Security Principles, Risk and Defense Models

Introduction and Context

Internet and network security is not achieved by installing a single firewall, antivirus product, or intrusion-detection system. It is a continuing process of protecting information, systems, services, people, and organisations against events that may cause unauthorised disclosure, alteration, destruction, interruption, or misuse. Effective security therefore requires principles for making decisions, methods for assessing risk, and layered models for selecting and evaluating controls.

This chapter introduces the principal security objectives—confidentiality, integrity, availability, authentication, accountability, least privilege, separation of duties, and defense in depth. It then develops a practical risk-assessment method based on asset, threat, vulnerability, likelihood, and impact analysis. The discussion connects these foundations with the NIST risk-management approach, ISO/IEC 27001 information-security management systems, and the CIS Controls.

Risk assessment is not an exercise in predicting the future with certainty. It is a structured way to make defensible decisions when information, money, time, and technical capability are limited. A diploma-level security practitioner should be able to identify what must be protected, explain how it could be harmed, estimate relative risk, recommend proportionate controls, and communicate residual risk to decision-makers.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the core principles of information and network security.
2. Distinguish authentication, authorisation, and accountability.
3. Apply least privilege, separation of duties, and defense in depth to practical systems.
4. Identify assets, threats, vulnerabilities, existing controls, and business impacts.
5. Perform a basic qualitative and semi-quantitative risk assessment.
6. Relate practical security work to NIST, ISO/IEC 27001, and CIS guidance.
7. Select risk treatments and explain residual risk, limitations, and governance responsibilities.

1. The Security Objectives

Confidentiality

Confidentiality means preventing information from being disclosed to unauthorised people, systems, or processes. Examples include protecting student records from unauthorised viewing, preventing interception of passwords, and restricting source code to approved developers.

Confidentiality is supported by access controls, encryption, secure authentication, network segmentation, data classification, and staff awareness. It is not identical to secrecy: some information is intentionally public, while other information requires strict protection. Security decisions should therefore be based on the information’s value and sensitivity.

A confidentiality failure is commonly called a data breach or unauthorised disclosure. Consequences may include fraud, legal penalties, loss of trust, competitive harm, and personal safety risks.

Integrity

Integrity is the accuracy, completeness, and trustworthiness of information and system processes. An attacker who changes a bank account number in an invoice has attacked integrity even if no information was disclosed. Integrity controls include input validation, cryptographic hashes, digital signatures, change control, access restrictions, database constraints, backups, and audit logs.

Integrity has two related dimensions. Data integrity concerns whether stored or transmitted data has been altered improperly. System or process integrity concerns whether a system performs its intended operations without unauthorised manipulation. Malware that changes a payment application’s behaviour can compromise process integrity even when its files appear unchanged.

Availability

Availability means that authorised users can access information and services when required. Availability depends on reliable infrastructure, capacity, maintenance, resilience, recovery procedures, and protection against denial-of-service attacks.

Availability is not necessarily the same as operating continuously. A service may have a defined acceptable outage window. Business requirements should specify recovery time and recovery point expectations. Recovery time objective (RTO) is the maximum targeted time to restore a service after disruption. Recovery point objective (RPO) is the maximum acceptable period of data loss measured backward from the disruption.

The CIA Triad in Practice

Confidentiality, integrity, and availability are interdependent. Strong confidentiality controls can reduce availability if legitimate users face excessive delays. Replication can improve availability but increase the number of systems requiring confidentiality and integrity protection. Security architecture therefore involves balancing objectives rather than maximising one objective in isolation.

Authentication, Authorisation, and Accountability

Authentication establishes identity: it answers, “Who or what are you?” Methods include knowledge factors such as passwords, possession factors such as hardware security keys, and inherence factors such as fingerprints. Multi-factor authentication uses two or more different factor categories; using two passwords is not multi-factor authentication because both are knowledge factors.

Authorisation determines what an authenticated identity may do. A user may successfully authenticate but still lack permission to read a payroll database. Authentication is therefore a prerequisite for many access decisions, but it is not authorisation itself.

Accountability makes actions attributable to a particular identity or process. It depends on unique accounts, reliable time synchronisation, logging, monitoring, protected audit records, and procedures for reviewing events. Shared administrator accounts weaken accountability because actions cannot be confidently linked to one person.

Non-repudiation is a stronger property in which a party cannot plausibly deny an action, usually because of reliable evidence such as a digital signature and controlled key management. Ordinary logs provide accountability evidence but do not automatically guarantee legal non-repudiation.

2. Foundational Design Principles

Least Privilege

Least privilege means granting a subject only the permissions necessary to perform an authorised task, for only as long as necessary. A help-desk worker may reset passwords but should not automatically be able to export the entire employee database. Least privilege reduces the damage caused by stolen credentials, mistakes, malware, and insider misuse.

Implementation techniques include role-based access control, just-in-time administration, separate privileged accounts, network segmentation, application allow-listing, and periodic access reviews. Least privilege is not “minimum access forever”; permissions should change when duties change and should expire when temporary work ends.

Separation of Duties

Separation of duties divides a sensitive activity among more than one person or role so that no single individual can complete an unauthorised transaction without detection or cooperation. For example, one employee may create a supplier record while another approves payment. In information technology, a developer may write code, an independent reviewer may approve it, and an operations team may deploy it.

Separation of duties reduces fraud and error, but it can increase cost and delay. Small organisations may use compensating controls, such as independent management review, detailed alerts, or retrospective audit, when complete separation is impractical.

Defense in Depth

Defense in depth uses multiple, different protective layers so that failure of one control does not result in immediate compromise. A layered design might include secure configuration, identity controls, endpoint protection, network segmentation, application validation, encryption, monitoring, backups, and incident response.

The layers should be meaningfully independent. Installing several products that rely on the same vulnerable identity service is not necessarily defense in depth. Controls should also cover different stages of an attack: prevention, detection, response, and recovery.

Secure Defaults and Fail-Safe Design

Secure defaults deny unnecessary access, disable unused services, require protective settings, and avoid exposing sensitive information through error messages. Fail-safe design ensures that when a control fails, the system moves to a safer state where practical. For example, a failed access-control service should not automatically grant unrestricted access.

Economy of Mechanism and Complete Mediation

Economy of mechanism favours simple, understandable security designs because complexity creates configuration errors and hidden dependencies. Complete mediation means that every access to a protected resource is checked, rather than trusting a permission decision made once and applying it indefinitely. Caching and performance optimisations may be used, but they must not allow stale permissions to persist beyond an acceptable period.

3. Assets, Threats, Vulnerabilities, and Controls

An asset is something that has value to an organisation or its stakeholders. Assets include information, hardware, software, services, credentials, facilities, business processes, reputation, and human safety. Asset identification should include dependencies: a web application may depend on a database, identity provider, cloud service, network link, and administrator account.

A threat is a potential cause of harm. Threat sources may be external attackers, criminal groups, insiders, contractors, natural hazards, equipment failures, or accidental human actions. A threat is not the same as an incident; a threat describes potential, while an incident is an observed event that affects or may affect security.

A vulnerability is a weakness that could be exploited or triggered. Examples include an unpatched service, excessive permissions, weak recovery procedures, insecure application logic, poor physical protection, or inadequate staff training. A vulnerability does not automatically create harm; it becomes significant when connected to a threat and a valuable asset.

A control is a safeguard that modifies risk. Controls may be administrative, technical, physical, preventive, detective, corrective, or deterrent. A policy is an administrative control; a firewall rule is a technical control; a locked server room is a physical control.

4. Risk Concepts and Basic Assessment

Risk is the possibility that a threat will exploit a vulnerability and cause harm to an asset or objective. A useful conceptual relationship is:

Likelihood represents the estimated chance or frequency of an adverse event under stated conditions. Impact represents the severity of its consequences. This expression is a decision-support model, not a universal physical law. It is appropriate for ranking risks when likelihood and impact are assessed on compatible scales. It does not eliminate uncertainty or justify false precision.

A more detailed conceptual model is:

Here, threat likelihood describes how likely the threat source is to attempt or cause the event, vulnerability exposure describes how susceptible the asset is, and impact describes the resulting harm. In practice, organisations often combine the first two factors into an overall likelihood rating because reliable numerical probabilities are unavailable.

Qualitative Scales

A five-level scale can be used for both likelihood and impact. For example, likelihood may range from 1, “rare,” to 5, “almost certain.” Impact may range from 1, “negligible,” to 5, “severe.” The product produces a comparative score from 1 to 25.

If likelihood is rated 4 and impact 5, then the comparative risk score is:

The result has no universal unit. It is a prioritisation score whose meaning depends on the organisation’s definitions and risk appetite. A score of 20 should not be interpreted as a 20 percent probability.

Risk Assessment Process

A basic assessment can follow these steps:

1. Establish context. Define the system, business purpose, scope, stakeholders, legal obligations, risk criteria, and assumptions.
2. Identify assets and owners. Record information, services, dependencies, and responsible business owners.
3. Identify threats and threat events. Consider malicious, accidental, environmental, and supply-chain events.
4. Identify vulnerabilities and predisposing conditions. Review configurations, software versions, processes, architecture, skills, and dependencies.
5. Record existing controls. Assess whether controls are designed appropriately and operating effectively.
6. Estimate likelihood and impact. Use evidence where available and document uncertainty.
7. Prioritise risks. Compare results against risk criteria and business priorities.
8. Select treatment. Avoid, mitigate, transfer, or accept the risk.
9. Assign ownership and deadlines. A risk without an accountable owner is unlikely to be managed.
10. Monitor and review. Reassess after major changes, incidents, new threats, or control failures.

Inherent and Residual Risk

Inherent risk is the level of risk before considering controls. Residual risk is the risk remaining after controls are applied. Controls generally reduce likelihood, impact, or both; they do not normally reduce risk to zero. Residual risk should be explicitly accepted by an appropriately authorised person when it exceeds routine operational authority.

Risk treatment options are:

• Avoid: stop the activity or remove the risky feature.
• Mitigate: implement controls to reduce likelihood or impact.
• Transfer or share: use insurance, contractual arrangements, or outsourcing, while recognising that accountability may remain with the organisation.
• Accept: make an informed decision to retain the risk within approved tolerance.

5. Applying Major Security Frameworks

NIST Risk Management and Cybersecurity Guidance

The NIST Risk Management Framework describes a structured cycle commonly expressed through the steps Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. It links system-level security controls to organisational risk decisions. NIST Special Publication 800-30 provides guidance for conducting risk assessments, while NIST Cybersecurity Framework 2.0 organises cybersecurity outcomes under Govern, Identify, Protect, Detect, Respond, and Recover.

NIST guidance is flexible rather than a checklist that guarantees security. It encourages organisations to define context, select controls proportionate to risk, assess control effectiveness, authorise systems, and monitor changes.

ISO/IEC 27001

ISO/IEC 27001 specifies requirements for an information security management system (ISMS). An ISMS is a management system, not merely a collection of technologies. It requires organisational context, leadership, planning, risk assessment, risk treatment, documented information, performance evaluation, internal audit, and continual improvement.

The ISO approach emphasises a repeatable governance cycle. Annex A contains a reference set of controls, but organisations select controls based on their risk treatment process and document applicability. Certification, where obtained, provides evidence that an ISMS conforms to specified requirements; it does not guarantee that no breach can occur.

CIS Controls

The CIS Critical Security Controls provide prioritised, practical safeguards. Examples include maintaining an inventory of enterprise assets and software, applying secure configurations, managing accounts and access, continuously managing vulnerabilities, using audit logs, protecting data, and maintaining incident response capabilities. CIS Controls are especially useful for translating broad risk objectives into implementable technical and operational actions.

The frameworks complement one another. NIST offers risk-management and outcome-oriented structure; ISO/IEC 27001 provides a certifiable management-system model; CIS provides prioritised safeguards. None removes the need for professional judgement or local legal and business analysis.

6. Worked Assessment Example

Consider a college learning-management system (LMS) containing student submissions, grades, staff messages, and identity information. The service is hosted by a cloud provider, while the college retains responsibility for account administration, data classification, access decisions, and incident response.

Asset and impact analysis

The primary assets are student records, assessment results, the LMS service, administrator credentials, and the college’s reputation. An integrity failure affecting grades may have high academic and legal consequences. An availability failure during an examination period may have high operational impact. Confidentiality impact is high for personal information but lower for already published course material.

Threat and vulnerability analysis

A plausible threat event is compromise of an administrator account through password reuse or phishing. Relevant vulnerabilities include lack of phishing-resistant multi-factor authentication, excessive administrative permissions, insufficient monitoring, and delayed review of dormant accounts.

Assume the assessment team uses a five-point scale and estimates likelihood as 4 and impact as 5. The initial comparative score is:

The team selects controls: phishing-resistant multi-factor authentication for administrators, separate privileged accounts, quarterly access reviews, alerts for unusual administrator activity, secure logging, and an incident-response playbook. These controls address prevention, detection, and response.

After implementation, the team estimates likelihood as 2 and impact as 4 because compromise remains possible and some consequences cannot be prevented. The residual score is:

The reduction from 20 to 8 is not proof that the controls are effective. The college should verify implementation, test alerting, review logs, conduct an account-recovery exercise, and reassess assumptions. The service owner may accept a score of 8 if it is within the college’s risk tolerance; otherwise additional treatment is required.

7. Detailed Illustrative Case: Regional Health Clinic

Background

This fictional case concerns a regional clinic that uses an internet-connected electronic health-record system, internet telephony, medical devices, and a cloud-based appointment service. The clinic has limited security staff and relies on a managed service provider for some infrastructure.

Problem

An employee opens a malicious attachment. The attacker obtains access to a workstation and attempts to move toward the health-record system. The clinic discovers that several staff members use broad shared permissions, some medical devices cannot be patched immediately, and logs from different systems use inconsistent time settings.

The immediate concern is confidentiality of patient records, but availability and safety are also important. If the record system is unavailable, clinicians may lack timely information. If a medical device is manipulated, physical harm could result.

Analysis

The clinic first establishes scope and identifies assets and owners. It classifies patient records as highly sensitive, identifies clinical availability requirements, and documents dependencies such as identity services, network switches, backups, and the managed provider.

The risk team identifies threat events including credential theft, ransomware, exploitation of unpatched devices, and supplier compromise. Vulnerabilities include shared accounts, weak segmentation, delayed patching, excessive privileges, incomplete offline backups, and inconsistent logging.

The team then maps treatments to principles. Unique accounts and multi-factor authentication improve authentication and accountability. Role-based access and separate clinical-administration roles apply least privilege. A second person’s approval for high-risk changes supports separation of duties. Network segmentation separates medical devices, administrative systems, guest wireless access, and critical servers. Endpoint protection, email filtering, immutable backups, monitoring, and rehearsed recovery procedures provide defense in depth.

Approach and outcome

The clinic does not attempt to solve every problem simultaneously. It prioritises administrative identity protection, segmentation of critical systems, tested backups, emergency procedures, and centralised logging. It documents temporary compensating controls for devices that cannot yet be patched. The managed provider’s contract is reviewed to clarify notification times, evidence preservation, access responsibilities, and recovery obligations.

After three months, the clinic reports fewer dormant accounts, verified restoration of critical records from backup, improved detection of unusual sign-ins, and clearer responsibility for supplier incidents. Residual risk remains because legacy medical devices cannot all be replaced. That risk is documented, monitored, and presented to senior management rather than hidden within technical operations.

Learning points

1. The most important asset may be a service or safety function, not merely a database.
2. Risk assessment must include dependencies and suppliers.
3. Controls should support confidentiality, integrity, availability, and accountability together.
4. Compensating controls should be documented when ideal controls are not immediately feasible.
5. Testing and monitoring are necessary because a control that exists on paper may fail in operation.

8. Governance, Ethics, and Professional Practice

Security decisions affect people. Excessive monitoring can intrude on privacy; weak monitoring can fail to detect abuse. Practitioners should collect only information justified by a legitimate purpose, protect logs from unauthorised access, define retention periods, and inform employees about relevant monitoring practices where required.

Personal data should be processed according to applicable law and organisational policy. Security teams should consider data minimisation, purpose limitation, access rights, breach-notification duties, and cross-border processing. Legal requirements vary by jurisdiction, so technical staff should work with privacy, legal, and compliance specialists rather than assuming that one framework answers every legal question.

Ethical practice also includes responsible vulnerability disclosure, avoiding unauthorised testing, preserving evidence, respecting professional confidentiality, and reporting material risks honestly. A practitioner should not claim that a system is “secure” merely because a scan found no vulnerabilities or because a framework checklist is complete.

9. Challenges and Limitations

Risk ratings are affected by incomplete data, changing threats, subjective judgement, and disagreements about impact. Numerical-looking scores can create false confidence. A low-frequency event with catastrophic consequences may deserve attention even if its product score is lower than a frequent minor incident.

Controls can introduce new risks. Multi-factor authentication may create account-recovery challenges; extensive logging may create privacy and storage obligations; segmentation may disrupt legitimate operations if poorly designed. Controls must therefore be tested for usability, resilience, accessibility, and unintended consequences.

Frameworks can also be misused. Treating NIST, ISO, or CIS as a compliance checklist may encourage documentation without effective protection. Conversely, implementing isolated technical safeguards without governance may produce inconsistent decisions. Effective security combines leadership, skilled personnel, technical controls, clear processes, measurement, and continual improvement.

Artificial intelligence is increasingly relevant to security operations through anomaly detection, automated analysis, and assistance with triage. However, AI outputs can be inaccurate, biased, explainability may be limited, and sensitive data may be exposed to an external service. AI should support—not replace—human review, access governance, testing, and accountability. Organisations should define approved uses, data-handling rules, validation procedures, and escalation paths.

10. Best-Practice Checklist

A practical security programme should:

• maintain an inventory of assets, software, services, owners, and dependencies;
• classify information and define confidentiality, integrity, and availability needs;
• use unique identities and strong, risk-appropriate authentication;
• review privileges regularly and remove unnecessary or dormant access;
• separate incompatible duties and protect privileged operations;
• configure systems securely and manage vulnerabilities according to risk;
• segment networks and protect critical services from unnecessary exposure;
• centralise and protect logs, synchronise time, and monitor meaningful events;
• maintain tested, protected backups and documented recovery objectives;
• exercise incident-response and business-continuity procedures;
• assess suppliers and define security responsibilities contractually;
• document accepted residual risks and assign accountable owners; and
• reassess security after major changes, incidents, new threats, or control failures.

Chapter Summary

Security principles provide the basis for designing and evaluating controls. Confidentiality limits unauthorised disclosure, integrity preserves trustworthy information and processes, and availability supports authorised access when needed. Authentication establishes identity, authorisation grants permissions, and accountability links actions to identifiable subjects. Least privilege limits permissions, separation of duties reduces the possibility of undetected abuse, and defense in depth combines independent layers of prevention, detection, response, and recovery.

Risk assessment connects assets, threats, vulnerabilities, controls, likelihood, and impact. The relationship Risk ≈ Likelihood × Impact is a comparative model that supports prioritisation but does not represent a guaranteed probability. A disciplined assessment establishes context, identifies assets and dependencies, evaluates threats and vulnerabilities, records existing controls, estimates risk, selects treatment, assigns ownership, and monitors residual risk.

NIST provides structured risk-management and cybersecurity outcomes; ISO/IEC 27001 provides an information-security management-system model; and CIS Controls provide prioritised practical safeguards. These frameworks are complementary, not substitutes for judgement. Effective security is governed, tested, monitored, ethically implemented, and continually improved.

Key Terms

Asset: Something valuable that requires protection, including information, systems, services, people, or reputation.

Authentication: The process of establishing the identity of a user, device, or process.

Authorisation: The decision about what an authenticated subject is permitted to do.

Accountability: The ability to attribute actions to a responsible identity or process.

Availability: The property that authorised users can access information and services when required.

Confidentiality: Protection against unauthorised disclosure of information.

Control: A safeguard that modifies risk.

Defense in depth: Use of multiple, complementary security layers.

Impact: The severity of consequences if a risk event occurs.

Integrity: The accuracy, completeness, and trustworthiness of information and processes.

Least privilege: Granting only the permissions necessary for an authorised task.

Likelihood: An estimate of the chance or frequency of a risk event.

Residual risk: Risk remaining after controls are applied.

Risk: The possibility of harm arising from threats exploiting vulnerabilities.

Risk appetite: The level and type of risk an organisation is willing to pursue or retain.

Separation of duties: Dividing sensitive tasks among different people or roles.

Threat: A potential cause of harm to an asset or objective.

Vulnerability: A weakness that can be exploited or triggered to cause harm.

Review Questions

5 Short Answer Questions

1. Distinguish confidentiality, integrity, and availability, giving one example of a control for each.
2. Why are authentication and authorisation different security functions?
3. Explain how least privilege reduces the consequences of compromised credentials.
4. What is residual risk, and who should normally accept it?
5. State one contribution each of NIST, ISO/IEC 27001, and the CIS Controls.

5 Long Answer Questions

1. Explain defense in depth and design a layered protection strategy for a small business web application.
2. Describe a complete basic risk-assessment process from establishing context through monitoring.
3. Discuss the relationship between separation of duties, accountability, and fraud prevention.
4. Compare the purposes and limitations of NIST guidance, ISO/IEC 27001, and CIS Controls.
5. Explain why risk scores should not be interpreted as precise probabilities, and discuss how uncertainty should be documented.

3 Analytical / Application Questions

1. A payroll administrator can create employees, change bank details, approve payments, and delete audit logs. Identify the principle violations and propose a revised control design.
2. A college estimates the likelihood of a ransomware event as 3 and its impact as 5 on a five-point scale. Calculate the comparative risk score, explain its meaning, and recommend at least three treatments.
3. A hospital cannot immediately patch several networked medical devices. Develop a compensating-control plan using least privilege, segmentation, monitoring, incident response, and recovery principles.

Multiple Choice Questions with Answers

Question 1

Which security objective is primarily concerned with preventing unauthorised alteration of data?

A. Confidentiality

B. Integrity

C. Availability

D. Authentication

Correct Answer: B. Integrity

Question 2

What is the main purpose of authentication?

A. To determine the actions a user may perform

B. To establish the identity of a user or system

C. To guarantee that a service is continuously available

D. To encrypt every stored record

Correct Answer: B. To establish the identity of a user or system

Question 3

Which example best demonstrates least privilege?

A. Giving every employee administrator access for convenience

B. Using one shared account for all technical staff

C. Granting a help-desk worker only the permissions needed to reset passwords

D. Allowing permissions to remain permanently after a temporary assignment

Correct Answer: C. Granting a help-desk worker only the permissions needed to reset passwords

Question 4

An organisation requires one employee to create a supplier record and another to approve payment. Which principle is being applied?

A. Separation of duties

B. Complete mediation

C. Data minimisation

D. Availability planning

Correct Answer: A. Separation of duties

Question 5

A risk has a likelihood rating of 4 and an impact rating of 5. Using the comparative model Risk ≈ Likelihood × Impact, what is the score?

A. 9

B. 15

C. 20

D. 25

Correct Answer: C. 20

Question 6

Which statement about a risk score of 20 on a five-by-five matrix is correct?

A. It proves that the event has a 20 percent probability

B. It is a comparative prioritisation value whose meaning depends on the organisation’s scale

C. It means that exactly 20 incidents will occur

D. It guarantees that existing controls have failed

Correct Answer: B. It is a comparative prioritisation value whose meaning depends on the organisation’s scale

Question 7

Which of the following is an example of defense in depth?

A. Relying exclusively on a firewall

B. Using one password for all systems

C. Combining segmentation, multi-factor authentication, monitoring, backups, and response procedures

D. Removing all logs to protect privacy

Correct Answer: C. Combining segmentation, multi-factor authentication, monitoring, backups, and response procedures

Question 8

What is the primary focus of an ISO/IEC 27001 information-security management system?

A. Providing only a vulnerability-scanning tool

B. Managing information security through governance, risk treatment, controls, evaluation, and continual improvement

C. Replacing all organisational policies with technical settings

D. Guaranteeing that breaches cannot occur

Correct Answer: B. Managing information security through governance, risk treatment, controls, evaluation, and continual improvement

Question 9

Which action most directly improves accountability?

A. Using shared administrator accounts

B. Disabling time synchronisation

C. Using unique accounts, protected logs, and regular event review

D. Allowing users to delete their own audit records

Correct Answer: C. Using unique accounts, protected logs, and regular event review

Question 10

Which option is a risk-treatment strategy?

A. Accepting, mitigating, transferring, or avoiding the risk

B. Ignoring every low-frequency event

C. Removing the asset inventory

D. Treating every vulnerability as equally urgent

Correct Answer: A. Accepting, mitigating, transferring, or avoiding the risk