Protection of Information Assets

When ISACA asks which CIA property was violated, read carefully: data read by an attacker = confidentiality. Data modified = integrity. System taken offline = availability. Encryption protects confidentiality. Hashing protects integrity. Redundancy protects availability. These are different tools for different purposes — the exam tests whether you can match the tool to the property.

MAC is the most secure access control model because users cannot override it. RBAC is the most practical for large organisations. DAC is the least secure because the data owner can grant access at their discretion. When the exam asks which model provides the strongest protection, the answer is MAC. When it asks which is most commonly used in enterprises, the answer is RBAC.

Two passwords is NOT multi-factor authentication — both are 'something you know.' True MFA combines factors from different categories. The CER (Crossover Error Rate) is the best single metric for biometric accuracy — lower is better. Type II errors (false acceptance) are more dangerous from a security perspective because they let impostors in.

Digital signatures use the sender's private key (not public). The receiver verifies using the sender's public key. Hashing is one-way — you cannot reverse a hash to get the original data. SSL/TLS uses asymmetric encryption for key exchange, then symmetric for bulk data transfer (hybrid approach). Encryption provides confidentiality; digital signatures provide integrity. These are different tools for different purposes.

IDS detects but does not block (detective control). IPS prevents and blocks (preventive control). The exam frequently tests this distinction. A stateful firewall tracks connections and is more secure than basic packet filtering. A firewall controls traffic based on rules — it cannot stop encrypted malware, social engineering, or attacks that use allowed ports. It is one layer, not the whole defence.

A man-trap (airlock) is the strongest physical access control for preventing tailgating — only one person enters at a time. Water-based sprinklers damage equipment; prefer FM-200 or inert gas suppression for data centres. The IS auditor should verify that physical access logs are reviewed regularly and that CCTV is operational.

A worm is the most dangerous self-propagating malware because it spreads without user action. The key distinction: viruses need a host, worms don't. For ransomware, the best recovery strategy is tested offline backups. Social engineering attacks are best countered by security awareness training, not technical controls. No antivirus can stop an employee from willingly entering their password.

Penetration testing requires written management authorisation before starting — this is non-negotiable. Vulnerability assessments are broader (find all weaknesses); pen tests are deeper (prove exploitability). Patches should always be tested in a non-production environment before deployment. Vulnerability assessment identifies and classifies. Penetration testing actively exploits. They are NOT the same.

The first priority during an incident is containment (after identification). Evidence preservation is critical — always create a bit-by-bit forensic copy and work on the copy, never the original. If chain of custody is broken, evidence may be inadmissible in court. The auditor's role in incident response is to observe and document, not participate in operational response. Participation compromises independence.

The data owner (business management) determines classification — NOT IT. The data custodian (IT) implements controls. This distinction is heavily tested. Data classification is a business responsibility. Without classification, DLP controls cannot be calibrated, and staff do not know how to handle sensitive data.

Under GDPR, the data controller bears primary responsibility, not the processor. Breach notifications must be made within 72 hours. Know the difference between Privacy by Design (building privacy in from the start) and Privacy by Default (strictest settings are the default). The "right to be forgotten" means data subjects can request deletion of their personal data.

Security awareness training is the most effective control against social engineering attacks. The exam often asks: 'What is the BEST way to prevent phishing?' — the answer is user training, not a technical control. Training should be mandatory, regular, and measured for effectiveness. Security is everyone's responsibility — training must be mandated and monitored by management, not just delivered by IT. Tone from the top matters.