Security Fundamentals and Risk Management
Security Fundamentals and Risk Management
This domain tests whether you can reason about security as business risk: the CIA triad, control selection, and the vocabulary used to justify or refuse spending.
Core rules
- CIA triad (confidentiality, integrity, availability) plus authenticity, non-repudiation and safety.
- Risk exists where a threat exploits a vulnerability to cause impact on an asset. Remove any one element and the risk collapses.
- Control categories: technical, operational, managerial. Control types: preventive, detective, corrective, deterrent, compensating, recovery.
- Risk treatment: mitigate, transfer, avoid, accept. Residual risk must be accepted by an accountable owner in writing.
- Quantitative: SLE = asset value x exposure factor; ALE = SLE x ARO.
- NIST RMF: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor.
Worked example
A customer database is valued at $500,000. A ransomware event would destroy 40% of it, so SLE = $200,000. It occurs roughly once every four years, so ARO = 0.25 and ALE = $50,000. A $15,000 control reduces ARO to 0.05, dropping ALE to $10,000. The control is justified on expected-loss grounds, but note it leaves $10,000 of residual risk that the data owner must accept and document.
Traps that cost marks
- Calling an unpatched server a "risk" when it is a vulnerability; risk needs a threat and an impact.
- Confusing inherent risk (before controls) with residual risk (after controls).
- Accepting risk verbally with no named owner or review date.
- Assuming a preventive control also provides detection; it usually does not.