2. Securing Spaces

The CIA Triad

Every security decision in every unit maps back to one or more of the three CIA pillars. The exam presents scenarios and asks which pillar is violated, or which control protects which pillar.

Pillar	Meaning	Example violation	Example control
Confidentiality	Only authorized parties can access the information.	Employee emails a customer list to a personal account.	Encryption, access controls, DLP.
Integrity	Information is accurate and cannot be altered by unauthorized parties.	Attacker modifies financial records in transit.	Cryptographic hashing, digital signatures, audit logs.
Availability	Information and systems are accessible when needed by authorized users.	DDoS attack takes down a banking website.	Redundancy, load balancing, DDoS mitigation, backup power.

Exam tip: A single attack can violate multiple pillars. Ransomware primarily violates Availability (files are locked) but may also violate Confidentiality (data is exfiltrated before encryption). When the question asks "which pillar," identify the primary violation described in the scenario.

Risk Assessment

Risk is quantified as the product of how likely a threat is and how severe its impact would be:

$$\text{Risk} = \text{Likelihood} \times \text{Impact}$$

A standard 5×5 risk matrix assigns values 1–5 to each axis. Controls are recommended in proportion to calculated risk — not every risk justifies the same investment.

Risk Assessment Process

1. Identify assets — what must be protected? (data, hardware, processes, reputation)
2. Identify threats — what could harm those assets?
3. Assess Likelihood × Impact — place each threat on the matrix
4. Recommend proportionate controls — high-risk items get layered controls; low-risk items may need only monitoring

Defense in Depth

No single control is sufficient. Layers of controls across three domains ensure that bypassing one layer does not mean a successful breach.

Domain	Examples
Physical	Locks, fences, mantraps, badge access, security cameras
Logical (Technical)	Firewalls, encryption, access controls, IDS/IPS, MFA
Administrative	Security policies, procedures, training, background checks, separation of duties

An attacker who tailgates into a building (bypasses a physical control) is still stopped by a login password (logical), and may be caught on CCTV reviewed after a SIEM alert (detective + administrative).

Physical Access Controls

Control	How it works	Control type
Badge / keycard	RFID or magnetic-stripe credential grants zone access. Logs entry/exit timestamps. Revocable instantly.	Preventative + Detective
Biometrics	Fingerprint, iris, or facial recognition. Cannot be shared, stolen, or forgotten. High assurance of identity.	Preventative
Mantrap / airlock	Two-door chamber: first door must close before second opens. Prevents tailgating and piggybacking.	Preventative
CCTV	Visible cameras deter attempts (preventative). Footage supports forensic review (detective).	Preventative + Detective

Key distinction: Tailgating = following an authorized person through a door without their knowledge. Piggybacking = doing so with their (sometimes unwitting) consent. Both are defeated by mantraps; badge access alone does not stop either.

Insider Threats

An insider threat originates from someone with authorized access — employee, contractor, or business partner. Two categories:

• Malicious insider: Intentionally abuses access for personal gain, sabotage, or espionage. Their access is legitimate, making detection harder than external threats.
• Negligent insider: Causes harm through carelessness without malicious intent — clicking a phishing link, misconfiguring a server, losing an unencrypted laptop.

Mitigations: Least privilege (limit access to only what is needed), separation of duties (require two people for sensitive actions), UEBA (behavioral analytics to detect anomalies), exit procedures (immediate revocation of access).

The Cyberattack Kill Chain (8 Phases)

Understanding the attack sequence lets defenders identify where they can intervene to stop or limit an attack.

#	Phase	What happens	Defensive opportunity
1	Reconnaissance	OSINT, network scanning, identifying targets	Reduce public footprint; honeypots
2	Weaponization	Crafting the exploit or malicious payload	Threat intelligence; vulnerability patching
3	Delivery	Email attachment, link, USB, or web exploit	Email filtering, user training, web proxy
4	Exploitation	Vulnerability triggered; code executes	Patch management, secure coding, sandboxing
5	Installation	Backdoor, rootkit, or scheduled task installed	Endpoint detection, application whitelisting
6	Command & Control (C2)	Compromised host beacons to attacker infrastructure	DNS sinkholing, outbound firewall rules, SIEM
7	Exfiltration	Data stolen, files encrypted (ransomware), objective achieved	DLP, network monitoring, data classification
8	Evasion	Logs deleted, channels encrypted, traffic blends in	Immutable logs, SIEM correlation, forensics

The Four Security Control Types

Type	When it acts	Examples
Preventative	Before — stops the attack from occurring	Firewalls, access controls, encryption, security training, mantrap
Detective	During/after — identifies that an attack occurred	IDS, audit logs, SIEM alerts, CCTV footage review
Corrective	After — restores normal operations	Incident response plan, data backups, patch management, system reimaging
Compensating	When the ideal control is unavailable — equivalent protection by alternative means	Manual approval workflow when automated MFA is unavailable; network segmentation to isolate an unpatched legacy system

Exam trap: A CCTV camera is both preventative (visible cameras deter) and detective (footage is reviewed after an incident). Classify by the function described in the specific scenario context.

Environmental Threats

Physical infrastructure security extends to environmental risks that directly violate Availability:

• HVAC failure: Server rooms require continuous cooling. Redundant HVAC with automated temperature monitoring is standard data-center practice.
• Fire: Clean-agent suppression systems (not water, which damages electronics) in server rooms. Fire detection and physical compartmentalization limit spread.
• Power failure: UPS (uninterruptible power supply) bridges short outages; diesel generators handle extended outages. N+1 redundancy means at least one backup per critical component.
• Natural disasters: Geographically separated secondary data centers and off-site backups protect against flood, earthquake, and severe weather scenarios.

Worked FRQ Scenario: Unit 2 Style