Security Fundamentals and Threat Landscape
Security Fundamentals and Threat Landscape
This domain tests whether you can reason about security as risk management rather than tool configuration. Questions target the CIA triad, authentication/authorization/accounting, threat actors, attack surfaces, threat modeling, and how frameworks such as MITRE ATT&CK and the cyber kill chain describe adversary behavior.
Core rules
- Confidentiality, integrity, and availability are separate goals; a control that improves one can weaken another. Encryption protects confidentiality, hashing and signatures protect integrity, redundancy protects availability.
- A threat is a potential cause; a vulnerability is a weakness; risk combines likelihood and impact. Asset + threat + vulnerability = risk.
- Threat actors range from opportunistic criminals and insiders to nation-state APTs. Motive, capability, and access determine which controls you prioritize.
- Defense in depth layers preventive, detective, and corrective controls. Zero trust removes implicit trust based on network location and verifies every request.
- STRIDE is a threat-modeling mnemonic: spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege.
Worked example
A finance user receives an email mimicking a vendor invoice and enters credentials on a lookalike site. The attacker logs in and creates a mailbox forwarding rule. In kill-chain terms this spans delivery, exploitation, installation, command and control, and actions on objective. Controls that break the chain: phishing-resistant MFA at the identity provider (exploitation), mail filtering and DMARC enforcement (delivery), impossible-travel and new-forwarding-rule detection (actions), and least privilege on the mailbox (impact).
Traps
- Treating compliance as security: an audit pass does not stop lateral movement.
- Confusing vulnerability scanning with threat intelligence; scanners find weaknesses, not intent.
- Assuming insider threats are only malicious; negligence causes many incidents.