◇ OpenCyber Academy
Technologist · Chapter 5 · English

Chapter 5 — Security literacy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Core security goals"]
  N2["5.2 Assets and threats"]
  N3["5.3 Layered controls"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Core security goals"]
  N2["5.2 Assets and threats"]
  N3["5.3 Layered controls"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Core security goals]
    |
    v
[5.2 Assets and threats]
    |
    v
[5.3 Layered controls]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) explain core security goals; (2) identify assets and threats in the makerspace; (3) describe layered controls.

5.1 Core security goals

Lucas learns the core goals of confidentiality, integrity and availability, plus accountability. For the makerspace, confidentiality protects members' contact and training data; integrity ensures credit balances and bookings are correct; availability means members can book machines when they need them; and accountability means actions such as granting credits can be traced to a person. He notes that the ledger strengthens integrity and accountability, because records are hard to change and signed, but does nothing for confidentiality by itself and can even weaken it if too much data is placed on-chain.

5.2 Assets and threats

Lucas lists assets: credit balances, the keys that issue credits, the booking database, the nodes and the makerspace's reputation. He considers threats in general terms: a lost issuing key could stop credits being granted; a misused key could grant credits without workshops; an exposed database could leak member emails; a failed node could slow bookings. He ranks them by likelihood and impact with the manager. He avoids technical attack detail and focuses on what could happen and what it would cost. The ranked list guides where effort goes first in the coming months.

5.3 Layered controls

Lucas learns to layer controls. Preventive controls stop problems, such as requiring two staff to approve credit grants. Detective controls notice them, such as a daily comparison of workshops taught with credits granted. Corrective controls recover, such as tested node backups. He maps each control to an asset and threat. When one layer fails, another should catch the problem. Ms Adebayo notes that small organisations often rely on a single control, such as trusting one person, and that adding a simple detective check is often the cheapest improvement available.

Worked example

Lucas ranks five assets with the manager and pairs credit issuing with two-person approval, a daily comparison and tested backups.

Synthetic case. The assets, threats and controls are synthetic.

Errors and limits

Relying on a single control, such as trusting one person, leaves no backup when it fails.

Exercises

Synthesis

Security goals, ranked assets and layered controls form a practical foundation.

Continue studying — chapter 05 of 30

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →