Fundamental concepts and principles of information security
Scope of the domain
This domain tests whether you can use ISO/IEC 27000 vocabulary with precision. Information security preserves confidentiality, integrity and availability (CIA). Confidentiality limits disclosure to authorised parties; integrity keeps data accurate and complete; availability ensures timely access. Security is managed through assets, threats, vulnerabilities, likelihood, consequence and risk, not through technology alone.
Core rules
- Risk is the effect of uncertainty on objectives; information security risk combines likelihood and consequence. A vulnerability is a weakness; a threat is a potential cause; a control modifies risk.
- Residual risk remains after treatment and must be accepted by an accountable owner.
- Defence in depth layers preventive, detective and corrective controls; least privilege, need-to-know and segregation of duties limit exposure.
- Information security covers people, processes, physical and technological assets, not only IT systems.
Worked example
A hospital stores patient records. Ransomware encrypts the server, so clinicians cannot access allergy data. Availability is the immediate impact, but integrity of future records and confidentiality of backups also matter. The threat is ransomware; the vulnerability may be an unpatched server and weak backup isolation; the consequence includes delayed treatment and regulatory breach. A backup tested by restore is a corrective and recovery control, not proof that the threat is absent.
Traps
Do not list a vulnerability as a threat, treat an incident as proof that a control is effective, or describe risk as a simple asset list. Do not assume CIA priorities are equal: the owner sets them from business impact.