## Chapter 1 — Security foundations for practitioners ### Learning outcomes You will (1) explain core security concepts in business terms; (2) relate them to a credit union's services; (3) recognise where governance adds value. ### 1.1 Core concepts Lena Hoffmann has worked for six years in compliance at Marston Credit Union, a fictional member-owned financial cooperative with four hundred staff, savings and loan products, a mobile banking app and card services. She joins the six-month professional course at the fictional Ashby Professional Academy, mentored by Mr. Victor Reyes. Her first module revisits core ideas: confidentiality, integrity and availability, threats exploiting vulnerabilities to cause impact, and controls that prevent, detect or correct. She learns to explain each using Marston's services rather than abstract definitions. ### 1.2 Applying to Marston For members' account data, confidentiality and integrity matter most: leaks or wrong balances damage trust and may breach law. For the mobile app, availability matters too, since members expect access at any time. Lena lists threats that matter most: account takeover through stolen passwords, fraud through social engineering of call centre staff, ransomware affecting core banking and errors by suppliers. She learns that understanding the business first lets her judge which controls are proportionate. Account takeover through stolen passwords, for instance, points to stronger authentication on the app rather than more call centre training. ### 1.3 Where governance helps Lena's compliance background helps her see where governance adds value. Many controls exist, but nobody checks whether they work. Risk decisions are made informally by IT without involving business owners. The board receives long reports with little analysis. She sees her new role as connecting these pieces: clear ownership, risk decisions documented with business input, controls tested and board reports that enable decisions. Mr. Reyes notes that her compliance discipline is a strong foundation for this broader work. Mr. Reyes adds that the informal IT risk decisions are the first gap to close, because every later step depends on business owners taking part. ### Worked example Lena relates security concepts to Marston's services, lists key threats and identifies where governance would add value. > **Synthetic case.** Ashby, Marston and all details are synthetic. ### Errors and limits Business framing can oversimplify technology. Threat lists change. ### Exercises - **EX001 — Member data priorities.** Which security objectives matter most for member account data? *Rubric:* 3 = confidentiality and integrity;; 2 = C and I;; 1 = availability only;; 0 = none. - **EX002 — App availability.** Why does availability matter for the mobile app? *Rubric:* 3 = members expect access at any time;; 2 = access;; 1 = vague;; 0 = none. - **EX003 — Social engineering target.** Which staff are targeted by social engineering fraud? *Rubric:* 3 = call centre staff;; 2 = call centre;; 1 = vague;; 0 = none. - **EX004 — Governance gaps.** Name two governance gaps Lena identified. *Rubric:* 3 = untested controls and informal risk decisions;; 2 = gaps;; 1 = vague;; 0 = none. - **EX005 — Compliance strength.** Why is Lena's compliance background useful? *Rubric:* 3 = its discipline is a strong foundation;; 2 = discipline;; 1 = vague;; 0 = none. ### Synthesis Security foundations framed in business terms show where governance adds value. ### Continue studying — chapter 01 of 12 [← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 (draft) →](#ch-02) ## Worked answers **EX001.** Confidentiality and integrity. **EX002.** Because members expect to reach their accounts at any time. **EX003.** Call centre staff. **EX004.** Controls not checked for effectiveness and risk decisions made informally by IT (also weak board reports). **EX005.** Because compliance discipline is a strong foundation for broader governance work.