Chapter 5 — Security literacy
Lesson map
Lesson 05 published. Map, example, EX013.
flowchart TD
N0["Learning outcomes"]
N1["5.1 Three goals"]
N2["5.2 Common threats"]
N3["5.3 Basic controls"]
N4["5.4 Updates"]
N5["5.5 People"]
N6["Proportionate security"]
N7["Backups"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX013"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["5.1 Three goals"]
N2["5.2 Common threats"]
N3["5.3 Basic controls"]
N4["5.4 Updates"]
N5["5.5 People"]
N6["Proportionate security"]
N7["Backups"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX013"]
[Learning outcomes]
|
v
[5.1 Three goals]
|
v
[5.2 Common threats]
|
v
[5.3 Basic controls]
|
v
[5.4 Updates]
|
v
[5.5 People]
|
v
[Proportionate security]
|
v
[Backups]
|
v
[Worked example] --> [Exercise EX013]
Learning outcomes
You will (1) explain confidentiality, integrity and availability for endpoints; (2) describe common threats; (3) understand basic controls.
5.1 Three goals
Tenant records must stay confidential, finance records must be accurate, and staff need laptops that work. Each goal suggests controls: encryption, updates and backups.
Aisha maps each goal to a Bramley system so the triad is not left abstract. Confidentiality matters most for the laptops and the file server, which hold tenant names, addresses and support notes. Integrity matters most for the finance server, where a wrong figure could reach the accounts. Availability matters for the domain server, because all 45 laptops need it to sign in.
5.2 Common threats
Loss and theft, malicious email attachments, unpatched software, weak passwords and misuse of administrator rights are the most common threats to small organisations' endpoints, as NIST SP 800-83 Rev. 1 on malware prevention notes.
Aisha checks which of these threats Bramley has already met. Loss and theft is the clearest, because of the stolen laptop, and many staff hold local admin rights, so admin misuse is possible on most laptops. Patch latency data from chapter 12 later show ten laptops taking more than 30 days to install an update. She records each threat beside the evidence for it, not beside a guess.
5.3 Basic controls
Encryption, timely updates, standard user accounts, screen locks, backups and anti-malware form a basic set that matches CIS Controls v8's early safeguards.
Aisha checks the six controls against Bramley's current state and finds a mixed picture. Anti-malware and the laptop firewall are already on almost everywhere. Encryption covers only 32 of 45 laptops, many staff still have admin rights, screen-lock settings vary, and nobody has yet tested restoring a backup. The gaps tell her where the project should spend its first months.
5.4 Updates
Patching fixes known vulnerabilities. NIST SP 800-40 Rev. 4 describes patching as routine preventive maintenance rather than an emergency activity.
At Bramley, updates arrive monthly, but Gareth has treated them as something to chase when a vendor warning appears. Aisha suggests a fixed monthly cycle: updates are released to a small test group first, then to all laptops, with the result checked a fortnight later. This turns patching into a calendar task instead of a reaction, which suits a charity with one IT officer.
5.5 People
Staff habits matter: leaving laptops in cars, sharing passwords and clicking unexpected links.
The stolen laptop shows how one habit can defeat technical controls: it was left in a car and taken. Aisha does not blame the staff member; she notes that nobody had told staff where laptops should be kept. She lists three habits to address in staff sessions later in the project: where laptops are kept when travelling, never sharing passwords, and reporting unexpected links to Gareth. Gareth adds a fourth habit after the staff meeting: telling him the same day when a laptop is lost, even if staff hope it will turn up.
Proportionate security
A small charity cannot apply every control in large frameworks. CIS Controls v8 groups safeguards into implementation groups, with the first group aimed at organisations with limited IT resources. Aisha uses this group as a starting point, which gives Bramley a recognised, proportionate baseline rather than an arbitrary list.
She explains this to managers as "the essentials first", and lists the safeguards Bramley already meets and those it lacks.
Backups
Backups protect availability and integrity: if a laptop or server fails, data can be restored. Aisha checks that backups exist and that a restore has been tested recently.
Note
Aisha keeps these definitions in a glossary appendix for staff.
Worked example
Aisha presents the six basic controls to Bramley's staff meeting with one example each. A staff member asks why they cannot be administrators on their own laptops. Aisha explains that admin rights let malware or mistakes change system settings, and that Gareth can install needed software quickly.
Synthetic case. Synthetic.
Errors and limits
Controls fail when staff do not understand why they exist.
Exercises
- EX013 — Goals. Apply the three goals to Bramley. Rubric: 3 = tenant confidentiality, finance accuracy, working laptops; 2 = two; 1 = one; 0 = none.
- EX014 — Threats. Name four common endpoint threats. Rubric: 3 = loss/theft, attachments, unpatched, weak passwords, admin misuse; 2 = three; 1 = two; 0 = none.
- EX015 — Admin question. Why not give staff admin rights? Rubric: 3 = malware/mistakes change system; 2 = partial; 1 = vague; 0 = none.
Synthesis
Basic controls address the most common threats.
Continue studying — chapter 05 of 40
← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →