Information Security Foundations and Threat Landscape

Introduction and Context

Information security is the disciplined protection of information and information systems against unauthorized access, use, disclosure, disruption, modification, or destruction. It applies to data in digital, printed, verbal, and physical forms, and to the people, processes, technologies, and facilities that create, store, process, transmit, and dispose of that information.

The importance of information security has expanded with cloud computing, mobile work, software supply chains, artificial intelligence, connected devices, and digitally dependent business processes. A security failure can cause more than data loss. It may interrupt essential services, create legal liability, damage reputation, endanger individuals, or undermine public trust. Consequently, security is not only a technical function. It is also a governance, risk-management, operational, legal, and ethical concern.

This chapter establishes the vocabulary and analytical foundation required for later study of cryptography, network security, secure software, identity management, incident response, and security governance. It emphasizes an important principle: security decisions must be based on risk and business context rather than on technology alone.

Learning Objectives

After completing this chapter, the reader should be able to:

1. Define information security and distinguish related security terms.

2. Explain confidentiality, integrity, and availability as the CIA triad.

3. Relate authenticity, accountability, and non-repudiation to security objectives.

4. Distinguish assets, threats, vulnerabilities, attacks, risks, and controls.

5. Analyze attack surfaces and attack paths.

6. Classify contemporary threat actors and explain their motivations and capabilities.

7. Select proportionate preventive, detective, corrective, deterrent, and compensating controls.

8. Evaluate security decisions using technical, organizational, ethical, and regulatory perspectives.

Information Security Terminology and Scope

Information security concerns the protection of information regardless of its medium. Cybersecurity is often used more narrowly for the protection of digital systems, networks, software, and data from cyber threats. The terms overlap, but information security also includes physical records, human procedures, and non-networked systems. For example, preventing unauthorized access to a paper personnel file is an information-security activity even if no computer is involved.

A security objective is a desired protection property, such as confidentiality or availability. A security requirement translates that objective into a specific, testable expectation. For example, “customer records must remain confidential” is an objective; “customer records must be encrypted in transit and accessible only to approved roles” is a set of requirements.

A policy expresses management intent and mandatory principles. A standard provides specific mandatory requirements, such as password or encryption requirements. A procedure gives step-by-step instructions, while a guideline offers recommended but generally non-mandatory advice. Confusing these forms can create either excessive rigidity or inadequate control.

Security assurance is justified confidence that controls are correctly designed, implemented, and operating effectively. Assurance can involve testing, audit, code review, penetration testing, certification, monitoring, and independent assessment. It is not identical to security: a system may be secure in some respects but poorly assured, or well documented but insecure in practice.

Privacy and security are related but distinct. Security protects information and systems from harmful or unauthorized events. Privacy concerns the appropriate collection, use, disclosure, retention, and rights associated with information about individuals. Strong security is often necessary for privacy, but a system can be secure while using personal data in an excessive or unfair manner.

The CIA Triad

The CIA triad is the foundational model of information security. It consists of confidentiality, integrity, and availability. The triad is a useful starting point, not a complete description of every security requirement.

Confidentiality

Confidentiality is the property that information is not made available or disclosed to unauthorized individuals, entities, or processes. It is supported by access control, authentication, encryption, data classification, secure disposal, physical protection, and personnel procedures.

Confidentiality failures include viewing medical records without authorization, exposing credentials in a public repository, or sending a confidential report to the wrong recipient. Confidentiality is not equivalent to secrecy in an absolute sense. Authorized disclosure is permitted, and the appropriate level of confidentiality depends on classification and business purpose.

Integrity

Integrity is the protection of information and systems against improper modification or destruction, including ensuring authenticity and accuracy where required. Integrity applies to data, software, configurations, logs, transactions, and system states.

Controls supporting integrity include hashes, digital signatures, access restrictions, input validation, version control, segregation of duties, database constraints, backups, and change-management procedures. A file can remain confidential while its contents are altered; therefore confidentiality does not guarantee integrity.

Availability

Availability is the property of being accessible and usable on demand by an authorized entity. Availability depends on capacity, resilience, maintenance, recovery, redundancy, environmental protection, and resistance to disruption.

Denial-of-service attacks, ransomware, equipment failure, power loss, software defects, and poorly planned maintenance can affect availability. Availability requirements should be expressed in business terms, such as maximum tolerable downtime or recovery objectives, rather than treated as an unlimited demand for continuous service.

Tensions Among the Objectives

The CIA objectives can conflict. Strong authentication or extensive inspection may reduce convenience or performance. A highly redundant architecture may increase cost and complexity. Emergency access may improve availability while increasing confidentiality risk. Security design is therefore a process of balancing requirements according to the value of assets, likely threats, legal obligations, and organizational risk tolerance.

Additional Security Properties

Authenticity

Authenticity is confidence that an entity, message, system, or data source is genuine. Authentication is the process of verifying an identity or claimed origin. A password, hardware token, biometric characteristic, certificate, or cryptographic signature may contribute to authentication.

Authenticity is different from authorization. Authentication answers “Who or what is this?” Authorization answers “What is this entity allowed to do?” An authenticated user may still be unauthorized to access a particular record.

Data authenticity may be established through a trusted source, digital signature, message authentication code, secure provenance, or controlled production process. Authenticity claims always depend on trust assumptions. If a private signing key is stolen, a technically valid signature may no longer provide reliable evidence of the legitimate signer.

Accountability

Accountability is the ability to associate actions with responsible entities and to support investigation or corrective action. It depends on reliable identification, authorization records, tamper-resistant logging, time synchronization, monitoring, and organizational processes.

Accountability is broader than logging. A log that records an account name is weak evidence if accounts are shared, credentials are compromised, clocks are inaccurate, or administrators can silently alter records. Effective accountability requires both technical evidence and governance, including defined responsibilities and retention practices.

Non-repudiation

Non-repudiation refers to evidence that supports the claim that a particular entity performed an action or approved a message, so that the entity cannot credibly deny it later. Digital signatures, trusted timestamps, transaction records, and controlled identity processes may support non-repudiation.

The term should be used carefully. Technology rarely provides absolute proof that a human acted personally. Non-repudiation depends on key custody, identity assurance, signing procedures, legal rules, system integrity, and the ability to demonstrate that credentials were not misused. In some contexts, “non-repudiation” is better understood as evidential support rather than an unconditional technical guarantee.

Assets, Threats, Vulnerabilities, Attacks, and Risk

An asset is anything valuable to an organization or stakeholder and therefore worthy of protection. Assets include data, applications, hardware, networks, cloud resources, intellectual property, credentials, facilities, services, reputation, safety, and business processes. Asset value is context-dependent. A public web page may have low confidentiality value but high availability and integrity value.

A threat is a potential cause of an unwanted incident. Threats may be intentional, accidental, environmental, technical, or organizational. Examples include a criminal group, an insider mistake, a flood, a software defect, or a power failure.

A threat actor is the person, group, organization, or system that performs or enables a threat action. A threat event is a specific occurrence or circumstance that could adversely affect an asset. A vulnerability is a weakness that can be exploited or triggered. Vulnerabilities may exist in software, configuration, architecture, processes, physical arrangements, or human behavior.

An attack is an intentional attempt to gain unauthorized access, cause harm, or violate a security property. An exploit is a technique, code, or procedure that uses a vulnerability. Malware, phishing, credential theft, SQL injection, and denial-of-service are examples of attack methods or categories, although the precise meaning depends on context.

Risk is the possibility that a threat will exploit a vulnerability and cause adverse consequences. In practical risk analysis, risk is often described qualitatively as a combination of likelihood and impact. This is not a universal physical law or a precise probability equation; organizational methods may use ordinal scales, estimated probabilities, financial models, or scenario analysis. A useful conceptual relationship is:

Risk is assessed from likelihood and impact.

Likelihood describes how plausible or frequent an event is under stated assumptions. Impact describes the consequence if it occurs, including financial, operational, legal, safety, privacy, and reputational effects. The assessment must define its time period, scope, assumptions, and uncertainty. A low-frequency event with catastrophic impact may deserve more attention than a frequent event with minor impact.

Residual risk is the risk remaining after controls are implemented. Inherent risk is the risk before considering controls. Risk treatment options include reducing risk through controls, avoiding the activity, transferring some consequences through contracts or insurance, or accepting risk through an informed and authorized decision. Risk cannot normally be eliminated completely; security management seeks a defensible level of residual risk.

Controls and Defense in Depth

A security control is a safeguard or countermeasure designed to modify risk. Controls can be classified in several complementary ways.

By function, preventive controls attempt to stop an unwanted event; detective controls identify events; corrective controls restore or repair; deterrent controls discourage action; and compensating controls provide an alternative when the preferred control is impractical. A firewall rule can be preventive, an intrusion detection alert detective, a backup corrective, a warning banner deterrent, and manual review compensating.

By nature, controls may be administrative or managerial, technical or logical, and physical. Security awareness training and policy are administrative. Multifactor authentication and encryption are technical. Locks, barriers, and environmental controls are physical. A mature program combines all three.

Defense in depth uses multiple, partially independent layers so that failure of one control does not automatically produce compromise. A layered design might include asset inventory, secure configuration, network segmentation, multifactor authentication, endpoint protection, logging, backups, and incident response. Defense in depth does not mean accumulating controls without analysis. Excessive complexity can create misconfiguration, alert fatigue, cost, and new attack paths.

The principle of least privilege limits users, processes, and services to the minimum access necessary for legitimate tasks. Separation of duties distributes sensitive authority among different roles, reducing the chance that one person can complete and conceal an improper transaction. Fail-safe defaults deny access unless explicitly authorized, while secure failure aims to preserve protection when a component fails. These principles must be adapted to operational requirements; for example, emergency services may require carefully governed break-glass access.

Attack Surfaces and Attack Paths

An attack surface is the collection of points through which an unauthorized entity could attempt to enter, influence, observe, or disrupt a system. It includes internet-facing applications, APIs, exposed ports, remote-access services, identities, endpoints, wireless networks, cloud interfaces, software dependencies, physical facilities, suppliers, and human interactions.

The attack surface is dynamic. New software releases, temporary cloud resources, remote workers, connected devices, mergers, and changes in supplier relationships can introduce exposures. Asset discovery and attack-surface management therefore require continuous processes rather than one-time inventories.

An attack path is a sequence of actions and conditions leading from an initial access point to a target objective. For example, an attacker may phish a user, steal a session token, access a workstation, discover excessive privileges, move laterally to a server, and extract sensitive data. Attack-path analysis helps organizations prioritize vulnerabilities by considering exploitability, privilege transitions, network position, asset value, and available detection.

Reducing attack surface includes removing unnecessary services, closing unused ports, limiting administrative interfaces, applying secure defaults, segmenting networks, enforcing strong identity controls, reviewing cloud permissions, and controlling third-party access. It also includes reducing information leakage, because publicly exposed system details can assist reconnaissance.

Contemporary Threat Actors

Threat actors differ in motivation, resources, persistence, risk tolerance, and access to tools. Categories overlap, and classification should not be treated as perfectly reliable attribution.

Cybercriminal groups generally seek financial gain through fraud, ransomware, extortion, credential theft, data sale, or abuse of computing resources. Their capabilities range from opportunistic automated attacks to specialized, organized operations.

Nation-state or state-sponsored actors may pursue espionage, strategic influence, military objectives, intellectual-property theft, or disruption of critical infrastructure. They may possess substantial resources, intelligence support, patience, and access to previously unknown vulnerabilities, although their operations also vary widely.

Insiders include employees, contractors, administrators, and partners. They may be malicious, negligent, coerced, or compromised. Insider risk is difficult because legitimate access can make malicious activity resemble normal work. Controls should address both intentional misuse and accidental exposure without assuming that all employees are untrustworthy.

Hacktivists use cyber activity to promote political or social causes. Their actions may include website alteration, data disclosure, harassment, or distributed denial of service. Terrorist or extremist actors may seek intimidation or disruption, although their technical capability differs significantly across groups.

Security researchers, penetration testers, and bug bounty participants may discover vulnerabilities without malicious intent. Their activities still require authorization and responsible disclosure. Unaffiliated individuals, sometimes called “grey hat” actors, may violate authorization boundaries even when they claim beneficial motives.

Supply-chain actors exploit trust relationships among software vendors, managed service providers, libraries, hardware manufacturers, and business partners. Artificial intelligence has lowered the cost of generating convincing phishing text, voice cloning, malicious code variants, and reconnaissance assistance. At the same time, defenders use AI for anomaly detection, alert triage, malware analysis, and vulnerability prioritization. AI systems introduce their own risks, including prompt injection, data leakage, model manipulation, insecure plugins, and overreliance on automated decisions. Human oversight, access control, testing, provenance, and monitoring remain essential.

Applied Case: Ransomware in a Regional Healthcare Provider

Background

The following is an illustrative case. A regional healthcare provider operates hospitals, outpatient clinics, laboratory systems, and a patient portal. Its environment includes legacy medical devices, cloud email, remote access for clinicians, and third-party billing services.

Problem

An employee receives a convincing message that imitates a cloud-service notification and enters credentials into a fraudulent site. The attacker uses the credentials to access email, registers an unauthorized authentication method, and then reaches a remote-access service. Because several accounts have excessive privileges and network segmentation is weak, the attacker moves toward file servers and clinical systems. Backups are connected to the production domain. Ransomware encrypts shared files and several scheduling systems.

Analysis

The assets include patient data, clinical availability, identities, devices, applications, and public trust. Confidentiality is threatened by possible data theft; integrity is threatened by unauthorized changes; availability is threatened by encryption and service interruption. Vulnerabilities include inadequate phishing resistance, weak authentication recovery, excessive privileges, insufficient segmentation, and insufficiently isolated backups. The attack path demonstrates that no single vulnerability explains the incident: compromise resulted from a chain of weaknesses.

Approach and Solution

The provider activates its incident-response plan, isolates affected systems, preserves forensic evidence, and moves critical clinical work to safe manual procedures. It verifies the integrity of backups before restoration and coordinates with law enforcement, regulators, insurers, suppliers, and affected stakeholders.

Longer-term measures include phishing-resistant multifactor authentication, privileged-access management, network segmentation between clinical, administrative, and device networks, offline or immutable backups, endpoint detection, centralized logging, tested recovery procedures, and supplier-access review. The organization also changes password-reset and authentication-registration procedures, conducts role-based training, and establishes executive metrics for recovery time, privileged-account coverage, backup restoration success, and unresolved high-risk exposures.

Outcome and Learning Points

The provider restores priority services in stages and improves resilience. The main lesson is that security is a system property. Awareness training alone would not have prevented the incident, nor would encryption alone have restored availability. Identity controls, architecture, monitoring, recovery, governance, and practiced response must operate together.

Governance, Ethics, and Professional Practice

Security professionals exercise power over information, access, and technology. They must protect individuals and organizations while respecting legality, proportionality, privacy, and due process. Monitoring should have a defined purpose, lawful basis where applicable, appropriate notice, limited collection, access restrictions, and retention controls. Security testing must be authorized and scoped; scanning an external system without permission may itself be unlawful.

Organizations should classify information, assign ownership, define retention and disposal requirements, document risk acceptance, and maintain incident-reporting obligations. Regulatory duties vary by jurisdiction and sector, but commonly include requirements concerning personal-data protection, breach notification, payment information, health information, critical infrastructure, and electronic records. Compliance is not identical to security. A compliant organization can still have exploitable weaknesses, while a strong control may exceed a minimum regulatory requirement.

Professional judgment also matters when controls affect accessibility, employment, and public services. Security mechanisms should avoid unjustified discrimination and should provide safe alternatives for users with disabilities or limited connectivity. Decisions involving automated detection or AI should be explainable enough for appropriate review, especially when they affect access to essential services.

Challenges and Limitations

Security analysis faces incomplete inventories, uncertain threat intelligence, changing technology, human error, conflicting business priorities, and imperfect measurement. Threat labels can create false confidence: an organization may focus on a named actor while ignoring common weaknesses exploited by many actors. Vulnerability counts alone are also poor risk measures because they do not adequately represent exploitability, exposure, asset value, or compensating controls.

Security controls can fail through misconfiguration, outdated assumptions, weak maintenance, credential compromise, insider misuse, or dependency failure. More controls do not automatically produce more security. Organizations should test whether controls work under realistic conditions, measure meaningful outcomes, and revise designs after incidents and near misses.

A mature program treats security as continuous improvement. It inventories assets, models threats, prioritizes risk, implements controls, validates effectiveness, monitors changes, responds to incidents, and learns from evidence. The objective is not perfect prevention but resilient protection and responsible recovery.

Best-Practice Principles

A postgraduate practitioner should apply the following principles:

• Establish ownership for information, systems, risks, and controls.
• Maintain an accurate and continuously updated asset inventory.
• Use least privilege, separation of duties, and secure defaults.
• Prefer phishing-resistant multifactor authentication for sensitive access.
• Reduce unnecessary attack surface and segment high-value environments.
• Protect data through classification, encryption where appropriate, and controlled retention.
• Centralize and protect logs, synchronize time, and monitor meaningful events.
• Maintain tested, isolated, and recoverable backups.
• Assess suppliers and software dependencies throughout their lifecycle.
• Exercise incident-response and business-continuity plans.
• Treat privacy, accessibility, ethics, and legal requirements as design considerations.
• Evaluate controls by evidence of effectiveness rather than by their existence on paper.

Chapter Summary

Information security protects information and systems from unauthorized disclosure, alteration, disruption, and destruction. The CIA triad—confidentiality, integrity, and availability—provides the central model, while authenticity, accountability, and non-repudiation extend analysis to identity, responsibility, and evidential support. Assets are valuable objects or capabilities; threats are potential causes of harm; vulnerabilities are weaknesses; attacks are intentional harmful attempts; and risk concerns the likelihood and impact of adverse events.

Controls modify risk and may be preventive, detective, corrective, deterrent, or compensating, as well as administrative, technical, or physical. Defense in depth, least privilege, separation of duties, and secure defaults are foundational design principles. Attack-surface and attack-path analysis help connect technical weaknesses to realistic business consequences. Contemporary threat actors include criminals, state-sponsored groups, insiders, hacktivists, researchers, and supply-chain actors, while AI changes both offensive and defensive capabilities.

Effective security is sociotechnical. It requires governance, architecture, trained people, monitoring, recovery, ethical judgment, and continuous improvement. No single product or control eliminates risk; resilient organizations combine proportionate controls with tested response and informed risk decisions.

Key Terms

Asset: Something valuable that requires protection.

Attack: An intentional attempt to violate a security property or cause harm.

Attack path: A sequence of actions and conditions leading from access to an attacker’s objective.

Attack surface: The collection of possible points through which a system may be attacked.

Authenticity: Confidence that an entity, message, or source is genuine.

Availability: The property that authorized users can access and use information or services when required.

Accountability: The ability to associate actions with responsible entities and support investigation.

Confidentiality: Protection against unauthorized disclosure or access.

Control: A safeguard or countermeasure that modifies risk.

Defense in depth: Use of multiple protective layers so one failure does not cause total compromise.

Integrity: Protection against improper modification or destruction, including preservation of accuracy where required.

Non-repudiation: Evidence supporting attribution of an action or message to an entity.

Risk: The possibility of adverse consequences arising from a threat event, considering likelihood and impact.

Threat: A potential cause of an unwanted incident.

Threat actor: An entity that performs or enables a threat action.

Vulnerability: A weakness that can be exploited or triggered.

Least privilege: Restricting access to the minimum necessary for legitimate tasks.

Residual risk: Risk remaining after controls are applied.

Review Questions

Short Answer Questions

1. Define information security and explain how it differs from cybersecurity.

2. What are the three elements of the CIA triad?

3. Distinguish authentication from authorization.

4. Define vulnerability, threat, and attack.

5. What is meant by defense in depth?

Long Answer Questions

1. Explain confidentiality, integrity, and availability, including examples of controls supporting each property.

2. Discuss accountability and non-repudiation, including the assumptions and limitations associated with each.

3. Explain how assets, threats, vulnerabilities, attacks, controls, and residual risk relate to one another.

4. Compare cybercriminal, state-sponsored, insider, hacktivist, and supply-chain threat actors.

5. Discuss why information security is a governance and ethical issue as well as a technical issue.

Analytical / Application Questions

1. A university exposes a cloud storage bucket containing research data. Analyze the assets, threat actors, vulnerabilities, attack paths, security objectives, and suitable controls.

2. An organization has multifactor authentication but still suffers account takeover through session-token theft. Explain why multifactor authentication was insufficient by itself and propose a defense-in-depth response.

3. Design a prioritized security-improvement plan for a hospital whose most important requirements are patient confidentiality, continuous clinical availability, and trustworthy audit records. Justify the order of your recommendations.

Multiple Choice Questions with Answers

Question 1

Which property of the CIA triad concerns preventing unauthorized disclosure of information?

A. Availability

B. Confidentiality

C. Integrity

D. Accountability

Correct Answer: B. Confidentiality

Question 2

Which statement best distinguishes authentication from authorization?

A. Authentication determines permissions, while authorization verifies identity

B. Authentication verifies identity, while authorization determines permitted actions

C. Authentication encrypts data, while authorization creates backups

D. Authentication detects attacks, while authorization restores systems

Correct Answer: B. Authentication verifies identity, while authorization determines permitted actions

Question 3

Which of the following is a vulnerability rather than a threat actor?

A. A criminal ransomware group

B. A flood affecting a data center

C. An unpatched internet-facing service

D. A malicious insider

Correct Answer: C. An unpatched internet-facing service

Question 4

Which control is primarily corrective?

A. A tested backup used to restore encrypted files

B. A firewall blocking unauthorized traffic

C. A warning banner discouraging misuse

D. Multifactor authentication

Correct Answer: A. A tested backup used to restore encrypted files

Question 5

What does least privilege require?

A. Giving all employees administrator access during business hours

B. Allowing each entity only the access necessary for legitimate tasks

C. Removing all access controls from emergency systems

D. Using one shared account for accountability

Correct Answer: B. Allowing each entity only the access necessary for legitimate tasks

Question 6

Which example most directly represents an attack-surface reduction measure?

A. Adding unnecessary internet-facing services

B. Disabling unused ports and removing obsolete services

C. Publishing internal network diagrams

D. Sharing administrative credentials with suppliers

Correct Answer: B. Disabling unused ports and removing obsolete services

Question 7

Why does a valid digital signature not always prove that a particular human personally approved a message?

A. Digital signatures cannot provide integrity

B. A signature depends on key protection, identity assurance, and trustworthy procedures

C. Digital signatures work only on printed documents

D. Digital signatures eliminate the need for authorization

Correct Answer: B. A signature depends on key protection, identity assurance, and trustworthy procedures

Question 8

Which actor is most characteristically motivated by financial gain from ransomware and extortion?

A. Cybercriminal group

B. Security auditor

C. Environmental disaster

D. Network administrator acting under policy

Correct Answer: A. Cybercriminal group

Question 9

In the healthcare case, why were isolated or immutable backups especially important?

A. They increase phishing success

B. They prevent all unauthorized access to patient records

C. They improve the ability to recover when production systems and connected backups are encrypted

D. They eliminate the need for incident response

Correct Answer: C. They improve the ability to recover when production systems and connected backups are encrypted

Question 10

Which statement about compliance and security is most accurate?

A. Compliance guarantees that no vulnerability exists

B. Security and compliance are identical concepts

C. Compliance can establish required practices, but it does not guarantee complete security

D. Security controls are unnecessary when an organization is certified

Correct Answer: C. Compliance can establish required practices, but it does not guarantee complete security