Exam Practice

The practice of protecting information from unauthorized access, use, disclosure, modification or destruction, ensuring its confidentiality, integrity and availability throughout its lifecycle, in physical or digital form.

The processes, structures, resources, tools, people and regulations an individual, organization or nation uses to protect its cyber-properties (money, devices, data, services, reputation) from all threats.

Increasing security tends to reduce functionality and ease of use and to raise cost. The system must still work normally and remain usable, so managers balance the three.

Information is accessible only to those authorized to see it. Failure example — a stolen laptop with unencrypted customer data.

Information is accurate, complete and unaltered except by authorized action. Failure example — an attacker changes a wire-transfer amount in transit.

Information and systems are accessible to authorized users when needed. Failure example — ransomware takes hospital records offline for days.

Strengthening one goal often costs another. Stricter access (C) can hurt availability, and extra verification (I) adds friction and cost. Good management chooses the right balance.

The set of policies, processes and organizational practices used to protect an organization's information assets (people, technology and data working together).

Management asks "what should we protect, and why?" (policy, risk, law, compliance). Engineering asks "how do we build it securely?" (secure code, configuration, tools).

The specific system, server, application or data an attacker aims at — the valuable asset.

A weakness or flaw in software, hardware or processes that can be exploited.

Any potential danger, actor or event with the capability to cause harm to a system or to cyber-properties.

The concrete entity behind a threat — a named category of actor with a motive (e.g. a cybercriminal seeking financial gain).

A specific piece of code, script or technique designed to take advantage of a vulnerability.

The pathway or method used to deliver an exploit to the target, e.g. phishing email → stolen VPN password → network login.

The structured, step-by-step sequence of events from the initial breach to the final impact.

An authorized, simulated cyberattack used to find weaknesses before real attackers do; results go back to the system owner so the gap can be closed.

Information/Data, Technology/Systems, Physical, People, and Reputation/Intangible.

Value to the business × sensitivity of the information, rated Low, Medium, High or Critical. Used to prioritize which assets to protect most.

Human/Process (weak passwords, no training, poor procedures), Technical (unpatched, misconfigured, insecure defaults, legacy software), Physical (unsecured facilities, unattended devices).

Insider, external hacker/cybercriminal, organized crime, nation-state, hacktivist, script kiddie/opportunist.

An employee or contractor who misuses legitimate access through grievance, financial gain or negligence. Often underestimated because no break-in is needed.

Phishing/social engineering, malware, unpatched systems, weak or stolen credentials, physical access, third-party/supply chain compromise.

Monitor & Analyze (spot signals early), Penetration Test (find the open window first), and the Security Analyst decides which risks to fix first — risk assessment.

The potential for loss when a threat exploits a vulnerability affecting an asset. Qualitatively, Risk = Likelihood × Impact.

1 Rare, 2 Unlikely, 3 Possible, 4 Likely, 5 Almost Certain.

1 Negligible, 2 Minor, 3 Moderate, 4 Major (serious; possible harm to people or trust), 5 Severe (threatens ability to operate).

Score L × I — Low 1–4, Medium 5–9, High 10–16, Critical 17–25.

Qualitative is fast, judgment-based and used for routine triage. Quantitative uses money (SLE/ALE), needs reliable data, is slower, and is best for budget cases and board reporting.

Single Loss Expectancy, the money lost in one incident. SLE = Asset Value × Exposure Factor.

The percentage of an asset's value lost in a single incident.

Annualized Rate of Occurrence, the expected number of incidents per year (0.5 = once every two years).

Annualized Loss Expectancy, the expected loss per year. ALE = SLE × ARO. It is the number a CFO wants before approving a security budget.

Eliminate the risk entirely by stopping the activity, decommissioning the system or redesigning the process.

Reduce likelihood or impact, e.g. patch the vulnerability, add controls, train staff.

Shift the risk to someone else, e.g. cyber insurance, outsourcing, contractual liability.

Acknowledge and monitor the risk; appropriate when treatment would cost more than the risk itself.

Cost of treatment vs. cost of risk, feasibility, risk appetite (how much risk leadership tolerates), and regulatory or legal requirements.

A living document recording each risk (asset, threat + vulnerability), its likelihood, impact, level, treatment, justification and owner, so it can be tracked and revisited.

High-level, mandatory statement of management intent saying WHAT is required and WHY. Approved at the top (board) and changes rarely.

A specific, mandatory, measurable requirement supporting a policy, e.g. "all workstations encrypted with AES-256 and locked after 5 minutes idle".

Mandatory step-by-step instructions for HOW to meet a standard. The most detailed level and the most likely to change.

Recommended best practice, NOT mandatory, offering judgment where standards don't fully specify, e.g. "consider a privacy screen in public spaces".

The board/executive approves top-level policy. The CISO owns policy content, drafts updates and monitors compliance. The IT manager owns standards and procedures. All staff must comply.

Draft → Review → Approve → Publish & Train → Periodic Review, looping back to Draft when risk, law or technology changes.

Consistency (same rule whoever decides), accountability (evidence of due diligence) and scale (new staff and systems inherit the rule).

Acceptable Use, Access Control, Incident Response and Data Classification policies.

Purpose, Scope, Policy Statement, Roles & Responsibilities, Compliance & Enforcement, Review Date.

Mandatory ("must/shall"), Specific & Measurable (numbers, timeframes), Enforceable (can be audited), Clear to non-technical staff, Practical (people will actually follow it).

A concrete safeguard (mechanism, process or physical measure) that reduces risk and enforces a policy in practice. The policy says WHAT; the control is HOW.

Preventive (stops it — firewall, MFA, lock), Detective (notices it — IDS, logs, CCTV), Corrective (fixes it — restore, patch), Deterrent (discourages it — warning banner, visible camera).

Administrative (people, process, paper — policy, training, background checks), Technical (enforced by systems — encryption, MFA, RBAC), Physical (enforced in the real world — locks, badges, guards).

Layer multiple controls so you never rely on a single one.

Grant only the access a role strictly needs to do its job.

When a decision is unclear, default to deny or off. Example — an unclaimed follow-me print job never prints.

Split sensitive tasks across more than one person so no individual can complete (and hide) a critical action alone.

The policy states what must happen, the control is the safeguard that makes it happen, and the standard gives the exact measurable spec for the control (e.g. badge within 60 s or the job is purged).

Provisioning (create when a person joins), Change (update on role change), Deprovisioning (disable when they leave). Common failure — leavers never deprovisioned.

Authentication (prove who you are), Authorization (decide what you can do), Accounting (record what you did).

Something you KNOW (password), HAVE (badge, phone token), ARE (biometric).

Combining two or more factors from DIFFERENT categories. A stolen password alone is then not enough.

Discretionary Access Control — the resource owner decides who gets access. Flexible, but hard to control centrally.

Mandatory Access Control — the system enforces fixed classification labels against subject clearances; the owner cannot change it. Strong but rigid.

Role-Based Access Control — access by job role. Easy and most widely used; watch for role explosion.

Attribute-Based Access Control — real-time decisions from user, resource and environment attributes (shift, device, patient assignment). Very flexible; harder to design.

Confidentiality model — No Read Up (can't see secrets above you), No Write Down (can't leak secrets below you).

Integrity model — No Read Down (don't trust input from below), No Write Up (can't contaminate data above you).

Rule-based (fixed if/then rules, e.g. firewall), Relationship-based (e.g. doctor of record), Policy-based (central policy engine, close to ABAC).

Recording who did what, when and where, for accountability, detection, compliance (e.g. PDPA) and forensics. Logs must be integrity-protected and kept for a set retention period.

Never trust, always verify. Apply authentication, authorization and accounting continuously; being inside the network does not mean automatic trust.

Confidentiality is organization-centric and control-based (protect data from unauthorized access). Privacy is individual-centric and rights-based (the person controls how their data is used).

Collecting more personal data than needed, or using it for a purpose the person never agreed to — privacy violations even with perfect confidentiality.

Public (no harm — price list), Internal (limited harm — memo), Confidential (real harm — salaries), Restricted (severe harm / legal exposure — patient records).

Impact if disclosed, legal requirements that apply, and what the data owner expects. Higher classification means higher impact and risk score.

At rest (stored — encryption at rest, backup security, masking), in transit (moving — secure channels, VPN, no personal LINE), in use (being viewed — privacy filter, clean desk, auto-lock, logging).

Thailand's Personal Data Protection Act B.E. 2562 (2019), fully enforced from 2022. It applies to personal data of people in Thailand, regardless of where the organization is based. Health data is sensitive personal data.

Consent (clear, informed, with limited exceptions), Purpose limitation (use only for the stated purpose), Data minimization (collect only what is necessary).

Access, rectification, erasure/restriction, objection and data portability — all subject to legal conditions (e.g. medical records must be retained).

The controller decides how and why data is used and bears primary responsibility (MediCare Plus). The processor processes on the controller's instructions (e.g. a cloud vendor).

GDPR (EU, 2018) covers people in the EU with fines up to 4% of global revenue or €20M. PDPA (Thailand, 2022) covers people in Thailand with fines of millions of baht. Both are extraterritorial and have special/sensitive data categories.

Policies and processes preventing sensitive data from leaving without authorization (no personal USB/email/LINE exports, approval for bulk export). Needs classification first, and disclosed rather than covert monitoring.

Build privacy in from the start — proactive not reactive, privacy as the default, privacy embedded into design, end-to-end security.

Data is accurate and trustworthy and is changed only by authorized people, in authorized ways.

Accurate (value correct), Complete (nothing missing), Consistent (systems agree), Current (up to date).

Data integrity means the data values are correct. System integrity means the system works as designed and has not been tampered with (software, server, updates).

Adversarial (someone wants harm), Accidental (mistake), Structural (hardware/software failure), Environmental (nature, events). ISO/IEC 27005 uses Deliberate, Accidental, Environmental.

Spoofing→authentication, Tampering→integrity, Repudiation→non-repudiation, Information disclosure→confidentiality, Denial of service→availability, Elevation of privilege→authorization.

A matrix built from real attacks. Columns are tactics (attacker goals), cells are techniques (e.g. T1565 Data Manipulation under Impact TA0040). There is no "integrity" column.

Software or Data Integrity Failures — trusting updates, code or critical data without checking integrity (unchecked updates, untrusted packages, weak CI/CD). Example — SolarWinds.

CDI (data that must stay correct), UDI (untrusted outside data), TP (the only approved way to change a CDI), IVP (check that CDIs are still correct).

Well-formed transactions (change only via TPs), separation of duties, access triple (User + TP + CDI), audit (every TP logs). A UDI must be checked before it becomes a CDI.

Biba uses integrity levels to stop low-trust data flowing up (military, OS). Clark-Wilson uses business processes against errors and fraud by authorized users (banks, hospitals).

Preventive checks — range, format, mandatory fields, pick lists, double entry, validating UDIs.

One person makes and another checks — doctor/pharmacist, accounts clerk/finance manager, developer/CAB.

RFC → Assess → CAB approve → Test → Deploy to ALL servers → Review, with a rollback plan and configuration baseline.

WHO, WHAT record, WHEN, OLD and NEW value, WHERE (workstation), WHY (reason code). Logs are write-once with synchronized clocks.

A detective control comparing two sources that should match (analyzer vs EHR, dispensed vs ordered). A mismatch is a signal to investigate, not proof — Clark-Wilson's IVP.

3 copies, 2 different storage types, 1 copy off-site. Add an immutable copy and test restores regularly.

5.3 Segregation of duties, 8.13 Information backup, 8.15 Logging, 8.32 Change management.

§10 — an electronic record replaces an original if a reliable method keeps its integrity. §11 — evidential weight depends on how reliably it was created, stored and sent.

Changing or deleting another person's computer data without permission — up to 5 years, up to 100,000 baht, or both. §7 covers unauthorized access to data.

§35 — the controller keeps personal data accurate, current, complete and not misleading. §36 — the data subject may request correction; refusals must be recorded with the reason.

Malware that makes data unusable then demands payment (encrypt, extort, threaten to publish). ATT&CK T1486 Data Encrypted for Impact.

Get in → become admin → spread → steal data → kill defenses (delete backups, stop tools/logs) → encrypt. Encryption is the last step.

Striping. Fastest, 100% capacity (N × S), survives 0 failures. For temporary data only.

Mirroring. Usable capacity S (50% for two disks), survives one disk failure, simple rebuild. For OS disks and small critical servers.

Single distributed parity. Minimum 3 disks, usable (N − 1) × S, survives 1 failure.

Double parity. Minimum 4 disks, usable (N − 2) × S, survives 2 failures. Good for large disks.

Mirror then stripe. Minimum 4 disks, usable N × S ÷ 2, survives 1 failure per pair (both in the same pair = data lost). Fast; for busy databases.

RAID protects against disk failure only. Deletion, corruption and ransomware are written to all disks, and fire or flood destroys all of them.

Recovery Point Objective — maximum acceptable data loss, measured back in time (RPO 1 h means back up at least hourly).

Recovery Time Objective — maximum acceptable downtime before service is restored.

Full = everything. Incremental = changes since the LAST backup (restore full + every incremental). Differential = changes since the last FULL (restore full + latest differential).

A snapshot is on the same storage (backup only if copied out). Replication copies changes in seconds, including the damage, so it is not backup.

Write once, read many — no one, not even an admin, can change or delete data until retention ends, so it survives ransomware with stolen admin credentials.

Isolate → exclude replicas and snapshots → clean rebuild (new servers, reset admin passwords) → pick last good point → restore (full + logs) → verify → go live and re-enter paper records.