Cybersecurity Foundations and Threat Landscape
Domain 1 tests how well you can explain security's purpose, name threat actors, and connect attacks to the CIA triad and common frameworks. Expect questions on malware families, social engineering, and the difference between a threat, vulnerability, and risk.
Core rules and concepts
- Confidentiality, integrity, and availability (CIA) guide control selection. Encryption protects confidentiality; hashing and change control protect integrity; backups and redundancy protect availability.
- Defense in depth layers people, process, and technology; no single control is trusted alone.
- Threat actors include opportunistic criminals, insiders, hacktivists, and advanced persistent threats (APTs). Motivation and capability change the likely tactic.
- MITRE ATT&CK describes adversary tactics and techniques; use it to map detections, not as a compliance checklist.
- Social engineering targets people: phishing, vishing, pretexting, and tailgating.
Worked example
A hospital's file server is encrypted by ransomware. Availability is immediately lost; if records were copied before encryption, confidentiality is also lost. The vulnerability might be an unpatched VPN appliance; the threat is the ransomware group; the risk combines likelihood and patient-safety impact. The response prioritizes isolation, restore from offline backup, and notification obligations.
Traps that cost marks
Do not treat risk as identical to vulnerability. Antivirus alone is not defense in depth. Not every attacker is an APT. A control that protects confidentiality may not protect availability.