Foundational Concepts and Terminology
Why terminology matters
Every later domain assumes you can distinguish a concept from a control from a procedure. A concept is an idea (e.g., least privilege); a control is an implemented safeguard (e.g., role-based access rules); a procedure is the documented steps someone follows. Questions frequently swap these words to see if you notice.
Core vocabulary to own
Know the difference between asset, threat, vulnerability, and risk. An asset is anything of value; a threat is a potential cause of harm; a vulnerability is a weakness a threat could exploit; risk is the combination of likelihood and impact. Also be fluent in confidentiality, integrity, availability (the CIA triad) and in authentication (proving identity) versus authorization (granting permissions) versus accountability (tying actions to an identity through logging).
Traps to watch
- Treating risk as synonymous with vulnerability. Risk exists even when no vulnerability is known.
- Confusing policy (management intent) with standard (mandatory specifics) and guideline (recommended).
- Assuming a control that is preventive also detects; most controls are one or the other, and layered defense needs both.
- Reading "threat" as "attacker" - a threat can be a flood, an outage, or an insider.
Rule of thumb
When a question describes a situation, name the noun first: is the subject an asset, a weakness, or an actor? Then name the verb: prevent, detect, correct. That two-step habit resolves most terminology items.
Worked example
"A shared password lets any staff member read the payroll folder." The asset is payroll data; the vulnerability is shared credentials (no individual accountability); the threat is an insider or a stolen password; the risk is unauthorized disclosure. The fix - unique accounts plus access review - is a preventive control, while audit logs supply detective coverage.