Security and Data Protection
This domain tests the principles behind protecting confidentiality, integrity and availability, and the judgement to apply them when a real person is on the phone asking for something urgent.
Core rules
- CIA triad - confidentiality, integrity, availability. Controls usually trade one against another; stronger access control can reduce availability.
- Authentication vs authorisation - proving identity is not the same as granting rights. Multi-factor authentication needs two or more different factor types: knowledge, possession, inherence.
- Encryption vs hashing - encryption is reversible with the key and protects data at rest or in transit. Hashing is one-way; passwords are stored as salted hashes, never encrypted or plain.
- Least privilege - give the minimum access needed, for the minimum time, with separation of duties on sensitive actions.
- Backups - three copies, on two media types, one offsite; add an offline or immutable copy to survive ransomware.
- Incident response - prepare, identify, contain, eradicate, recover, then capture lessons learned.
Worked example
A caller claiming to be the finance director demands an immediate password reset on a colleague's account. Urgency plus claimed authority is classic pretexting. Reasoning: verify identity through a callback to the number in the directory, follow the documented reset route, issue a temporary password through an approved channel, and record the request. Never read a password aloud to a caller.
Traps that cost marks
- Treating the HTTPS padlock as a reputation signal rather than encryption.
- Saying hashing and encryption are interchangeable.
- Calling an antivirus product a backup strategy.
- Keeping the only backup in the same room as the server.