Tier 3a — Security Principles (Revised)

Threat

An external force that jeopardizes security

Threat vector

The method an attacker uses to reach the target

Threat actor

The person or group behind the threat

Vulnerability

A weakness in a system or control that an attacker could exploit

Risk

A threat combined with a corresponding vulnerability

Threat + Vulnerability

Risk equation

Likelihood

The probability that a risk will actually occur

Impact

The amount of damage if a risk materializes

Confidentiality

Keep data private and secret — only authorized parties can see it

Integrity

Data is accurate, consistent, and unaltered by unauthorized parties

Availability

Systems and applications work when users need them — uptime

Confidentiality example

Encryption, clean desk policy, screen locks

Integrity example

Hashing, digital signatures, file integrity monitoring

Availability example

Backups, redundancy, DDoS protection, fault tolerance

Risk avoidance

Change business practices to make the risk irrelevant

Risk transference

Move the risk to another organization (e.g., insurance) — can't transfer 100%

Risk mitigation

Reduce the likelihood or impact of the risk

Risk acceptance

Acknowledge the risk and continue operations anyway

Inherent risk

Original level of risk before any controls are applied

Residual risk

Risk that remains after controls are applied

Control risk

New risk introduced BY the controls themselves

Risk tolerance

The level of risk the organization is willing to accept

Qualitative risk analysis

Subjective judgment grouped into categories (high/medium/low)

Quantitative risk analysis

Numeric ratings, often in dollars, for likelihood and impact

Configuration management

Tracks how devices are set up — both OS and installed software inventory

Baseline

A configuration snapshot at a given point in time

Baselining

The practice of establishing a known-good configuration as a reference point

Versioning

Assigning numbers to track configuration changes over time

Version control

The practice of tracking revisions to files or code over time

Configuration diagrams

Documents that show how systems are set up

Change management

Controls how changes happen to minimize risk

ISC2 Canon 1

Protect society, the common good, public trust, and the infrastructure

ISC2 Canon 2

Act honorably, honestly, justly, responsibly, and legally

ISC2 Canon 3

Provide diligent and competent service to principals

ISC2 Canon 4

Advance and protect the profession

Policy

Bedrock document of security expectations approved at the highest levels — MANDATORY

Standard

Specific details of required security controls — MANDATORY

Procedure

Step-by-step instructions employees follow to perform tasks — may or may not be mandatory

Guideline

Advice from security professionals to the rest of the organization — OPTIONAL

AUP (Acceptable Use Policy)

Defines authorized uses of company technology and penalties for violation

BYOD (Bring Your Own Device)

Policy covering use of personal devices with company information

Something you know

Authentication factor — password, PIN, security question answer

Something you have

Authentication factor — token, debit card, authenticator app

Something you are

Authentication factor — biometric (fingerprint, iris, palm, face)

MFA (Multi-Factor Authentication)

Combines authentication from TWO DIFFERENT factor categories (e.g., password + token)

SSO (Single Sign-On)

Shares an authenticated session across multiple systems so users don't re-authenticate — about UX, not auth strength

Non-repudiation

Prevents someone from falsely denying an action — provided by digital signatures

PII (Personally Identifiable Information)

Data that can be tied back to a specific person — governed by privacy laws like GDPR

PHI (Protected Health Information)

Medical records (paper and electronic) — governed by HIPAA

PCI DSS (Payment Card Industry Data Security Standard)

Regulation covering credit/debit card data handling

Preventive control

Stops a security issue from happening (firewall, MFA, fence)

Detective control

Identifies security issues that have occurred (IDS, CCTV, log review)

Corrective control

Remediates issues after they happen (patching, restoring from backup)

Technical control

Uses technology to achieve the control objective — also called logical control

Administrative control

Uses processes and policies (training, AUP, background checks)

Physical control

Impacts the physical world (locks, fences, guards, bollards)