Security, Compliance, and Risk Management
This domain tests security fundamentals, risk assessment, control selection, and compliance boundaries. Expect questions that ask whether a control is preventive, detective, or corrective, or whether compliance equals security.
Core rules
- The CIA triad is confidentiality, integrity, and availability. Authentication, authorization, non-repudiation, and least privilege support it.
- Risk is commonly assessed as likelihood times impact. A risk register records description, owner, rating, treatment, and residual risk.
- Risk treatments are avoid, mitigate, transfer, and accept. Acceptance requires the right authority and documented rationale.
- Controls are preventive, detective, or corrective. Defense in depth combines them rather than relying on one barrier.
- Threat modeling with STRIDE covers spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
- Compliance frameworks such as ISO/IEC 27001, NIST standards, and privacy regulations set baselines. Compliance does not prove security.
- Log and monitor security events, and maintain an incident response capability.
Worked example
A public-facing server has a known unpatched vulnerability. Likelihood is high because exploit code is available; impact is high because the server can reach customer data. The risk rating is high. Treatment: patch immediately to mitigate, add a web application firewall rule as a detective and preventive barrier, and document residual risk accepted by the accountable security officer. Reasoning: compliance alone would not remove the exposure, and acceptance without authority is invalid.
Traps
- Treating a compliance certificate as proof of security.
- Ignoring insider and supply-chain threats.
- Accepting risk without an accountable owner or review date.
- Relying only on preventive controls with no detection or response.
- Overlooking shadow IT and unmanaged assets.