I85PREP
⌘ K
ECF-GSF Core study materials
ECF-GSF Core study resources

ECF-GSF Core: Security Fundamentals and Risk Management

ECF-GSF Core · Work through your exam, one topic at a time.

All guide sections

Security Fundamentals and Risk Management

What this domain tests

Domain 1 supplies the vocabulary and arithmetic every later domain depends on: the CIA triad plus AAA, the distinction between threat, vulnerability and risk, the control taxonomy, and the risk-management process (identify, assess, treat, monitor). Expect definitional items and at least one quantitative annualized-loss question.

Core rules

  • CIA plus AAA: confidentiality, integrity, availability; authentication, authorization, accounting. Non-repudiation sits with integrity.
  • Vocabulary: a threat is a potential cause (actor or event); a vulnerability is a weakness; exposure is an instance where the weakness is reachable; risk combines likelihood and impact.
  • Quantitative risk: SLE = asset value x exposure factor; ALE = SLE x ARO. Risk = likelihood x impact.
  • Treatment options: mitigate, transfer (insurance, contract), avoid (stop the activity), accept (documented sign-off by a named authority). "Ignore" is not a treatment.
  • Control taxonomy: managerial, operational and technical categories crossed with preventive, detective, corrective, deterrent and compensating types. Defense in depth layers independent controls so one failure is not fatal.
  • Design principles: least privilege, need to know, separation of duties, fail-safe defaults, economy of mechanism.

Worked example

A firm has 40 laptops valued at $2,000 each, an exposure factor of 100% for theft, and a historical ARO of 0.15. SLE = $2,000; ALE = $2,000 x 0.15 = $300 per year. A cable-lock program plus full-disk encryption costs $90 per year and drops the ARO to 0.03, giving an ALE of $60 - a $240 annual saving. Reasoning: compare annualized loss to annualized control cost, state the assumptions behind the ARO, and observe that encryption protects confidentiality of the data but does not reduce the hardware loss.

Traps that cost marks

  • Calling a hacker "the risk" - that is a threat; the risk is the probable loss.
  • Mixing ARO (events per year) with EF (percentage of asset value lost per event).
  • Labelling antivirus purely corrective; on-access scanning is preventive, and it becomes corrective only after execution.
  • Forgetting that residual risk still requires formal acceptance.
  • Assuming a compensating control removes the original requirement rather than substituting for it.