Information Security Foundations

Introduction and Context

Modern organisations depend on information to deliver services, make decisions, meet legal obligations and maintain relationships with customers and partners. Information may exist as paper records, databases, email, cloud files, source code, operational technology, intellectual property or human knowledge. Because information supports business activity, its loss, alteration, disclosure or unavailability can cause financial damage, regulatory penalties, safety consequences and reputational harm.

Information security is the discipline of protecting information and information systems from unauthorised access, use, disclosure, disruption, modification or destruction. Cybersecurity is a closely related field concerned especially with protecting digital systems, networks, devices, applications and data from cyber threats. Cybersecurity is therefore an important part of information security, but information security also includes physical records, buildings, people, procedures and non-digital processes.

A sound foundation requires more than memorising security terms. Security professionals must understand how valuable assets are exposed to threats through vulnerabilities, how controls reduce risk, and how security decisions balance confidentiality, integrity and availability. These concepts provide the vocabulary used in standards, policies, audits, incident response and cyber law.

Learning Objectives

By the end of this chapter, you should be able to:

• define information security and distinguish it from cybersecurity;
• identify information assets and explain why they require protection;
• distinguish threats, vulnerabilities, risks and security controls;
• explain attack surfaces and attack vectors;
• describe the confidentiality–integrity–availability (CIA) triad;
• classify controls as physical, administrative or technical;
• apply foundational concepts to a practical organisational scenario; and
• recognise the ethical, governance and legal significance of protecting information.

1. Information Security and Cybersecurity

Information security protects information throughout its lifecycle: creation, collection, storage, processing, transmission, use, sharing, archiving and disposal. Its scope includes people, processes, technology and physical environments. For example, protecting a patient record requires secure software, access rules, trained staff, locked rooms, reliable backups and lawful handling procedures.

Cybersecurity focuses on threats involving digital systems and electronic communications. Examples include phishing, ransomware, malicious code, exploitation of software weaknesses, credential theft, denial-of-service attacks and unauthorised access to cloud services. Cybersecurity also includes resilience: the capacity to continue operating, detect attacks, respond effectively and recover with trustworthy systems and data.

The distinction is useful but not absolute. A stolen laptop is a physical security event with cybersecurity consequences. A malicious employee using legitimate credentials is a personnel and administrative issue expressed through a technical system. Effective protection is consequently layered rather than exclusively technical.

Security objectives are commonly expressed as:

1. Protection: prevent or limit unauthorised actions.
2. Detection: identify suspicious or harmful activity.
3. Response: contain incidents and reduce damage.
4. Recovery: restore services and learn from the event.
5. Governance: establish accountability, acceptable behaviour and compliance.

Security is not the same as absolute secrecy or perfect prevention. Every organisation has limited resources, and controls may introduce cost, inconvenience or operational risk. The professional task is to manage risk proportionately and continuously.

2. Assets: What Must Be Protected?

An asset is anything of value to an organisation, individual or society that requires protection. Assets include more than data. A useful inventory may contain the following categories:

Assets may depend on one another. A web service depends on software, servers, networks, electricity, administrators and data. A security assessment should therefore identify owners, locations, dependencies, sensitivity, criticality and retention requirements.

Asset ownership means accountability for decisions about an asset, such as classification, access and retention. Ownership does not necessarily mean legal possession or daily technical administration. A business manager may own customer data while an IT team operates the database.

Information classification

Classification assigns information-handling requirements according to sensitivity and business value. Typical labels include public, internal, confidential and restricted. Labels must be supported by rules: who may access the information, how it may be transmitted, how long it is retained and how it is destroyed. Over-classification can obstruct legitimate work; under-classification can expose sensitive information.

3. Threats, Threat Actors and Vulnerabilities

A threat is a circumstance, event or actor with the potential to cause harm. Threats may be intentional or accidental, human or environmental, internal or external. Examples include a criminal group deploying ransomware, an employee sending data to the wrong recipient, a flood damaging a data centre, or an unplanned power failure.

A threat actor is the person, group or organisation responsible for, or capable of conducting, a harmful action. Actors may include cybercriminals, insiders, competitors, hacktivists, hostile states, opportunists and careless users. Their capabilities, motives, resources and access affect the plausibility of different scenarios.

A vulnerability is a weakness that could be exploited by a threat. Examples include:

• unsupported software;
• weak or reused passwords;
• excessive user privileges;
• insecure default settings;
• untrained personnel;
• untested backups;
• unlocked equipment rooms; and
• unclear incident-reporting procedures.

A vulnerability is not itself an incident. A misconfigured cloud storage bucket is a weakness; unauthorised downloading of its contents is an event that may become a breach.

An exploit is a method, code or technique used to take advantage of a vulnerability. An attack vector is the route or means by which an attack reaches a target, such as email, a web application, a removable drive, a remote-access service or a supplier connection.

4. Risk and Risk Management

Risk is the possibility that a threat will exploit a vulnerability and produce an adverse consequence. Risk assessment asks what could happen, how likely it is, and how serious the result would be. Risk is not limited to malicious cyberattacks; accidental disclosure and equipment failure can also create significant risk.

A simple qualitative model is:

Likelihood expresses the estimated chance or frequency of a scenario, while impact expresses the severity of its consequences. This expression is a decision aid, not a universal law of probability. Organisations may use scales such as low, medium and high, or numerical scoring systems. Numerical scores should not be treated as precise measurements unless the organisation has a defensible method, consistent definitions and suitable evidence.

For example, suppose a team rates the likelihood of a phishing-related account takeover as 4 on a five-point scale and its impact as 5. A simple score is:

The score has meaning only within that organisation’s defined scale. It does not mean that the event has a 20 percent probability. The assessment should also document assumptions, existing controls, affected assets and uncertainty.

Risk treatment generally involves four choices:

• Avoid: stop the activity that creates unacceptable risk.
• Reduce or modify: implement controls that lower likelihood or impact.
• Transfer or share: use insurance, contracts or outsourcing arrangements, recognising that accountability may remain with the organisation.
• Accept: knowingly retain the risk within approved tolerance.

Risk management is continuous. New software, suppliers, laws, vulnerabilities and business processes can change the risk profile. Residual risk is the risk remaining after controls have been applied; it should be formally understood and accepted by an authorised person where appropriate.

5. The Confidentiality–Integrity–Availability Triad

The CIA triad is a foundational model for describing information-security objectives.

Confidentiality

Confidentiality means that information is not disclosed to unauthorised people, processes or systems. Controls supporting confidentiality include access permissions, encryption, authentication, data classification, secure disposal and privacy procedures. A confidentiality failure may involve a stolen password, accidental email disclosure or excessive database access.

Confidentiality is not identical to privacy. Privacy concerns the appropriate collection, use, sharing and rights associated with personal information. Confidentiality is a security property that helps enforce privacy, but privacy also involves lawful purpose, transparency, minimisation and individual rights.

Integrity

Integrity means maintaining the accuracy, completeness, consistency and trustworthiness of information and systems. Integrity controls include change management, input validation, hashes, digital signatures, version control, separation of duties and audit logs. Altering a bank-account number or examination result is an integrity failure even if no information is disclosed.

Integrity has two related dimensions. Data integrity concerns whether data is correct and unaltered; system integrity concerns whether systems operate according to authorised design and have not been tampered with.

Availability

Availability means that authorised users can access information and services when needed. Availability depends on capacity, resilience, maintenance, redundancy, backups, incident response and recovery arrangements. Ransomware, distributed denial-of-service attacks, hardware failure and natural disasters can all reduce availability.

The triad involves trade-offs. Strong confidentiality controls may slow access; extensive integrity checks may consume processing capacity; high availability may require redundant infrastructure and greater cost. The appropriate balance depends on the mission and consequences of failure. In a hospital, availability of clinical systems may be urgent, while confidentiality remains essential. Security design must address all three objectives rather than treating one as universally dominant.

A broader set of objectives is sometimes used. Authenticity concerns whether an identity, message or source is genuine; accountability supports tracing actions to responsible entities; and non-repudiation provides evidence that a party performed an action, subject to legal and technical limitations. These properties complement rather than replace the CIA triad.

6. Attack Surface and Exposure

An attack surface is the total set of points through which an unauthorised party might attempt to enter, affect or extract value from an organisation or system. It includes technical, human and physical elements:

• internet-facing applications and APIs;
• open ports and remote-access services;
• employee accounts and endpoints;
• cloud identities, storage and configuration interfaces;
• suppliers and software dependencies;
• wireless networks and removable media;
• offices, equipment rooms and discarded documents; and
• social processes vulnerable to deception.

Attack surface is dynamic. Remote work, mobile devices, software updates, mergers, new suppliers and Internet of Things devices can expand it. Attack-surface management involves discovering assets, identifying exposure, prioritising weaknesses, reducing unnecessary services, monitoring changes and verifying that controls remain effective.

Attack surface should not be confused with attack vector. The surface is the collection of possible exposure points; a vector is a particular route used in an attack. For example, an organisation’s email service is part of its attack surface, while a phishing message delivered through email is one attack vector.

7. Security Controls and Defence in Depth

A security control is a safeguard or countermeasure that modifies risk. Controls may prevent, deter, detect, correct, recover from or compensate for harmful events. A strong programme uses defence in depth: several independent or complementary layers so that failure of one control does not automatically produce compromise.

Control classifications by nature

A further classification describes function:

• Preventive controls attempt to stop an unwanted event, such as least privilege.
• Deterrent controls discourage action, such as warning notices or visible cameras.
• Detective controls identify events, such as monitoring and intrusion detection.
• Corrective controls restore or correct conditions, such as malware removal.
• Recovery controls return operations to an acceptable state, such as tested backups and alternate facilities.
• Compensating controls provide an alternative when the preferred control cannot be implemented.

These categories can overlap. A security camera may deter and detect; multifactor authentication primarily prevents unauthorised login but may also generate alerts. Classification should reflect the control’s actual function in context.

Foundational control principles

Least privilege grants only the access necessary for an authorised task and for no longer than needed. Need to know limits access according to a person’s actual requirement for particular information. Separation of duties divides critical tasks among people or roles to reduce fraud and error. Fail-safe defaults deny access unless it is explicitly authorised. Secure by design incorporates security early rather than treating it as a late addition.

Controls should be usable. A control that is so inconvenient that employees routinely bypass it may create new risk. Effectiveness should be evaluated through evidence such as test results, audit records, incident trends and recovery exercises—not merely by the existence of a policy.

8. Physical, Administrative and Technical Security in Practice

Physical security addresses the tangible environment. Examples include access badges, visitor registers, locked server racks, environmental monitoring, backup power, fire protection and secure destruction of paper. Physical controls protect availability as well as confidentiality. An attacker does not need to exploit software if an unlocked server room permits direct access.

Administrative security, also called managerial or organisational security, governs behaviour and decision-making. Policies define acceptable use, access management, data handling, incident reporting and retention. Procedures explain how policies are applied. Training develops competence, while contracts and supplier assessments extend expectations beyond the organisation. Governance assigns responsibility and establishes review mechanisms.

Technical security uses hardware and software mechanisms. Examples include identity and access management, multifactor authentication, network segmentation, secure configuration, vulnerability management, encryption, endpoint detection, logging and backup systems. Technical controls are powerful but depend on accurate configuration, maintenance and human oversight.

A mature programme combines all three. For example, protecting a restricted archive may require a locked room and fire suppression (physical), an approved retention policy and staff training (administrative), and encrypted access-controlled records with monitoring (technical).

9. A Practical Security Assessment Method

A certificate-level assessment can follow these steps:

1. Define scope and objectives. Identify the system, process, location or service being assessed.
2. Identify assets and owners. Record information, hardware, software, people, services and dependencies.
3. Identify threats and threat actors. Consider accidents, environmental events, insiders and external attackers.
4. Find vulnerabilities and exposure. Review configurations, permissions, procedures, facilities and suppliers.
5. Map scenarios to CIA impacts. Describe what could be disclosed, changed or made unavailable.
6. Estimate likelihood and impact. Use a documented qualitative or quantitative method.
7. Select and prioritise controls. Consider effectiveness, cost, usability, legal requirements and residual risk.
8. Implement, test and monitor. Verify that controls work in practice.
9. Review and improve. Update the assessment after incidents, changes or new information.

This method supports frameworks such as the NIST Cybersecurity Framework and ISO/IEC 27001, although organisations should consult the current official versions and applicable sector requirements. Frameworks organise good practice; they do not eliminate the need for professional judgement.

10. Illustrative Case: Community Clinic Ransomware Exposure

Background. A small community clinic uses a cloud patient-record system, ten staff laptops, a wireless network and an internet-connected medical device. Staff share a general account for convenience, and backups are configured but have never been restored in a test.

Problem. An employee receives a convincing invoice email and enters credentials into a false login page. An attacker uses the credentials to access the cloud system and deploys ransomware on several laptops. The clinic cannot retrieve appointments, and staff begin using temporary paper records.

Analysis. The patient records are critical assets. The phishing message is an attack vector; stolen credentials are the immediate enabler; shared accounts, absent multifactor authentication and inadequate staff awareness are vulnerabilities. The incident threatens confidentiality through unauthorised access, integrity through possible alteration of records, and availability through encryption and system disruption. The untested backup creates recovery uncertainty.

Approach. The clinic first activates its incident procedure, contacts the provider and relevant authorities as required, isolates affected devices and preserves evidence. It verifies patient-safety procedures and communicates through an approved channel. It then introduces individual accounts and multifactor authentication, disables unnecessary access, resets credentials, patches endpoints, improves email filtering and conducts phishing-awareness training. Backups are separated from ordinary user access and restoration is tested. The clinic also reviews supplier responsibilities, retention requirements and breach-notification obligations under applicable law.

Outcome. Operations resume using verified clean systems and tested backups. The clinic records lessons learned and schedules periodic access reviews and recovery exercises. No single control solved the problem: administrative training, technical authentication and recovery capability worked together.

Learning points. Convenience-based shared accounts weakened accountability and least privilege. A backup is not a dependable recovery control until restoration has been tested. Incident response must address patient safety, evidence, communication and legal duties as well as technical containment.

11. Ethics, Governance and Legal Significance

Information-security professionals hold positions of trust. They may access sensitive personal, financial, health or business information. Ethical practice requires authorised access, respect for privacy, accurate reporting, responsible disclosure and avoidance of unnecessary harm. Security testing must have defined permission, scope and rules of engagement; unauthorised testing can be unlawful even when the tester claims benevolent intent.

Governance establishes who is accountable for security decisions. Boards and senior managers set risk appetite and allocate resources; data owners define handling requirements; technical teams implement controls; users follow procedures and report concerns. Clear accountability helps prevent the assumption that “someone else” is responsible.

Cyber laws vary by jurisdiction, but common legal themes include privacy and data protection, unauthorised access, misuse of computer systems, breach notification, electronic communications, intellectual property, records retention and critical-infrastructure obligations. Organisations should not infer legal compliance merely from deploying a technical product. Legal duties depend on facts such as jurisdiction, data type, sector, contractual commitments and the nature of an incident. Professional practice therefore includes consulting current laws, regulators, contracts and qualified legal advisers.

12. Contemporary Developments and Limitations

Cloud computing changes where assets and controls are located. Responsibility is shared among the customer, provider and other parties; outsourcing infrastructure does not outsource accountability. Zero-trust approaches assume that network location alone does not establish trust and emphasise explicit verification, least privilege and continuous assessment.

Artificial intelligence can assist alert triage, anomaly detection and vulnerability analysis, but it can also generate convincing phishing content, discover weaknesses and amplify misinformation. AI systems introduce additional concerns involving training data, privacy, model integrity, prompt manipulation and explainability. Human review, access controls, logging and governance remain necessary.

Security metrics can be useful, but simplistic counts—such as the number of blocked attacks—may create a misleading impression of safety. Better evaluation considers exposure reduction, patch timeliness, privileged-access review, incident detection time, recovery performance and control coverage. No framework, certification or tool guarantees security. Threats evolve, dependencies fail and people make mistakes; resilience depends on continual learning and adaptation.

Best-Practice Checklist

• Maintain an accurate asset inventory and identify owners.
• Classify information and apply handling rules.
• Use unique accounts, least privilege and multifactor authentication for important systems.
• Patch supported software and remove unnecessary services.
• Segment sensitive systems and monitor important activity.
• Encrypt sensitive data appropriately in storage and transit.
• Maintain backups that are protected from compromise and regularly restored in tests.
• Train staff to recognise phishing and report incidents promptly.
• Control physical access and securely dispose of equipment and records.
• Review suppliers, contracts, legal duties and shared-responsibility arrangements.
• Test incident-response and business-continuity plans.
• Measure effectiveness and improve controls as circumstances change.

Chapter Summary

Information security protects information and systems through their lifecycle, while cybersecurity concentrates on digital threats and environments. Assets include information, technology, people, services, facilities and trust. Threats create potential harm, vulnerabilities provide weaknesses, attack vectors provide routes, and risk describes the possibility and consequence of harmful events. Controls reduce risk and may be physical, administrative or technical; effective programmes use defence in depth and test controls in practice.

The CIA triad frames three essential objectives: confidentiality prevents unauthorised disclosure, integrity protects accuracy and trustworthiness, and availability ensures authorised access when needed. Attack-surface management identifies and reduces possible exposure. Risk management involves assessment, treatment, acceptance of residual risk and continuous review. Ethical conduct, governance and applicable law shape how controls are selected and used. The clinic case demonstrates that resilient security depends on coordinated people, processes, technology and recovery capability.

Key Terms

Information security: Protection of information and systems from unauthorised access, use, disclosure, disruption, modification or destruction.

Cybersecurity: Protection of digital systems, networks, devices, applications and data from cyber threats.

Asset: Anything of value requiring protection.

Asset owner: Person or role accountable for decisions concerning an asset.

Threat: A circumstance, event or actor with potential to cause harm.

Threat actor: Person, group or organisation capable of conducting a harmful action.

Vulnerability: A weakness that can be exploited.

Exploit: A method or technique used to take advantage of a vulnerability.

Attack vector: A route or means used to reach a target.

Risk: The possibility that a threat exploits a vulnerability and causes adverse consequences.

Control: A safeguard or countermeasure that modifies risk.

Residual risk: Risk remaining after controls are applied.

Confidentiality: Protection against unauthorised disclosure.

Integrity: Maintenance of accuracy, completeness and trustworthiness.

Availability: Accessibility of information and services to authorised users when needed.

Attack surface: The total set of possible exposure points.

Least privilege: Granting only the access necessary for an authorised task.

Defence in depth: Use of multiple complementary security layers.

Multifactor authentication: Authentication requiring two or more distinct factor types.

Governance: Direction, accountability and oversight of security decisions.

Review Questions

Short Answer Questions

1. Define information security and explain one way it differs from cybersecurity.
2. What is the difference between a threat and a vulnerability?
3. Name and explain the three elements of the CIA triad.
4. What is an attack surface, and why does it change over time?
5. Give one example each of a physical, administrative and technical control.

Long Answer Questions

1. Explain how assets, threats, vulnerabilities, attack vectors and controls are related in a risk scenario.
2. Discuss the CIA triad and explain why improving one objective may create tensions with another.
3. Compare physical, administrative and technical security, using an integrated example.
4. Describe a practical risk-management process from asset identification through monitoring.
5. Explain why tested backups, incident response and governance are necessary even when preventive controls exist.

Analytical / Application Questions

1. A college stores examination results in a cloud application. A lecturer’s account has excessive privileges, multifactor authentication is unavailable, and the provider has not documented restoration times. Identify the principal assets, vulnerabilities, likely threats and CIA consequences. Recommend prioritised controls.
2. An organisation has installed a firewall but continues to experience account takeovers caused by phishing. Analyse why the firewall is insufficient and design a layered physical, administrative and technical response.
3. A manager proposes accepting the risk of shared administrator accounts because individual accounts would be inconvenient. Evaluate the proposal using accountability, least privilege, integrity and residual-risk principles.

Multiple Choice Questions with Answers

Question 1

Which statement best defines information security?

A. Protection of only internet-connected computers

B. Protection of information and systems from unauthorised access, use, disclosure, disruption, modification or destruction

C. A process for purchasing antivirus software

D. A legal process used only after a data breach

Correct Answer: B. Protection of information and systems from unauthorised access, use, disclosure, disruption, modification or destruction

Question 2

Which CIA objective is primarily affected when an unauthorised person reads a patient record?

A. Availability

B. Integrity

C. Confidentiality

D. Redundancy

Correct Answer: C. Confidentiality

Question 3

A misconfigured cloud storage bucket is best classified as a:

A. Vulnerability

B. Threat actor

C. Control

D. Recovery event

Correct Answer: A. Vulnerability

Question 4

Which option is an administrative control?

A. Firewall rule

B. Locked server-room door

C. Security-awareness policy and training

D. Disk encryption

Correct Answer: C. Security-awareness policy and training

Question 5

What is an attack vector?

A. The complete inventory of organisational assets

B. A route or means by which an attack reaches a target

C. The impact rating assigned to an incident

D. A physical backup device

Correct Answer: B. A route or means by which an attack reaches a target

Question 6

Using the chapter’s simple model, if likelihood is rated 3 and impact is rated 4, what is the risk score?

A. 7

B. 12

C. 1

D. 34

Correct Answer: B. 12

Question 7

Which practice best demonstrates least privilege?

A. Giving every employee administrator access

B. Allowing access only to the resources required for a current job

C. Using one shared account for convenience

D. Disabling all audit logging

Correct Answer: B. Allowing access only to the resources required for a current job

Question 8

Why should backups be restored in tests?

A. To make backups publicly accessible

B. To verify that recovery is actually possible and dependable

C. To eliminate the need for incident response

D. To increase the attack surface

Correct Answer: B. To verify that recovery is actually possible and dependable

Question 9

Which statement correctly distinguishes a threat from a threat actor?

A. A threat is a weakness; a threat actor is a control

B. A threat is potential harm; a threat actor is a person or group capable of causing it

C. A threat is always accidental; a threat actor is always technical

D. There is no meaningful distinction

Correct Answer: B. A threat is potential harm; a threat actor is a person or group capable of causing it

Question 10

Which combination represents defence in depth?

A. One password shared by all users

B. A firewall alone with no monitoring

C. Multifactor authentication, staff training, monitoring and tested backups

D. Removing all access controls to improve availability

Correct Answer: C. Multifactor authentication, staff training, monitoring and tested backups