Cybersecurity Fundamentals
What this domain tests
Cybersecurity Fundamentals is the entry domain of the CSX Fundamentals exam, and it establishes the vocabulary every later domain assumes. Questions do not ask you to recite definitions; they describe a business situation and expect you to label the element correctly - asset, threat, vulnerability, risk, control - and then classify the control.
Core rules and concepts
- CIA triad: confidentiality (only authorised parties can read), integrity (data is accurate and unaltered), availability (accessible when needed). Every control should map to at least one of the three.
- Risk vocabulary: an asset has value; a threat is a potential cause of harm; a vulnerability is a weakness a threat can exploit; risk combines likelihood and impact; a control reduces it. Residual risk remains after controls - it is never zero and must be accepted by management.
- Control families: administrative (policy, standards, procedures, awareness training), technical/logical (firewalls, access control lists, encryption), physical (locks, badge readers, guards).
- Control types: preventive, detective, corrective, deterrent, recovery, compensating. Family and type are independent labels - a policy is administrative and preventive.
- IAM sequence: identification → authentication → authorization → accountability (logging and audit). Least privilege and need-to-know constrain what authorization grants.
- Defense in depth: overlapping layers so a single control failure does not expose the asset.
Worked example
An internet-facing web server runs an outdated TLS library and attackers are actively scanning for that version. The asset is the server and its data; the threat is an opportunistic attacker; the vulnerability is the unpatched library; risk is high likelihood (public exposure, active scanning) combined with high impact (customer data, outage). Chosen controls: a monthly patch cycle with emergency patching (technical, preventive) plus SIEM alerting on exploit attempts (technical, detective). Residual risk falls but is not eliminated.
Traps that cost marks
- Calling the outdated library a "threat" - it is a vulnerability.
- Assigning a control one type when categorisation depends on when it acts.
- Assuming encryption alone delivers integrity or availability.
- Treating risk acceptance as an IT decision; it is a management decision.