierarchy typically runs: top-level security policy (management intent) -> standards (mandatory specific requirements) -> procedures (step-by-step how) -> guidelines (recommended, non-mandatory).

The top-level information security policy is approved by executive management and states objectives, scope, responsibilities, and commitment to continual improvement.

Governance assigns accountability: senior management owns the overall security program, while asset owners and data owners accept risk for specific assets.

Segregation of duties prevents one person from controlling all stages of a sensitive process (e.g., requesting, approving, and executing a payment).

Least privilege means granting only the access necessary to perform a task, and need-to-know limits access to information on a per-information basis.

The Acceptable Use Policy defines permitted and prohibited use of organizational assets, email, internet, and devices; violations are typically disciplinary matters.

A Data Classification Policy defines labels (e.g., public, internal, confidential, secret) and the handling rules attached to each label.

Policy exceptions should be time-bound, documented, risk-assessed, and approved by an authorized manager rather than granted informally.

Policies must be reviewed at planned intervals (commonly annually) or when significant changes occur, and employees must acknowledge them.

Roles must be separated: an asset owner is accountable for an asset and its classification, a data custodian performs day-to-day administration, and users follow policy.

The employment lifecycle controls are: screening before hire, security responsibilities in the contract, awareness training during employment, and revocation of access on termination or role change.

Security awareness, training, and education differ in depth: awareness is 'what and why' for all staff, training teaches skills for a role, education builds deeper expertise.

Onboarding must include signing confidentiality/acceptable use agreements and completing awareness training before access is granted.

Offboarding must promptly revoke accounts, recover assets and badges, and remove physical access; delayed revocation is a common audit finding.

Background verification should be proportionate to the role's sensitivity and lawful in the jurisdiction; it reduces insider risk at hire.

Insider threats include malicious insiders and negligent insiders; controls include least privilege, monitoring, job rotation, and mandatory vacation for sensitive roles.

Third-party/supplier management requires due diligence before contracting, security requirements in contracts, and periodic review of supplier performance.

Clear desk and clear screen rules reduce exposure of information to unauthorized people in shared or visitor-accessible areas.

Identification asserts who a subject claims to be; authentication verifies that claim; authorization decides what the authenticated subject may do; accountability records what was done.

Authentication factors are something you know (password, PIN), something you have (token, smart card), something you are (biometrics); MFA combines factors from different categories.

Access control models: discretionary (owner grants access), mandatory (system-enforced labels, e.g., classification), and role-based (access tied to job role).

Encryption protects confidentiality; symmetric algorithms (e.g., AES) use one shared key and are fast, asymmetric algorithms (e.g., RSA) use a public/private key pair and support key exchange and digital signatures.

Hashing (e.g., SHA-256) is one-way and supports integrity checks; a digital signature combines a hash with the sender's private key to provide integrity, authenticity, and non-repudiation.

TLS protects data in transit between client and server; full-disk or file-level encryption protects data at rest, and both should be paired with sound key management.

Firewalls filter traffic by rules; an intrusion detection system (IDS) detects and alerts, while an intrusion prevention system (IPS) can block; antivirus/EDR detects and responds to malicious code.

Patch management reduces exploitable vulnerabilities; vulnerability scanning finds known weaknesses, and penetration testing simulates an attacker to validate controls.

Logging and monitoring support detection and investigation; logs should be time-synchronized and protected from tampering, and privileged activity should be reviewed.

Physical security layers are perimeter (fences, lighting, barriers), building (locks, guards, reception), and interior (secure rooms, cabinets, locks on devices).

Access to secure areas should follow least privilege and need-to-know; entry should be logged, and visitors escorted and badged.

Physical access control mechanisms include lock-and-key, electronic card access, biometrics, mantraps (two-door interlock), and turnstiles.

Environmental controls include fire detection and suppression (water, CO2, inert gas, or clean-agent systems for server rooms), temperature and humidity control, and water-leak detection.

Power protection: a UPS provides short-term ride-through and clean shutdown; a generator provides long-term backup; both require periodic testing.

Cabling should be protected from interception and damage (conduits, locked cabinets, avoiding untrusted areas); unused network ports should be disabled.

Equipment should be sited to reduce exposure to environmental hazards (flood-prone basements, direct sunlight, heat sources) and secured against theft, including mobile devices.

Secure disposal and reuse requires sanitizing or destroying media (shredding, degaussing, cryptographic erase) so that data cannot be recovered.

Clear desk and clear screen rules and locked cabinets for removable media are physical measures that protect confidentiality of information.

An information security incident is a single or series of unwanted or unexpected events with a significant probability of compromising business operations and threatening security.

Incident response phases are commonly: preparation; detection and reporting; assessment and decision; containment, eradication, and recovery; and post-incident review/lessons learned.

Reporting channels must be known to all staff; staff should report suspected incidents quickly and not attempt to investigate on their own.

Containment aims to limit damage (isolate a host, disable an account, block an address) before eradication removes the cause and recovery restores normal service.

Evidence handling requires a documented chain of custody and forensic imaging to preserve integrity for possible legal or disciplinary action.

Business continuity focuses on keeping critical business functions running during disruption; disaster recovery focuses on restoring IT infrastructure and data after a major failure.

Recovery objectives: RTO (recovery time objective) is the maximum acceptable downtime; RPO (recovery point objective) is the maximum acceptable data loss measured in time.

A business impact analysis (BIA) identifies critical processes, their dependencies, and the impact of their unavailability over time; it drives RTO/RPO targets.

Continuity and recovery plans must be tested (tabletop exercises, simulations, full tests) and updated based on results, since untested plans are unreliable.

The ISO/IEC 27000 family provides international standards: ISO/IEC 27001 specifies requirements for an information security management system (ISMS), and ISO/IEC 27002 gives implementation guidance on controls.

An ISMS follows the Plan-Do-Check-Act cycle: establish the system, implement and operate it, monitor and review it, and maintain and improve it.

ISO/IEC 27001 certification is performed by an accredited external certification body after internal audits and management review; it is not self-declared.

The GDPR regulates processing of personal data of individuals in the EU/EEA; key principles include lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, and accountability.

Under the GDPR, a personal data breach generally must be notified to the supervisory authority within 72 hours of becoming aware where it poses a risk to individuals.

NIST Cybersecurity Framework organizes outcomes into functions: Identify, Protect, Detect, Respond, Recover (with Govern added in version 2.0).

PCI DSS applies to organizations handling payment card data and defines requirements for protecting cardholder data, including encryption and access restriction.

Compliance is not the same as security: meeting a standard is a baseline, and organizations must still manage risks specific to their own context.

Audit evidence includes policies, logs, records, and interviews; internal audit should be independent of the functions being audited.