What you'll learn
- CIA triad and security principles
- Risk management
- Frameworks you will meet
- Policies, standards, procedures
Lessons
1CIA triad and security principles
Confidentiality, Integrity, Availability are the three properties every control protects. Add authenticity and non-repudiation for transactions.
- Least privilege: grant only the access a role needs.
- Defense in depth: layer preventive, detective and corrective controls.
- Separation of duties: no single person completes a sensitive process alone.
- Zero trust: verify every request explicitly; assume breach.
2Risk management
Risk = Likelihood × Impact. A risk register lists each asset, threat, vulnerability, inherent risk, controls, residual risk and owner.
- Treatment options: mitigate, transfer, avoid, accept.
- Quantitative: ALE = SLE × ARO, where SLE = Asset value × Exposure factor.
- Qualitative heat maps work when data is thin; revisit quarterly.
3Frameworks you will meet
- NIST CSF 2.0: Govern, Identify, Protect, Detect, Respond, Recover.
- ISO/IEC 27001:2022: certifiable ISMS with 93 Annex A controls in 4 themes.
- CIS Controls v8.1: 18 prioritized safeguards with Implementation Groups.
- SOC 2: Trust Services Criteria reports for service providers.
- Regulation: GDPR, India's DPDP Act 2023, EU NIS2, EU Cyber Resilience Act, PCI DSS 4.0.
4Policies, standards, procedures
A policy states intent ("all data is classified"). A standard makes it measurable ("AES-256 for Confidential data"). A procedure gives steps. A guideline is advice. Audit evidence ties each control to proof that it operates.
Hands-on lab: Build a mini risk register
- Pick 5 assets in a small business (email, payroll, website, laptops, customer DB).
- For each, name one threat and one weakness (e.g. phishing / no MFA).
- Score likelihood and impact 1–5; multiply for inherent risk.
- Choose a treatment and one control; re-score residual risk.
- Map each control to a NIST CSF 2.0 function.
Outcome: A 5-row register you can reuse as a template.
Practice questions
A web server outage caused by a DDoS mainly affects which property?
Answer: Availability. DDoS prevents legitimate access, so availability suffers.
Buying cyber insurance is which risk treatment?
Answer: Transfer. Insurance shifts financial impact to a third party.
SLE is $50,000 and ARO is 0.2. What is ALE?
Answer: $10,000. ALE = SLE × ARO = 50,000 × 0.2.
The full graded assessment (6 questions, pass mark 70%) is in the platform.
Key terms
- CIA triad
- Confidentiality, Integrity and Availability: the three core security properties.
- Risk appetite
- The amount of risk an organisation is willing to accept to pursue its goals.
- Residual risk
- Risk remaining after controls are applied.
- ALE
- Annualized Loss Expectancy = Single Loss Expectancy × Annual Rate of Occurrence.
- Compensating control
- An alternative control used when the primary control isn't feasible.
- ISMS
- Information Security Management System, the management framework defined by ISO/IEC 27001.
- Statement of Applicability
- ISO 27001 document listing which Annex A controls apply and why.
- Due diligence
- Investigating and understanding risks before acting (e.g. assessing a vendor).
- Defense in depth
- Layering multiple independent controls so one failure doesn't cause a breach.
- Separation of duties
- Splitting critical tasks so no one person can complete them alone.
See the full cyber security glossary →
Official references
Related courses
Security Architecture & Zero Trust
Designing secure systems: trust boundaries, zero trust architecture, reference models and design reviews.
Data Security & Privacy
Data classification, DLP, encryption and key management, plus GDPR and India's DPDP Act.