Security Concepts
Why concepts come first
Every other domain rests on a small vocabulary. Learn it precisely, because exam questions often turn on a single word.
Core terms
- Confidentiality, Integrity, Availability (CIA triad): confidentiality means only authorised people can read data; integrity means data is accurate and unaltered; availability means data and services are reachable when needed. A ransomware attack that encrypts files primarily attacks availability; a tampered invoice attacks integrity; a leaked customer list attacks confidentiality.
- Threat, vulnerability, risk: a threat is something that could cause harm (a criminal, a flood), a vulnerability is a weakness that the threat could exploit (an unpatched program, an unlocked door), and risk is the likelihood and impact of that combination. A question may ask which element a missing update represents - it is a vulnerability, not a threat.
- Authentication vs authorisation: authentication proves who you are (password, fingerprint); authorisation decides what you may do (read a folder, approve a payment). Confusing the two is a classic trap.
- Social engineering: manipulating people rather than machines - phishing, pretexting, tailgating, shoulder surfing.
Traps to watch
- Questions that describe an event and ask for the CIA element affected; read what actually happened, not what sounds dramatic.
- "Which is the weakest link?" - usually the human user, not the firewall.
- Distinguishing a policy (a rule) from a control (a measure that enforces it).
Rule of thumb: for any scenario, name the asset, the threat, the vulnerability, and the CIA element harmed. If you can fill those four slots, the answer is usually obvious.
Worked example: An employee finds a USB stick in the car park and plugs it in. The threat is the attacker, the vulnerability is user curiosity plus unrestricted USB ports, and the likely harm is malware installation affecting integrity and availability.