Information Security Fundamentals and Governance
Information Security Fundamentals and Governance
This domain tests how well you connect penetration-testing activity to security governance: the CIA triad, risk, control selection, policy hierarchy, access control, and cryptography at a conceptual level. Expect questions that ask you to classify a control or decide whether a finding is a vulnerability, a risk, or a compliance gap.
Core rules and concepts
- CIA triad: confidentiality, integrity, availability. A control can support one and harm another; encryption supports confidentiality but can complicate availability and incident response.
- Risk is likelihood × impact, not the mere existence of a weakness. A vulnerability is a weakness; a threat is who or what can exploit it; risk is the potential outcome.
- Control types: preventive, detective, corrective, deterrent, compensating. Least privilege, separation of duties, defense in depth, and fail-safe defaults are design principles.
- Policy hierarchy: policy (intent), standard (mandatory requirement), procedure (steps), guideline (recommendation). Frameworks such as ISO/IEC 27001, NIST CSF, and COBIT guide governance but are not laws.
- Access control models: DAC, MAC, RBAC, ABAC. Data classification drives handling and retention.
- Cryptography: symmetric for bulk data, asymmetric for key exchange and signatures, hashing for integrity; PKI binds identities to keys.
Worked example
A public web server is missing patches. The vulnerability is the unpatched service; the threat is an attacker exploiting it; likelihood is high because it is internet-facing; impact is high because it holds customer data; therefore risk is high. A patch is the corrective control, a WAF rule is a compensating control, and a change-management procedure reduces recurrence. Saying 'the risk is the missing patch' would lose marks because it confuses the weakness with the risk.
Traps that cost marks
- Calling a framework a legal requirement.
- Treating encryption as a cure for every CIA problem.
- Rating risk from severity alone without likelihood or business context.
- Confusing policies with technical controls.