Topics in this domain
- Enterprise Architecture and IT Risk
- Change Management Risk
- Assets, Configuration and Dependencies
- Incident and Problem Management Oversight
- Project Governance and IT Risk
- Governing the Secure SDLC
- DevOps, CI/CD and Agile Delivery Risk
- Testing, Release and Deployment Risk
- Data Classification, Ownership and Handling
- Data Lifecycle: Integrity, Retention and Disposal
- Business Continuity Planning and Governance
- Disaster Recovery and Testing Recovery Capability
- Emerging Technology Risk: Cloud, IoT and OT
- AI and Machine Learning Risk
- Setting Risk Boundaries for Innovation
- Core Security Concepts: CIA, IAM, Cryptography and Network Security
- Security Frameworks and Control Standards
- Security Awareness Culture and Measuring Training
- Privacy Governance and Data Protection Principles
- Developing a Data Protection Control Strategy
Core Security Concepts: CIA, IAM, Cryptography and Network Security
Security objectives
Identity and access
Cryptography in brief
Encryption is only as strong as the management of its keys.
Network and endpoint
Zero trust
Example. An attacker who phished one employee moved freely across a flat network to the finance servers. Under a zero trust design, the stolen session would have reached only the applications that employee needed, and unusual access would have been challenged.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Control proving data wasn’t altered | Hashing or a digital signature |
| MOST important control for remote access | Multi-factor authentication |
| Limits the spread of an attack | Segmentation or zero trust |
| Weakest part of most encryption | Key management |
In short
- Confidentiality, integrity and availability are the core security objectives; accountability and non-repudiation extend them.
- Identity and access management covers the identity life cycle, authentication, authorisation, privileged access and reviews.
- Symmetric encryption protects bulk data, asymmetric encryption solves key exchange and signatures, and hashing proves integrity.
- Network and endpoint controls (segmentation, firewalls, EDR, hardening) limit how attacks spread.
- Zero trust replaces trust based on network location with verification of every request.
- Defence in depth layers controls so one failure doesn't expose the asset.
Exam traps
- Thinking hashing provides confidentiality.
- Relying on the network perimeter alone.
- Treating MFA as optional for privileged and remote access.
- Assuming encryption is strong when keys are poorly managed.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Security objectives
Identity and access
Cryptography in brief
Network and endpoint
Zero trust
ExampleAn attacker who phished one employee moved freely across a flat network to the finance servers. Under a zero trust design, the stolen session would have reached only the applications that employee needed, and unusual access would have been challenged.
1 / 9