Security Fundamentals and Risk Management
This domain tests whether you can turn security spending into a defensible business decision. Questions cluster around the CIA triad plus authenticity and non-repudiation, control classification, quantitative versus qualitative risk analysis, and the business-impact vocabulary (MTD, RTO, RPO) that continuity and incident plans depend on.
Core rules and concepts
- Threat, vulnerability, risk, exposure: a threat exploits a vulnerability to create risk against an asset. Exposure alone is not risk.
- Control categories are technical, administrative and physical. Control functions are preventive, detective, corrective, deterrent, compensating and recovery.
- Quantitative risk: SLE = asset value x exposure factor. ALE = SLE x annualised rate of occurrence (ARO).
- Qualitative risk uses ordinal scales, Delphi or scenario ranking when numerical data is thin.
- Treatment options: avoid, mitigate, transfer, accept. What remains is residual risk, owned by a named risk owner and measured against risk appetite.
- Defense in depth layers people, process and technology; least privilege limits blast radius; due care is doing the work, due diligence is proving it was done.
- BIA outputs the maximum tolerable downtime (MTD), from which RTO and RPO are derived; RPO is tolerable data loss, RTO is tolerable outage.
Worked example
A customer database is valued at $400,000. A breach would destroy 35% of its value, so SLE = $140,000. The threat is assessed at once every two years, so ARO = 0.5 and ALE = $70,000. A tokenisation and DLP programme costs $20,000 per year and should cut ARO to 0.1, giving a new ALE of $14,000. Expected annual benefit = $70,000 - $14,000 - $20,000 = $36,000, so mitigation is justified quantitatively. If the board declines, it must formally accept $70,000 of residual risk, not the analyst on the ticket.
Traps that cost marks
- Mixing SLE and ALE, or forgetting the ARO multiplication.
- Calling a logging tool preventive; logging is detective.
- Treating cyber insurance as mitigation. It is transfer and does not lower the ALE of the event itself.
- Recording risk acceptance by a security engineer rather than the accountable business risk owner.