Chapter 7 — Security concepts in practice | Technologist Information security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Security concepts in practice

Lesson map

Lesson 07 published. Map, example, EX019.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Objectives in daily work"]
  N2["7.2 Least privilege"]
  N3["7.3 Defence in depth"]
  N4["7.4 Controls and risks"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX019"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Objectives in daily work"]
  N2["7.2 Least privilege"]
  N3["7.3 Defence in depth"]
  N4["7.4 Controls and risks"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX019"]

[Learning outcomes]
    |
    v
[7.1 Objectives in daily work]
    |
    v
[7.2 Least privilege]
    |
    v
[7.3 Defence in depth]
    |
    v
[7.4 Controls and risks]
    |
    v
[Worked example] --> [Exercise EX019]

Learning outcomes

You will (1) apply confidentiality, integrity and availability to daily tasks; (2) use least privilege and defence in depth; (3) relate controls to risks.

7.1 Objectives in daily work

Jamal connects the three security objectives to his daily tasks. Restricting the questionnaire folder protected confidentiality. Checking backups protects integrity and availability. Keeping the booking system patched protects all three. ISO/IEC 27000:2026, the overview of the ISO/IEC 27000 family, describes information security in these terms. Ms. Grant asks him to label each task in his notebook with the objective it serves, which helps him explain why the task matters. After a month, he finds that most of his tasks protect availability, which matches the centres' need to keep admitting members.

7.2 Least privilege

Saltzer and Schroeder's 1975 paper describes least privilege: give each user and program only the access needed. Jamal applies it at Riverbend: receptionists need booking access but not finance folders; instructors need questionnaires but not payment data. He notes that least privilege also limits the damage when an account is compromised, because the attacker inherits only that account's limited rights. He reviews the access of five sample accounts against their roles and finds two receptionists who can open finance folders. The IT manager removes the access the same day, and Jamal notes the result in his notebook.

7.3 Defence in depth

No single control is perfect, so security uses layers. Jamal lists layers protecting Riverbend's tills: network separation, up-to-date software, restricted accounts, payment terminal encryption and monitoring. If one fails, others still protect. Ms. Grant explains that layered defence is especially important in small organisations, where any single control may be maintained by one busy person. He draws the layers as rings around the tills in his notebook. Ms. Grant asks him which ring would fail first if the IT technician were on holiday for a month, and he identifies software updates, which leads him to suggest an automatic update setting for the tills supplier to confirm.

7.4 Controls and risks

Jamal learns that controls exist to reduce specific risks. Before adding a control, he asks what risk it reduces and whether that risk matters. He questions a proposal to block all USB storage devices at reception, finding that staff need them for printing posters. He suggests allowing only encrypted, Riverbend-issued devices instead. Ms. Grant praises him for matching controls to real needs. The IT manager orders encrypted memory sticks for each reception desk, and staff report that the change causes no difficulty. Jamal records the decision with the risk it addresses and the reason the original proposal was changed.

Worked example

Jamal labels tasks by objective, applies least privilege to roles, lists layered controls for tills and adapts a USB control to real needs.

Synthetic case. Examples are synthetic.

Errors and limits

Controls that ignore real work needs get bypassed.

Exercises

EX019 — Overview standard. Which standard gives the family overview? Rubric: 3 = ISO/IEC 27000:2026;; 2 = partly correct;; 1 = other;; 0 = none.
EX020 — Compromise limit. How does least privilege limit compromise? Rubric: 3 = attacker inherits limited rights;; 2 = partly correct;; 1 = vague;; 0 = none.
EX021 — USB alternative. What USB alternative does Jamal suggest? Rubric: 3 = Riverbend-issued encrypted devices only;; 2 = partly correct;; 1 = vague;; 0 = none.

Continue studying — lesson 07 (chapter 07 of 30)

← Chapter 06 · Course chapter index · Chapter 08 →

Continue to the next authored lesson.