Tutorial 1: Enterprise Security Principles

Unit 1 ยท Security foundations and risk

Objectives

The CIA triad and beyond

Confidentiality limits information disclosure, integrity protects correctness and provenance, and availability keeps authorized services usable. Real systems also require authenticity, accountability, privacy, and non-repudiation. A control should be connected to a concrete asset and objective rather than added because it sounds secure.

Asset: payroll records
Threat: unauthorized disclosure
Objective: confidentiality
Controls: least privilege, encryption, access logging

Security boundaries exist wherever trust, privilege, data classification, or administrative responsibility changes. A browser-to-API boundary is different from an API-to-database boundary, but both deserve explicit assumptions. Security architecture is the practice of making those assumptions visible and reducing blast radius when one control fails.

Security as risk

Risk combines an adverse event, its likelihood, and its impact. Quantitative estimates can be useful, but qualitative scales are often more honest when evidence is limited. A security decision should state what is protected, from which scenario, at what cost, and what residual risk remains.

Exercises

  1. Classify customer records, a public brochure, and an uptime monitor by CIA priority.
  2. Draw trust boundaries for a browser, API, database, and administrator console.
  3. Write one risk statement in the form asset, threat, impact, and likelihood.

Self-check

  1. What does integrity protect?
  2. Why are trust boundaries useful?
  3. What is residual risk?

Self-Check Quiz

1. Which objective concerns unauthorized disclosure?

AnswerConfidentiality.

2. Does encryption alone guarantee availability?

AnswerNo. Encryption primarily supports confidentiality and sometimes integrity; availability requires other controls.

3. What makes a risk statement actionable?

AnswerIt names an asset, adverse event, impact, likelihood or conditions, and a decision-relevant control or treatment.

Homework

  1. Threat-model a university identity service using CIA and trust boundaries.
  2. Create an asset inventory with owner, classification, and security objectives.
  3. Recommend three controls and state their residual risks.
Sample answer

A strong inventory identifies credentials and personal data as high-confidentiality assets, authorization records as high-integrity assets, and login availability as operationally important. Controls may include MFA, least privilege, encryption, monitoring, and tested recovery. Residual risks include compromised endpoints, recovery-channel abuse, and misconfiguration.