Chapter 1 — Security foundations for practitioners

Learning outcomes

You will (1) explain core security concepts in business terms; (2) relate them to a credit union's services; (3) recognise where governance adds value.

1.1 Core concepts

Lena Hoffmann has worked for six years in compliance at Marston Credit Union, a fictional member-owned financial cooperative with four hundred staff, savings and loan products, a mobile banking app and card services. She joins the six-month professional course at the fictional Ashby Professional Academy, mentored by Mr. Victor Reyes. Her first module revisits core ideas: confidentiality, integrity and availability, threats exploiting vulnerabilities to cause impact, and controls that prevent, detect or correct. She learns to explain each using Marston's services rather than abstract definitions.

1.2 Applying to Marston

For members' account data, confidentiality and integrity matter most: leaks or wrong balances damage trust and may breach law. For the mobile app, availability matters too, since members expect access at any time. Lena lists threats that matter most: account takeover through stolen passwords, fraud through social engineering of call centre staff, ransomware affecting core banking and errors by suppliers. She learns that understanding the business first lets her judge which controls are proportionate. Account takeover through stolen passwords, for instance, points to stronger authentication on the app rather than more call centre training.

1.3 Where governance helps

Lena's compliance background helps her see where governance adds value. Many controls exist, but nobody checks whether they work. Risk decisions are made informally by IT without involving business owners. The board receives long reports with little analysis. She sees her new role as connecting these pieces: clear ownership, risk decisions documented with business input, controls tested and board reports that enable decisions. Mr. Reyes notes that her compliance discipline is a strong foundation for this broader work. Mr. Reyes adds that the informal IT risk decisions are the first gap to close, because every later step depends on business owners taking part.

Worked example

Lena relates security concepts to Marston's services, lists key threats and identifies where governance would add value.

Synthetic case. Ashby, Marston and all details are synthetic.

Errors and limits

Business framing can oversimplify technology. Threat lists change.

Exercises

• EX001 — Member data priorities. Which security objectives matter most for member account data?
  Show marking criteria

  Rubric: 3 = confidentiality and integrity;; 2 = C and I;; 1 = availability only;; 0 = none.
• EX002 — App availability. Why does availability matter for the mobile app?
  Show marking criteria

  Rubric: 3 = members expect access at any time;; 2 = access;; 1 = vague;; 0 = none.
• EX003 — Social engineering target. Which staff are targeted by social engineering fraud?
  Show marking criteria

  Rubric: 3 = call centre staff;; 2 = call centre;; 1 = vague;; 0 = none.
• EX004 — Governance gaps. Name two governance gaps Lena identified.
  Show marking criteria

  Rubric: 3 = untested controls and informal risk decisions;; 2 = gaps;; 1 = vague;; 0 = none.
• EX005 — Compliance strength. Why is Lena's compliance background useful?
  Show marking criteria

  Rubric: 3 = its discipline is a strong foundation;; 2 = discipline;; 1 = vague;; 0 = none.

Synthesis

Security foundations framed in business terms show where governance adds value.

Continue studying — chapter 01 of 12

← Course home · Course chapter index · Chapter 02 (draft) →