Fundamental principles and concepts of information security, cybersecurity, and privacy
This domain tests the vocabulary and mental models behind ISO/IEC 27002. Expect definitions from ISO/IEC 27000, the CIA triad, risk terms, and clear distinctions between information security, cybersecurity, and privacy.
Core definitions
- Information security is the preservation of confidentiality, integrity, and availability of information. Confidentiality means information is not disclosed to unauthorized parties; integrity means it is accurate and complete; availability means it is accessible when needed.
- Cybersecurity focuses on protecting information systems, networks, and digital data from cyber threats. It is often treated as a subset of information security.
- Privacy concerns the protection of personally identifiable information (PII), including lawful and fair processing, consent, and data-subject rights.
- Key risk terms: asset (something of value), threat (potential cause of harm), vulnerability (weakness that can be exploited), risk (effect of uncertainty on objectives), control (measure that modifies risk), and residual risk (risk remaining after controls).
Risk-based thinking
Controls are chosen according to risk, not copied from a checklist. Risk is commonly assessed through likelihood and impact, then compared with risk appetite or tolerance.
Worked example
An HR laptop holds employee PII. The asset is the laptop plus the data. The threat is theft; vulnerabilities include no disk encryption and a weak login. Impact includes a privacy breach, regulatory penalty, and reputational harm. A suitable control set is full-disk encryption, multifactor authentication, an asset register, and secure storage. Residual risk remains but is reduced and can be accepted or further treated.
Traps
- Treating privacy and confidentiality as synonyms; privacy also involves legal obligations and data-subject rights.
- Confusing threat, vulnerability, and risk.
- Claiming ISO/IEC 27002 certifies an organization; ISO/IEC 27001 is the certifiable requirements standard.