Fundamental principles and concepts of information security, cybersecurity and privacy
This domain tests the vocabulary and mental models the rest of the exam builds on: what information security, cybersecurity and privacy each protect, how the classic properties relate to one another, why controls are selected by risk, and which principles govern personal data.
Three related but distinct concepts
- Information security - the preservation of confidentiality, integrity and availability of information (ISO/IEC 27000). Authenticity, accountability, non-repudiation and reliability may also be involved.
- Cybersecurity - the preservation of confidentiality, integrity and availability of information in cyberspace (ISO/IEC 27032), where cyberspace is the environment formed by the interaction of people, software, services and networked devices. It is not a synonym for IT security.
- Privacy - the handling of personally identifiable information (PII) according to principles such as consent and choice, purpose legitimacy and specification, collection limitation, data minimisation, use/retention/disclosure limitation, accuracy, openness and transparency, individual participation and access, and accountability (ISO/IEC 29100).
Properties, risk and control logic
Confidentiality means need-to-know access; integrity means accuracy and completeness; availability means accessible and usable when required, including timeliness. Security is risk-based: threats exploit vulnerabilities to create impact, and no control set removes risk, so management accepts residual risk. Controls are preventive, detective or corrective, and are layered in depth, supported by least privilege and segregation of duties.
Worked example
A payroll team shares an HR spreadsheet through an anyone-with-the-link URL. The exposure is a confidentiality failure and a breach of the use-and-disclosure limitation principle. Corrective action: revoke the link. Preventive: access restriction (8.3) plus data masking (8.11) in reports. Detective: review of sharing logs. The reasoning matters because one incident maps to both a security property and a privacy principle, and each control is classified by its type.
Traps that cost marks
- Equating privacy with confidentiality: privacy also covers lawful purpose, minimisation and individual rights.
- Treating cybersecurity as purely technical, ignoring people and process.
- Assuming compliance with a control list equals security.
- Confusing availability with mere uptime.