Cybersecurity and Information Assurance
Cybersecurity and Information Assurance tests defensive security thinking: protecting confidentiality, integrity, and availability through layered controls, identity, monitoring, and response.
Core rules
- Risk combines likelihood and impact across threats, vulnerabilities, and assets. A vulnerability alone is not a risk until exposure and impact are assessed.
- Least privilege and separation of duties limit blast radius. MFA protects against stolen passwords, but not every session-theft method.
- Encryption protects data in transit and at rest; hashing verifies integrity and stores passwords. Hashing is not encryption.
- Authentication proves identity; authorization grants permissions. Logging and time synchronization are required for investigations.
- Incident response phases are prepare, detect and analyze, contain, eradicate, recover, and lessons learned.
- Defense in depth combines patching, endpoint protection, segmentation, backups, training, and monitoring.
Worked example
A user reports a suspicious invoice attachment. The sender domain is a lookalike, the link asks for Microsoft 365 credentials, and one user clicked but did not enter data. Classify it as a phishing attempt. Contain by blocking the sender and URL, resetting the clicked user's password, checking sign-in logs and MFA, and preserving the email. Eradicate by removing similar messages; recover by confirming no mailbox rule or token persistence remains. Do not simply delete the email and close.
Traps
Do not call a vulnerability a threat. Do not treat an antivirus alert as confirmed compromise without scope. Do not disable MFA to fix access. Do not confuse backup with immutability; ransomware can encrypt connected backups. Do not skip containment to chase root cause.