Domain 1: Security and Risk Management
Core security goals: CIA and friends
Every control you will ever study maps to a goal. Confidentiality (only authorised people can read data), Integrity (data is accurate and unmodified), Availability (systems work when needed). The exam adds authenticity (identity of source), non-repudiation (sender cannot deny sending) and accountability (actions traceable to an identity).
The opposite world is the DAD triad: Disclosure, Alteration, Destruction.
Risk math you must be able to do cold
| Term | Meaning | Formula |
|---|---|---|
| AV | Asset Value | — |
| EF | Exposure Factor (% of asset lost per event) | — |
| SLE | Single Loss Expectancy | AV × EF |
| ARO | Annualised Rate of Occurrence (events/year) | — |
| ALE | Annualised Loss Expectancy | SLE × ARO |
| Safeguard value | Is a control worth buying? | ALEbefore − ALEafter − annual cost of control |
Example: a &u20B9;2,00,00,000 data centre (AV), a flood would destroy 40% (EF), floods expected once per 100 years (ARO 0.01). SLE = 80,00,000; ALE = 80,000.
Risk responses and risk types
- Mitigate – reduce likelihood or impact with a control.
- Transfer – insurance, contracts, cloud shared responsibility.
- Accept – documented, signed-off decision (senior management owns it).
- Avoid – stop the activity that creates the risk.
- “Reject/ignore” a risk is never a valid answer.
Know the flavours: inherent (before controls), residual (after), control gap (risk left by missing controls), risk tolerance/appetite. Qualitative scoring uses a risk matrix (likelihood × impact); Delphi is anonymous expert consensus.
Control categories and functions
Two axes that can be combined (a firewall = technical + preventive):
| Category | Examples |
|---|---|
| Administrative | policies, training, background checks, procedures |
| Technical/logical | firewalls, encryption, MFA, audit logs |
| Physical | locks, guards, CCTV, mantraps, HVAC |
Functions: preventive (stops the event), detective (finds it), corrective (fixes after), deterrent (discourages), recovery (restores), compensating (alternative when primary is impossible), directive (directs behaviour, e.g. a banner).
Governance and the document hierarchy
Top-down order: policies (mandatory, broad) → standards (mandatory, specific technologies) → baselines (minimum security level) → procedures (mandatory step-by-step) → guidelines (optional advice). Senior management carries ultimate accountability for security — a favourite exam answer.
Due care = doing what a reasonable person would (acting); due diligence = investigating/verifying (investigating). Regulation drivers: sector (HIPAA, PCI DSS), government (FISMA), and economic (GDPR fines up to 4% global turnover or €20M, whichever is higher; India’s DPDP Act 2023 for Indian organisations).
Law quick-hits
- Criminal law – punish offences (burden: beyond reasonable doubt).
- Civil law – damages between parties (preponderance of evidence).
- Administrative – regulatory (e.g., licensing, data protection).
- IP: patent ~20 years; trademark renewable 10-year terms; copyright life + 70 years; trade secret = protected while secret.
- Trade agreements and export controls (Wassenaar) touch crypto export.
People: roles, separation, lifecycle
Data roles: owner (business decision-maker, senior), custodian (IT keeps it running), steward (day-to-day quality), user, administrator (privileged access), auditor (independent check).
Personnel controls: separation of duties (no single person completes a critical task alone), two-person control, job rotation, mandatory vacation (fraud detection), least privilege, need to know, NDA, clean onboarding/offboarding with access reviews at both ends. Awareness training is an administrative preventive control and reduces the largest risk: people.
Threat modelling and frameworks
- STRIDE – Spoofing, Tampering, Repudiation, Information disclosure, DoS, Elevation of privilege (Microsoft).
- PASTA – 7-stage, risk-centric (Process for Attack Simulation and Threat Analysis).
- DREAD – Damage, Reproducibility, Exploitability, Affected users, Discoverability (scoring).
- Cyber Kill Chain (Lockheed Martin, 7 stages: recon → weaponize → deliver → exploit → install → C2 → actions on objectives).
- MITRE ATT&CK – adversary tactics & techniques knowledge base; Diamond Model – adversary, capability, infrastructure, victim.
Supply-chain risk: assess vendors (SOC 2, SIG), contract clauses, and keep software provenance (SBOM) in scope.
Continuity basics (the BIA)
BCP keeps the business running; DRP restores IT. The Business Impact Analysis identifies critical functions and sets MTD/MAO (maximum tolerable downtime), RTO (restore time objective), RPO (acceptable data loss window) and WRT (work recovery time). RTO + WRT ≤ MTD.
Memory hooks
- ALE = SLE × ARO, and SLE = AV × EF — practise until automatic.
- Policies → standards → baselines → procedures → guidelines (mandatory to optional).
- “Senior management is ultimately accountable” — correct answer surprisingly often.
- Accept / avoid / transfer / mitigate — never “reject”.
- Kill Chain starts with reconnaissance, ends with actions on objectives.
Exam tips
- If a question quantifies loss in rupees/dollars — it is ALE math.
- Insurance = transfer. Stopping the risky activity = avoid.
- Due care = act reasonably; due diligence = investigate/verify.
- Ethics (ISC² code): protect society first, then the profession, then principals, then colleagues — in that order.
- Delphi = anonymous rounds of expert opinion.