Chapter 5 — Security literacy | Bachelor's Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 The three goals"]
  N2["5.2 Assets and threats"]
  N3["5.3 Risk"]
  N4["5.4 Controls"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 The three goals"]
  N2["5.2 Assets and threats"]
  N3["5.3 Risk"]
  N4["5.4 Controls"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 The three goals]
    |
    v
[5.2 Assets and threats]
    |
    v
[5.3 Risk]
    |
    v
[5.4 Controls]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) explain confidentiality, integrity and availability; (2) identify assets and threats; (3) relate controls to risks.

5.1 The three goals

Security is often described through three goals. Confidentiality means information is seen only by those allowed to see it, such as patient records seen only by clinical staff. Integrity means information and systems are not changed improperly, such as test results not altered in transit. Availability means systems work when needed, such as the booking system during opening hours. Priya notices that the goals can conflict: locking down the network might protect confidentiality but harm availability if a needed connection is blocked, so security decisions involve balancing them.

5.2 Assets and threats

An asset is something of value: patient data, the booking system, clinical carts, the clinic's reputation. A threat is something that could harm an asset: malware on a visitor phone, a staff member's stolen password, a failed network switch. A vulnerability is a weakness a threat could exploit, such as a shared wireless network or an outdated protocol. Listing assets first keeps attention on what matters to the clinics. Without that, security work tends to focus on interesting technical issues rather than the ones that would actually hurt patients or staff.

5.3 Risk

Risk combines how likely a harmful event is with how much harm it would cause. A visitor phone infected with malware is fairly likely in a busy waiting room; the harm if it reaches clinical carts could be serious. A switch failure is less likely and causes disruption rather than data loss. Priya rates risks roughly as high, medium or low, recognising that precise numbers are rarely available for small organisations. The value of the exercise is in comparing risks consistently so that limited money and staff time go to the most important ones first.

5.4 Controls

A control reduces risk by lowering likelihood or harm. Separating visitor wireless from clinical devices reduces the likelihood that malware spreads to them. Backups reduce the harm of data loss. Logging does not prevent harm but helps detect and investigate it. Controls are often grouped as preventive, detective and corrective. Priya learns that good designs combine all three, because no preventive control is perfect, and detection and recovery limit the damage when prevention fails. The CIS Controls offer a prioritised list of such safeguards for organisations of different sizes.

Worked example

Priya builds a small risk table for the clinics with five rows; the shared wireless network is rated high likelihood and high impact and placed first.

Synthetic case. The risk table is synthetic.

Errors and limits

Rating risks without first listing assets tends to over-weight technical issues and miss business impact.

Exercises

EX013 — Goal conflict. Give an example where confidentiality and availability conflict at the clinics. Rubric: 3 = strict blocking protects data but blocks a needed service;; 2 = blocking;; 1 = defines terms only;; 0 = none.
EX014 — Control types. Classify central logging as preventive, detective or corrective. Rubric: 3 = detective, explaining it finds rather than stops;; 2 = detective;; 1 = preventive;; 0 = none.
EX015 — Threat versus vulnerability. Distinguish the threat from the vulnerability in "malware on a visitor phone spreads over the shared network". Rubric: 3 = threat malware phone; vulnerability shared network;; 2 = one correct;; 1 = confuses;; 0 = none.

Synthesis

Assets, threats, vulnerabilities, risk and controls form the basic vocabulary of security decisions.

Continue studying — chapter 05 of 40

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →