Chapter 15 — Security fundamentals | Engineering Information security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 15 — Security fundamentals

Lesson map

Lesson 15 published. Map, example, EX043.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 Three objectives"]
  N2["15.2 Categorising systems"]
  N3["15.3 Threats and vulnerabilities"]
  N4["15.4 Controls"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX043"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 Three objectives"]
  N2["15.2 Categorising systems"]
  N3["15.3 Threats and vulnerabilities"]
  N4["15.4 Controls"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX043"]

[Learning outcomes]
    |
    v
[15.1 Three objectives]
    |
    v
[15.2 Categorising systems]
    |
    v
[15.3 Threats and vulnerabilities]
    |
    v
[15.4 Controls]
    |
    v
[Worked example] --> [Exercise EX043]

Learning outcomes

You will (1) define confidentiality, integrity and availability; (2) categorise systems by impact; (3) relate threats, vulnerabilities and risk.

15.1 Three objectives

Lindiwe studies the security objectives used throughout the field. FIPS 199 defines three: confidentiality, preserving authorised restrictions on access and disclosure; integrity, guarding against improper modification or destruction; and availability, ensuring timely and reliable access. ISO/IEC 27000:2026, the current overview of the ISO/IEC 27000 family, describes information security in the same three terms. She applies them to Saltmarsh: payroll needs confidentiality, delivery records need integrity and the dispatch system needs availability during working hours. Prof. Hale asks her to justify each choice by describing what would happen if that objective failed for a full working day.

15.2 Categorising systems

FIPS 199 asks how severe the impact would be if each objective were lost: low, moderate or high. Lindiwe categorises five Saltmarsh systems. Payroll is high for confidentiality; dispatch is high for availability; the public website is low for confidentiality but moderate for integrity, since defacement harms reputation. Prof. Hale explains the high-water mark: the overall category takes the highest of the three. She learns that categorisation focuses effort on systems whose failure would hurt most. She records each categorisation with a one-line reason for the rating.

15.3 Threats and vulnerabilities

A threat is something that could cause harm, such as a criminal group seeking ransom. A vulnerability is a weakness that a threat could exploit, such as an unpatched server. Risk combines the likelihood that a threat exploits a vulnerability with the impact if it does. Lindiwe reads NIST SP 800-30 Revision 1, which describes this approach to risk assessment. She notes that risk exists only when threat, vulnerability and impact come together for a particular system. She writes one example of each for the dispatch system in her notes.

15.4 Controls

Controls reduce risk by preventing, detecting or correcting harm. Lindiwe classifies examples at Saltmarsh: multi-factor authentication prevents account takeover, log alerts detect suspicious activity and backups correct damage after ransomware. She learns that relying on one type is fragile, because prevention eventually fails. Prof. Hale introduces defence in depth, combining several independent controls so that the failure of one does not expose the system completely, and asks her to show it for payroll. For payroll she lists multi-factor authentication, restricted network access, access reviews, alerts on bulk exports and tested backups as separate layers.

Worked example

Lindiwe defines the three objectives from FIPS 199, categorises five systems with the high-water mark, separates threat from vulnerability and builds layered controls for payroll.

Synthetic case. Categorisations are synthetic.

Errors and limits

Calling a vulnerability a risk ignores threat and impact.

Exercises

EX043 — Integrity definition. How does FIPS 199 define integrity? Rubric: 3 = guarding against improper modification or destruction;; 2 = partly correct;; 1 = vague;; 0 = none.
EX044 — High-water mark. What is the high-water mark? Rubric: 3 = overall category is the highest of the three;; 2 = partly correct;; 1 = vague;; 0 = none.
EX045 — Defence in depth. What is defence in depth? Rubric: 3 = several independent controls;; 2 = partly correct;; 1 = vague;; 0 = none.

Continue studying — lesson 15 (chapter 15 of 50)

← Chapter 14 · Course chapter index · Chapter 16 →

Continue to the next authored lesson.