Exam Practice
Cheat sheet, flashcards and concept quiz covering Weeks 1–9 of Security Management, from the CIA triad to availability, backup and ransomware recovery.
Reference text: CSC352 lecture slides (KMUTT SIT); Whitman & Mattord, Principles of Information Security; NIST SP 800-30; ISO/IEC 27001:2022
1. CIA Triad
| Confidentiality | Integrity | Availability | |
|---|---|---|---|
| Question | Is it still secret? | Is it correct? | Can users access it? |
| Definition | Accessible only to the authorized | Accurate, complete, unaltered except by authorized action | Accessible to authorized users when needed |
| Example control | Access control, encryption at rest and in transit | Checksums, audit logs | Load balancing, redundant servers, backups |
| Example failure | Stolen unencrypted laptop; misdirected payroll email | Altered wire transfer or invoice bank account | Ransomware, DDoS, outage |
| Typical threats | Phishing, data breach, spyware | Man-in-the-middle, malware, social engineering | Ransomware, DDoS, account takeover |
1. Security Basics
Triad in tensionMore C can hurt A (doctors locked out in an emergency); more I adds friction and cost.
Security triangleSecurity vs. functionality vs. ease of use, plus cost.
Management vs. engineering"What should we protect, and why?" vs. "How do we build it securely?"
Business impactsOperational disruption, financial loss, legal issues, reputation damage.
2. The Attack Chain
| Term | Meaning | Max7 shop example |
|---|---|---|
| Target | The asset the attacker wants | Customer credit-card database |
| Vulnerability | The weakness | Outdated, unpatched DB software |
| Threat | Potential source of harm | People who want the data |
| Threat actor | Concrete actor with a motive | IT staff of 11-shop (financial gain) |
| Attack vector | The path in | Phishing → stolen VPN password → login |
| Exploit | Code or technique used on the weakness | Running exploit code against the DB flaw |
| Attack | The whole event end to end | Actor uses vector, exploits weakness, reaches target |
2. Assets, Vulnerabilities & Actors
Asset categoriesInformation/Data · Technology/Systems · Physical · People · Reputation/Intangible
CriticalityValue to business × sensitivity → Low / Medium / High / Critical
Prioritize assetsInventory → Value → Prioritize
Vulnerability typesHuman/Process · Technical · Physical
InsiderGrievance, money, negligence — data and systems they already access
CybercriminalFinancial gain — financial and customer data
Nation-stateEspionage, geopolitics — critical infrastructure, IP
HacktivistIdeology — public-facing systems, reputation
DefenderMonitor & Analyze → Penetration Test → Security Analyst decides (risk assessment)
3. Risk Assessment
RiskLikelihood × Impact (each 1–5)
Likelihood1 Rare · 2 Unlikely · 3 Possible · 4 Likely · 5 Almost Certain
Impact1 Negligible · 2 Minor · 3 Moderate · 4 Major · 5 Severe
LevelsLow 1–4 · Medium 5–9 · High 10–16 · Critical 17–25
SLE
ALE
AROTimes per year (0.5 = once in 2 years)
Framework logicIdentify → analyze → evaluate → prioritize (NIST SP 800-30, ISO/IEC 27005)
3. Risk Treatment
| Strategy | Meaning | Example | Rule of thumb |
|---|---|---|---|
| Avoid | Eliminate the risk | Decommission system, stop activity | Critical / High |
| Mitigate | Reduce likelihood or impact | Patch, add controls, train | Critical / High / Medium |
| Transfer | Shift to another party | Cyber insurance, outsourcing | Medium |
| Accept | Acknowledge and monitor | Treatment costs more than the loss | Low |
4. Policy Hierarchy
| Level | Answers | Mandatory? | Example |
|---|---|---|---|
| Policy | Why / what (broad intent) | Yes — board approved, rarely changes | All clinical systems must be kept secure and available. |
| Standard | What exactly (measurable) | Yes | Patch within 30 days of a critical release. |
| Procedure | How, step by step | Yes — changes most often | Monthly patch scans; flagged systems patched within 5 business days. |
| Guideline | Suggested best practice | No | Consider network isolation for unpatchable legacy systems. |
4. Governance & Writing
OwnersBoard approves policy · CISO owns content & monitors · IT Manager owns standards & procedures · Staff comply
LifecycleDraft → Review → Approve → Publish & Train → Periodic Review
Why policyConsistency · Accountability (due diligence) · Scale
Policy typesAcceptable Use · Access Control · Incident Response · Data Classification
Six partsPurpose · Scope · Policy Statement · Roles & Responsibilities · Compliance & Enforcement · Review Date
Five language principlesMandatory (must/shall) · Specific & Measurable · Enforceable · Clear to non-technical staff · Practical
5. Function × Nature Matrix
| Function | Administrative | Technical | Physical |
|---|---|---|---|
| Preventive (stop) | Security awareness training | Firewall, MFA | Locked server room |
| Detective (notice) | Mandatory access review | Intrusion detection system | CCTV |
| Corrective (fix) | Incident response plan | Automated backup restore | Re-key locks after breach |
| Deterrent (discourage) | Signed acceptable use agreement | Login banner "activity is monitored" | Visible camera signage |
5. Secure Design Principles
Defense in depthLayer multiple controls; never rely on one
Least privilegeOnly the access a role strictly needs
Fail-safe defaultsWhen unsure, default to deny / off
Separation of dutiesSplit sensitive tasks across people
Policy → Control → StandardWhat must happen → the safeguard → the exact measurable spec
Follow-me printingPreventive + Technical; least privilege + fail-safe; add walk-through audits for defense in depth
6. Identity & Authentication
Identity lifecycleProvisioning → Change → Deprovisioning
AAAAuthentication (prove) · Authorization (decide) · Accounting (record)
FactorsKnow · Have · Are — MFA needs different categories
Accounting purposesAccountability · Detection · Compliance · Forensics
Log rulesProtect integrity (not editable by the watched); set a sensible retention period
Zero TrustNever trust, always verify; location ≠ trust; continuous AAA
6. Access Control Models
| Model | Who decides | Best fit | Watch out for |
|---|---|---|---|
| DAC | Resource owner | Small teams, flexible sharing | Hard to control centrally |
| MAC | System (fixed labels vs. clearances) | Highly sensitive data | Rigid, hard to change |
| RBAC | Job role | Most organizations | Role explosion |
| ABAC | User + resource + environment attributes | Complex, context-sensitive rules | Harder to design and manage |
6. Bell-LaPadula vs. Biba
| Bell-LaPadula | Biba | |
|---|---|---|
| Protects | Confidentiality | Integrity |
| Read rule | No Read Up | No Read Down |
| Write rule | No Write Down | No Write Up |
| Blocks | Secrets flowing down | Dirty data flowing up |
7. Confidentiality, Privacy & Classification
| Level | Meaning | MediCare Plus example |
|---|---|---|
| Public | No harm if disclosed | Published service price list |
| Internal | Limited harm, internal use only | Department memo, IT meeting notes |
| Confidential | Real harm to the organization | Employee salary records |
| Restricted | Severe harm / legal exposure | Patient medical records |
7. Data States, PDPA & DLP
Confidentiality vs. privacyOrganization-centric, control-based vs. individual-centric, rights-based
At restEncryption at rest, secure storage, backup security, masking, access review
In transitSecure channels, VPN, no sensitive data on personal LINE or email
In usePrivacy filter, clean desk, session auto-lock, access logging
PDPAB.E. 2562 (2019), enforced 2022; people in Thailand (location, not nationality); health = sensitive
PDPA principlesConsent · Purpose limitation · Data minimization
Data subject rightsAccess · Rectify · Erase/Restrict · Object · Portability (with conditions)
Controller / processorDecides why and how (primary responsibility) / acts on instructions
PenaltiesCivil · Administrative (millions of baht) · Criminal
GDPREU 2018; up to 4% global revenue or €20M; extraterritorial
DLPStop unauthorized data exit; needs classification; disclosed monitoring
Privacy by DesignProactive · Privacy by default · Embedded · End-to-end security
8. Integrity Threats
| Source (NIST / ISO) | Example | Matching controls |
|---|---|---|
| Adversarial / Deliberate | Stolen account changes a lab value | Edit rights, audit trail, hash / signature |
| Accidental | Types 50 instead of 5.0 | Input validation, maker-checker, reconciliation |
| Structural / Technical failure | Update converts units wrongly | Change management, testing, rollback |
| Environmental | Power cut leaves record half-written | 3-2-1 backup, RAID, immutable copy |
8. Integrity Models & Controls
IntegrityChanged only by authorized people, in authorized ways
DimensionsAccurate · Complete · Consistent · Current
STRIDES→authN · T→integrity · R→non-repudiation · I→confidentiality · D→availability · E→authZ
Clark-WilsonCDI, UDI, TP, IVP; well-formed transactions, SoD, access triple (User+TP+CDI), audit
PreventiveInput validation, separate change from read, SoD / maker-checker, change management, DB constraints
DetectiveAudit trail (who/what/when/old/new/where/why), reconciliation (IVP), hash, FIM
CorrectiveBackup & restore, immutable copy, versioning, correction with a trail, rollback
Change managementRFC → Assess → CAB → Test → Deploy (all servers) → Review
8. Integrity Standards & Law
ISO/IEC 27001:2022 Annex A5.3 Segregation of duties · 8.13 Backup · 8.15 Logging · 8.32 Change management
ETA B.E. 2544 §10Electronic record = original if a reliable method keeps integrity
ETA §11Evidence weight depends on reliability of creation, storage and transmission
Computer Crime Act §9Altering or deleting others' data — up to 5 years and/or 100,000 baht (§7 = unauthorized access to data)
PDPA §35 / §36Duty to keep data accurate / right to request correction (refusals recorded with reason)
9. RAID
| Level | Method | Min disks | Usable | Failures survived | Use for |
|---|---|---|---|---|---|
| RAID 0 | Striping | 2 | N × S | 0 | Temporary data |
| RAID 1 | Mirroring | 2 | S | 1 (N − 1 for an N-way mirror) | OS disks, small critical servers |
| RAID 5 | Single parity | 3 | (N − 1) × S | 1 | General storage, smaller disks |
| RAID 6 | Double parity | 4 | (N − 2) × S | 2 | Large imaging / file servers |
| RAID 10 | Mirror + stripe | 4 | N × S ÷ 2 | 1 per pair guaranteed | Busy databases (EMR) |
9. Backup, RPO & RTO
RPOMax data loss (back in time) → sets backup frequency
RTOMax downtime → sets restore method and speed
IncrementalSince last backup; restore full + every incremental
DifferentialSince last full; restore full + latest differential
ReplicationSeconds; copies damage too → NOT backup
SnapshotMinutes; same storage → backup only if copied out
Immutable / WORMEven admins cannot delete before retention ends
RAID ≠ backupRAID = hardware failure; backup = data loss
XOR parity, so
Restore orderIsolate → exclude replicas → clean rebuild → pick point → restore → verify → go live