Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)
What the exam tests
This domain checks whether you can use ISO/IEC 27032 vocabulary precisely and place cybersecurity in relation to information security, network security, Internet security and critical information infrastructure protection (CIIP). ISO/IEC 27032 is guidance, not a certifiable management system standard; it explains how stakeholders can collaborate in Cyberspace.
Core concepts
- Cyberspace is the complex environment produced by people, software and services interacting on the Internet through connected devices and networks; it has no single physical form.
- Cybersecurity is the preservation of confidentiality, integrity and availability of information in Cyberspace; authenticity, accountability, non-repudiation and reliability may also apply.
- Information security protects information in all forms; network security protects network infrastructure; Internet security protects Internet-connected systems and services; CIIP protects critical infrastructures.
- The categories overlap. One event can be a cybersecurity incident, a cybercrime and a CIIP event depending on target, effect and legal context.
- Cybersafety concerns protection from undesirable consequences in Cyberspace, especially for users; cybercrime involves criminal activity where Cyberspace is source, target or means.
Worked example
A DDoS attack takes down a public appointment portal used by a hospital. The service is unavailable, so it is a cybersecurity incident. If the hospital is designated critical infrastructure, CIIP obligations may also apply. If a criminal extortion demand is involved, it is also a cybercrime. The reasoning is to identify the affected asset, stakeholder obligations and jurisdiction - not to assign one exclusive label.
Traps
Do not equate cybersecurity with information security; do not call Cyberspace a physical network; do not treat ISO/IEC 27032 as a certifiable MSS; do not assume every cybercrime is a CIIP incident.