Fundamental cybersecurity principles and concepts
This domain tests the vocabulary and reasoning behind every later control decision: how assets, threats, vulnerabilities, and risk relate; what confidentiality, integrity, and availability protect; and why controls are layered, scoped, and measured.
Core vocabulary and the risk equation
- Asset: anything of value, including data, systems, people, and reputation.
- Threat: an actor or event with the potential to cause harm, such as ransomware or a malicious insider.
- Vulnerability: a weakness that a threat can exploit, such as an unpatched service or an overly broad permission.
- Risk: the combination of likelihood and impact if a threat exploits a vulnerability. Qualitative scales are acceptable when defined consistently.
- Control: a safeguard that modifies risk. Controls are preventive, detective, or corrective.
- Residual risk: what remains after controls; it must be accepted by an accountable owner.
Principles that guide control design
- Apply least privilege and separation of duties so no single account or person can both cause and conceal harm.
- Use defense in depth: independent layers that do not share a single failure point.
- Distinguish authentication (proving identity) from authorization (granting permissions); logging and monitoring provide accountability.
- Prefer fail-safe defaults: deny by default, allow explicitly.
Worked example
A billing server runs an unsupported operating system. The asset is billing data and service availability. Ransomware is a credible threat; the unsupported OS is the vulnerability. Likelihood is high because exploit code is public, and impact is high because invoices stop and records may be encrypted. Risk is therefore high. The primary preventive control is upgrading the OS; until then, segmentation and endpoint detection are compensating controls, tested backups are corrective, and alerting is detective. After the upgrade, residual risk is lower but not zero, so an owner accepts it and monitors it.
Traps that cost marks
- Treating a threat as a vulnerability, or a vulnerability as risk.
- Saying risk is binary instead of likelihood times impact.
- Confusing authentication with authorization.
- Equating compliance with security.
- Calling any duplicate tool 'defense in depth'.