Security Concepts and Principles
Core model
This domain tests whether you can explain why a control exists, not just name it. Use the CIA triad: confidentiality (need-to-know access), integrity (tamper-evident logs and records) and availability (backup power, alternate routes, relief staff). Security protects against intentional acts; safety protects against accidental harm. Both use the same risk formula: risk = likelihood x impact. Treat controls in order: eliminate, reduce, transfer (insurance), accept.
Layered defence
Never trust one barrier. Typical layers are perimeter, building envelope, controlled internal zones and the asset itself. Each layer should deter, detect, delay and allow response. A visible guard and lighting deter; CCTV and alarms detect; locks, turnstiles and grilles delay; a trained response team acts. If one layer fails, the next still works.
CPTED
Crime Prevention Through Environmental Design uses natural surveillance (clear sightlines, no blind corners), natural access control (one obvious entrance), territorial reinforcement (signage, fencing, marked staff areas) and maintenance (repair broken lights and locks quickly).
Worked example. A store room loses small high-value items. Likelihood is high and impact medium-high. Instead of adding one camera, the guard locks the door (delay), limits keys to two named staff (access control), adds a camera at the door (detection), records every entry (integrity) and asks a supervisor to make random checks (deterrence). Reasoning: each control blocks a different failure mode; a camera alone records a loss but does not prevent it.
Traps that cost marks
Do not confuse security with safety. Do not treat CCTV as prevention. Do not forget availability when listing the CIA triad. Do not claim that more guards always means more security: untrained numbers add cost, not control.