Domain 1: Security Principles

CIA triad

• Confidentiality: only authorised people can access information. Controls: encryption, access control.
• Integrity: information is not altered without authorisation. Controls: hashing, digital signatures.
• Availability: systems and data are accessible when needed. Controls: redundancy, backups, DDoS protection.

Also: authentication (proving identity), non-repudiation (a sender can't deny an action), and privacy.

Risk management

Risk = likelihood × impact. Terms:

• Asset: something of value
• Vulnerability: a weakness
• Threat: something that could exploit a vulnerability
• Risk treatment: avoid, accept, mitigate (reduce), or transfer (e.g. insurance)

Risk appetite is how much risk an organisation is willing to accept.

Security controls

• Administrative / managerial: policies, procedures, training
• Technical / logical: firewalls, encryption, access control lists
• Physical: locks, guards, fences, CCTV

ISC2 Code of Ethics canons

1. Protect society, the common good, necessary public trust and confidence, and the infrastructure.
2. Act honourably, honestly, justly, responsibly, and legally.
3. Provide diligent and competent service to principals.
4. Advance and protect the profession.

Governance elements

Policies (high level, mandatory), standards (mandatory specifics), procedures (step by step), guidelines (recommendations), plus regulations and laws.