Security Concepts
Why security matters
Information security rests on the CIA triad: Confidentiality (only authorised people can read data), Integrity (data is accurate and unaltered), and Availability (systems and data are reachable when needed). A useful extension adds Authentication (proving identity) and Non-repudiation (you cannot later deny an action). Learn to map every scenario to the property it threatens: a leaked customer list breaks confidentiality; a tampered invoice breaks integrity; a ransomware lockout breaks availability.
Threats, vulnerabilities, risk
A threat is a potential cause of harm (a criminal, a flood, a worm). A vulnerability is a weakness that a threat can exploit (an unpatched program, a weak password). Risk is the likelihood and impact of a threat exploiting a vulnerability. Questions often swap these words, so read carefully: "an unpatched server" is a vulnerability, not a threat. Exploits are the techniques or code that turn a vulnerability into an attack.
Defence in depth and controls
No single control is enough, so layers are used: physical (locks, guards), technical (firewalls, encryption, antivirus), and administrative (policies, training, backups). Controls are also classed as preventive, detective, or corrective. Least privilege (give only the access needed) and separation of duties (no one person controls a whole sensitive process) are core principles.
Traps and a rule of thumb
Watch for "security through obscurity" (hiding something is not real protection), confusing backup with archive, and assuming antivirus alone is sufficient. Many items test whether you know that human error is the most common cause of breaches.
Rule of thumb: for any scenario, ask three questions in order - What is the asset? What property is harmed (C/I/A)? Which control layer would best reduce the risk?