Assets, Threats, and Vulnerabilities
Assets and data
An asset is anything of value to an organization. Asset management means inventorying assets, classifying them (public, private, sensitive, confidential), assigning ownership, and understanding each one's place on the attack surface. Regulated data categories matter: PII (name, address), PHI (health information), SPII (SSN, card numbers, biometrics). Data exists in three states: at rest, in transit, and in use, and each state needs its own protection.
Threats and vulnerabilities
A vulnerability is a weakness; a threat is anything that can exploit it; risk is the likelihood and impact of that happening. CVE catalogs specific vulnerabilities, CVSS scores severity, and vulnerability management is the repeatable cycle of identify, assess, remediate, and report.
Malware distinctions matter: a virus needs a host file and user action; a worm self-replicates across networks without a host; a trojan disguises itself as legitimate software; ransomware encrypts data for payment; spyware and rootkits conceal collection or access; botnets are armies of compromised machines.
Social engineering exploits psychology - authority, urgency, intimidation, consensus, scarcity, and familiarity/trust - through phishing, spear phishing, whaling, vishing, smishing, baiting, tailgating, and shoulder surfing.
Cryptography
Symmetric encryption uses one shared key (fast, but key distribution is the problem). Asymmetric encryption uses a public/private key pair for exchange and signatures. Hashing is one-way and supports integrity, not confidentiality. Digital signatures plus certificate authorities provide authentication and non-repudiation; TLS protects data in transit; SSH protects remote administration.
Traps
Virus versus worm, hashing versus encryption, symmetric versus asymmetric, and vulnerability versus risk are the four classic mix-ups.
Rule of thumb
Ask three questions in order: what asset, what weakness, who would exploit it? Then ask which CIA leg the fix protects.