Chapter 6 — Security basics | Technical Information security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 6 — Security basics

Lesson map

Lesson 06 published. Map, example, EX021.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 Threats and weaknesses"]
  N2["6.2 Controls"]
  N3["6.3 Layers"]
  N4["6.4 People and processes"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX021"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 Threats and weaknesses"]
  N2["6.2 Controls"]
  N3["6.3 Layers"]
  N4["6.4 People and processes"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX021"]

[Learning outcomes]
    |
    v
[6.1 Threats and weaknesses]
    |
    v
[6.2 Controls]
    |
    v
[6.3 Layers]
    |
    v
[6.4 People and processes]
    |
    v
[Worked example] --> [Exercise EX021]

Learning outcomes

You will (1) explain threats, weaknesses and risks; (2) give examples of controls; (3) explain layered protection.

6.1 Threats and weaknesses

A threat is something that could cause harm, such as a criminal sending fake emails. A weakness is a gap that a threat could use, such as a password on a sticky note. Risk is the chance that harm happens and how bad it would be. Chloe lists threats to Westfield: fake emails, stolen tablets, card fraud at tills and mistakes such as sending customer lists to the wrong person. She adds a weakness and a possible harm beside each threat in her notebook, so the list becomes a simple risk table.

6.2 Controls

Controls reduce risk. Some prevent problems, such as multi-factor sign-in. Some detect problems, such as alerts for unusual logins. Some help recovery, such as backups. Chloe matches a control to each threat on her list. For stolen tablets, she suggests screen locks and the ability to wipe them remotely. Mr. Appiah explains that controls should match real risks, not just follow a list. She shows her list to Mr. Doyle, who adds one threat she missed: a supplier's support account with access to the tills. Chloe adds a control for it as well.

6.3 Layers

No single control is perfect. Chloe learns to think in layers. For the online shop, layers include strong passwords, multi-factor sign-in, limiting who has admin access, keeping software updated and watching for unusual orders. If one layer fails, others still protect. Mr. Appiah notes that this layered approach is used everywhere in security, from small shops to large companies. Chloe draws the layers as a simple diagram with the online shop in the middle and each control as a ring around it. Mr. Appiah asks her which ring would be missed first if Mr. Doyle were away for two weeks.

6.4 People and processes

Security is not only technology. Chloe sees that Westfield's biggest risks involve people: staff clicking fake links, managers sending data to the wrong address and suppliers changing bank details by email. She learns that clear processes, such as checking bank detail changes by phone, protect against these. Saltzer and Schroeder's 1975 paper on protecting information described psychological acceptability: security must be easy enough that people use it correctly. Chloe writes down three Westfield processes that protect against people risks and shows them to Mr. Doyle, who confirms they are already used.

Worked example

Chloe defines threats, weaknesses and risk, matches controls to Westfield threats, builds layers for the online shop and recognises people and process risks.

Synthetic case. Examples are synthetic.

Errors and limits

Relying on a single control leaves no protection when it fails.

Exercises

EX021 — Weakness example. Give an example of a weakness. Rubric: 3 = a password on a sticky note;; 2 = one;; 1 = vague;; 0 = none.
EX022 — Tablet controls. Which controls suit stolen tablets? Rubric: 3 = screen locks and remote wipe;; 2 = partly correct;; 1 = vague;; 0 = none.
EX023 — Shop layer. Name one online shop layer. Rubric: 3 = multi-factor sign-in;; 2 = one;; 1 = vague;; 0 = none.
EX024 — Usability principle. What principle says security must be easy to use? Rubric: 3 = psychological acceptability;; 2 = partly correct;; 1 = other;; 0 = none.

Continue studying — lesson 06 (chapter 06 of 18)

← Chapter 05 · Course chapter index · Chapter 07 →

Continue to the next authored lesson.