Chapter 5 — Security literacy | Bachelor's Critical infrastructure and sector security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 05 published. Map, example, EX010.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["5.1 The vocabulary"]
  N2["5.2 The CIA triad in critical services"]
  N3["5.3 Actors and techniques"]
  N4["5.5 Practical activity"]
  N5["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX010"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["5.1 The vocabulary"]
  N2["5.2 The CIA triad in critical services"]
  N3["5.3 Actors and techniques"]
  N4["5.5 Practical activity"]
  N5["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX010"]

[Learning outcomes and connection]
    |
    v
[5.1 The vocabulary]
    |
    v
[5.2 The CIA triad in critical services]
    |
    v
[5.3 Actors and techniques]
    |
    v
[5.5 Practical activity]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX010]

Learning outcomes and connection

After this chapter you can (1) define confidentiality, integrity and availability and explain why critical services often rank them differently from office IT; (2) use the vocabulary asset, threat, vulnerability, likelihood, impact, risk and control correctly; (3) describe the main classes of threat actor and attack technique at a conceptual level; and (4) read a security advisory and extract what it means for a given organisation. It builds on Chapters 1–4 and prepares Chapter 16 (architecture) and Chapter 19 (the field's scope).

5.1 The vocabulary

An asset is something of value: a service, a system, data, a building, people's time. A threat is a potential cause of harm — an actor (a criminal group, an insider, a state) or an event (a flood, a failed update). A vulnerability is a weakness a threat can exploit: an unpatched flaw, a shared password, a single cable route. Likelihood is how probable it is that a threat exploits a vulnerability in a period; impact is the harm if it does. Risk combines them — informally "likelihood × impact", though Chapter 23 shows why the multiplication is often misleading. A control (or safeguard) is a measure that reduces likelihood or impact. NIST's risk-assessment guide sets out this vocabulary and process (SP 800-30 Rev. 1).

5.2 The CIA triad in critical services

Confidentiality means information is disclosed only to those authorised; integrity means information and systems are not altered without authorisation; availability means they work when needed. Office IT often puts confidentiality first because breaches of personal data carry legal and reputational costs. In OT, the order is often reversed: a water utility cares first that pumps run (availability) and that commands and readings are genuine (integrity); the secrecy of a tank level matters much less. NIST's OT guide makes this point and adds safety as an overriding concern (SP 800-82 Rev. 3). Healthcare mixes both: patient records demand confidentiality, while infusion pumps and ventilators demand integrity and availability. A security professional in a critical sector must ask, for each asset, which property failing would hurt people first.

5.3 Actors and techniques

Threat actors differ in motive and capability. Criminal groups seek money, most visibly through ransomware that encrypts data and threatens to publish it. State-sponsored groups may seek intelligence or the ability to disrupt services in a crisis. Hacktivists seek attention. Insiders may be malicious or, far more often, make mistakes. Accidents — failed updates, misconfigurations, cut cables — cause many outages without any adversary. Techniques are catalogued in public knowledge bases such as MITRE ATT&CK; the version for industrial control systems lists tactics from initial access to "impair process control" (MITRE ATT&CK for ICS). At bachelor's level you should be able to read such a catalogue and say which techniques a control addresses; you are not asked to perform them.

5.4 Worked example: reading an advisory for CPN (synthetic)

This case is synthetic. A vendor advisory (invented) states: "Remote-access gateway VPN-G versions before 9.3 allow an unauthenticated attacker to execute code. Exploitation has been observed. Fixed in 9.3." Calder Power Networks runs VPN-G 9.1 at head office, reachable from the internet, used by engineers to reach the control network.

Extract: asset — the gateway and everything reachable through it; vulnerability — the flaw in 9.1; threat — any actor scanning the internet, made more likely by observed exploitation; impact — potential access to the control network, hence to feeder operation; control options — upgrade to 9.3 now, or disable the gateway until upgraded and use a supervised alternative. Public catalogues such as CISA's Known Exploited Vulnerabilities list exist precisely to raise the priority of flaws exploited in the wild (CISA KEV). The decision is not difficult; the literacy lies in recognising that "remote access to OT" plus "exploited" plus "internet-facing" outranks a higher-scored flaw on an isolated device.

5.5 Practical activity

Pick one recent advisory from CISA's ICS advisories. Without testing anything, extract asset, vulnerability, affected versions, exploitation status, vendor fix and recommended mitigations. Then write two sentences on how the priority would change for an operator whose device is (a) internet-facing and (b) on an isolated network.

Write the exposure answer as a change in priority with a reason, not a new score. Internet-facing plus exploited usually moves an advisory to emergency handling, as with CPN's VPN-G 9.1; the same flaw on a device reachable only from an isolated cell can wait for the next planned window if compensating controls are checked.

5.6 Common errors and limits

Using "threat", "vulnerability" and "risk" interchangeably.
Assuming confidentiality always comes first.
Treating every incident as an attack; many outages are accidents, and the response differs.
Learning attack techniques operationally without authorisation (Chapter 10).

EX010 shows the first error: calling the cable cut a vulnerability confuses the threat (roadworks) with the weakness (a single cable route). The second makes a CW dosing controller look like a privacy problem when integrity is what protects customers. The third treats a cut cable or a failed update as an incident to investigate for an attacker, delaying repair. The fourth is why every lab here is offline.

Exercises — chapter 5

EX009 — Rank the properties. Objective: apply CIA by asset. Inputs: CVH patient records; CW chlorine-dosing controller; Calder Mutual's card-authorisation service; CEDC's call recordings. Steps: rank C, I and A for each and justify the top property in one sentence. Expected evidence: table. Rubric: 3 = defensible rankings with harm-based reasons (dosing: integrity/safety first); 2 = one weak; 1 = rankings without reasons; 0 = none.

EX010 — Vocabulary under pressure. Objective: use terms precisely. Inputs: "The risk is that the cable is cut by roadworks, which is a vulnerability for CEDC." Steps: rewrite using asset, threat, vulnerability and impact correctly. Expected evidence: one or two sentences. Rubric: 3 = roadworks as threat, single cable route as vulnerability, dispatch availability as impact; 2 = one term misplaced; 1 = two misplaced; 0 = none.

Chapter synthesis

Security literacy is precise vocabulary applied to real consequences. Assets, threats, vulnerabilities, likelihood, impact and controls are distinct ideas. In critical services availability, integrity and safety often outrank confidentiality, and the right priority for an advisory depends on exposure and exploitation, not on a score alone.