I85PREP
⌘ K
EXIN Information Security Essentials study materials
EXIN Information Security Essentials study resources

EXIN Information Security Essentials: Technical Security Measures

EXIN Information Security Essentials · Work through your exam, one topic at a time.

All guide sections

Technical Security Measures

This domain covers logical controls: access control, authentication, cryptography and network defence. Expect questions of the form which property does this control provide and what does this control not do - the second is where most marks are lost.

Access control

  • Identification is the claim, authentication is the proof, authorisation is the granted rights, accounting is the audit trail.
  • Authentication factors: something you know, something you have, something you are. MFA requires two different factors; location or time are additional context, not factors.
  • Models: least privilege, role-based access control, attribute-based access control, separation of duties.
  • Passwords: favour length over forced complexity, store salted hashes, apply lockout or rate limiting; biometrics trade false acceptance against false rejection.

Cryptography

  • Symmetric (AES): fast, one shared key, key-distribution problem.
  • Asymmetric (RSA, ECC): key pair, slow, solves key exchange and enables signatures.
  • Hashing (SHA-256): one-way fingerprint providing integrity only; it is not encryption.
  • Digital signature: hash the message, encrypt the hash with the sender's private key. Gives integrity, authenticity and non-repudiation - not confidentiality.
  • TLS protects data in transit; encryption at rest protects stored data; key management is the hard part of both.

Network and endpoint

  • A firewall filters traffic by rule; IDS detects and alerts while IPS blocks; a DMZ hosts public-facing services; segmentation limits lateral movement; VPNs protect remote access.
  • Patching, anti-malware, central logging with a SIEM, and tested, isolated backups complete the baseline.

Worked example

A supplier emails a contract PDF carrying a digital signature. The recipient hashes the document, decrypts the signature with the supplier's public key and compares the hashes. A match proves the document is unaltered and originated with the holder of the private key. It does not make the contract confidential, because anyone holding the PDF can still read it - a classic distractor option.

Traps that cost marks

  • Claiming encryption prevents outage or deletion; availability needs backups.
  • Confusing hashing with encryption; hashes are irreversible.
  • Counting a password plus a secret question as MFA - both are knowledge factors.
  • Assuming a firewall stops an insider or a convincing phishing email.