Chapter 15 — Security fundamentals
Lesson map
Lesson 15 published. Map, example, EX043.
flowchart TD
N0["Learning outcomes"]
N1["15.1 Security objectives"]
N2["15.2 Building blocks of risk"]
N3["15.3 Control types"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX043"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["15.1 Security objectives"]
N2["15.2 Building blocks of risk"]
N3["15.3 Control types"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX043"]
[Learning outcomes]
|
v
[15.1 Security objectives]
|
v
[15.2 Building blocks of risk]
|
v
[15.3 Control types]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX043]
Learning outcomes
You will (1) define confidentiality, integrity and availability for Ardwell's assets; (2) link threats, vulnerabilities and impact to risk; (3) distinguish control types.
15.1 Security objectives
Nadia defines what security means for Ardwell's main assets. For customer payment data, confidentiality matters most. For meter readings that drive bills, integrity matters most. For control systems that keep power flowing, availability and safety matter most. She learns that ranking objectives per asset guides control choices, because a control that strengthens confidentiality, such as strict lockout, might weaken availability. Making these priorities explicit helps the board understand why controls differ across the organisation. Strict lockout on control-system consoles, for example, could stop an operator restoring power during an incident.
15.2 Building blocks of risk
Nadia learns the building blocks used in NIST SP 800-30 Rev. 1: threat sources and events, vulnerabilities and predisposing conditions, likelihood and impact. Risk arises when a threat can exploit a vulnerability to cause an impact. She applies this to vendor remote access: the threat is misuse of a vendor account, the vulnerability is a shared password, and the impact is an unplanned outage. Separating the parts helps her see where a control can act, such as replacing the shared password with named accounts. Named accounts address the vulnerability, while session logging would help detect the threat event if the vulnerability returned.
15.3 Control types
Controls can prevent, detect or correct, and they can be administrative, technical or physical. Nadia classifies Ardwell's controls for vendor access: named accounts and approval are preventive; session logging is detective; a tested procedure to revoke access during an incident is corrective. She learns that relying on only one type is fragile, because prevention eventually fails. A balanced set allows Ardwell to stop most problems, notice the rest and recover, which is the basis of defence in depth. For vendor access, the corrective revoke procedure only counts if it has been tested, since an untested procedure may fail during the incident it was written for.
Worked example
Nadia ranks security objectives per asset, decomposes vendor access risk using SP 800-30 terms and balances preventive, detective and corrective controls.
Synthetic case. Assets and controls are synthetic; SP 800-30 Rev. 1 is real.
Errors and limits
Objective rankings can be contested. Classifications blur in practice.
Exercises
- EX043 — Meter priority. Which objective matters most for meter readings? Rubric: 3 = integrity, because readings drive bills;; 2 = integrity, without explanation;; 1 = confidentiality;; 0 = none.
- EX044 — Risk parts. What vulnerability did Nadia identify for vendor access? Rubric: 3 = a shared password;; 2 = shared password, hedged with another option;; 1 = vague;; 0 = none.
- EX045 — Corrective example. Give the corrective control for vendor access. Rubric: 3 = tested procedure to revoke access during incidents;; 2 = revoke;; 1 = vague;; 0 = none.
Synthesis
Clear objectives, risk components and balanced control types form the basis of security governance.
Continue studying — chapter 15 of 50
← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →