Home Projects Articles Learning Resume About Contact
← Back to certification journal
Day 01 CompTIA Security+ SY0-701

Risk Management Part 1

My first set of Security+ notes: business risk, the CIA triad, threat actors, threat intelligence, physical risks, and the policies used to keep everything under control.

Defining Business Risk

Risk management starts with knowing what the business has, what could go wrong, and how much damage it would cause. These four terms connect everything together:

Asset

Anything valuable to the business. This includes personal information, financial information, devices, applications, services, business operations, and even the company's reputation.

Threat

Anything with the potential to cause harm. It could be an attacker, an employee mistake, a fire, a power outage, or another event that affects an asset.

Vulnerability

A weakness or gap in security that a threat could take advantage of. An unpatched server, weak password, or unlocked server-room door would all count.

Risk

The possibility of harm, usually judged by both likelihood and impact. Basically: how likely is the problem, and how bad would it be if it happened?

How I connect the terms

A payroll account is the asset. A criminal sending phishing emails is the threat. No MFA on the account is the vulnerability. The chance of that account being compromised, plus the damage it could cause, is the risk.

The basic risk-management job can be broken down into four parts:

  1. Understand and protect the assets.
  2. Find and address vulnerabilities.
  3. Recognize the threats that actually matter to the business.
  4. Assess the risk and reduce it to an acceptable level.

The CIA Triad

The CIA triad is a quick way to think about what security controls are supposed to protect:

Threat Actors

Threat actors can be grouped by where they operate, the resources they have, their skill level, and what they are trying to accomplish. Those differences affect who they target and the type of attack they are likely to use.

Type Usually Resources Main motivation
Unskilled attacker External Low Curiosity, attention, or easy targets. Often uses tools made by somebody else (also called a script kiddie).
Hacktivist External Varies Promoting a social or political cause.
Insider threat Internal Varies Could be malicious, careless, or accidental. Their authorized access and knowledge of the company can make the impact serious.
Organized crime External High Profit. These groups are usually organized, specialized, and professional.
Nation-state External Very high Espionage, disruption, military advantage, political goals, or economic advantage.

Advanced Persistent Threats (APTs)

APTs are skilled, well-resourced attackers that can stay focused on a target for a long time. Their attacks are usually planned, stealthy, and persistent. Nation-states are commonly connected to APTs. The defining traits are the time, resources, and long-term access involved in the campaign.

Shadow IT

Shadow IT is the unauthorized use of software, cloud services, devices, or other tools by employees. This often happens when somebody finds their own way to get work done without going through the IT approval process.

The company may not know where its data is being stored or whether the tool has the right security controls. That can create vulnerabilities, expose data, make compliance harder, and leave IT supporting systems it did not know were being used.

Application Allowlisting

An application allowlist defines which applications and components are allowed to run on company systems. Anything not approved is blocked by default. This can stop malware and unauthorized software, while still letting employees use the tools they need.

The allowlist needs regular maintenance as approved applications and versions change. It works alongside patching, least privilege, endpoint protection, and user training to reduce the attack surface.

Threat Intelligence

Threat intelligence provides information about current or possible threats. It can show the tactics, techniques, and procedures (TTPs) attackers use and help a company decide what it should defend against first.

Sources of intelligence

CVE records

CVE stands for Common Vulnerabilities and Exposures. A CVE ID gives a publicly disclosed vulnerability a unique identifier so vendors, scanners, researchers, and defenders can all refer to the same issue. A CVE record normally includes a short description, affected products or versions, and references. It gives defenders a common name for the vulnerability. Details about a real attack come from security alerts, system logs, incident reports, and the investigation itself.

Sharing threat intelligence

The easy way I remember it

STIX describes what the threat-intelligence data looks like. TAXII is how systems exchange it. AIS is one sharing program that uses both.

Risk Vectors

A risk vector is a path or area where the business can be exposed to harm. Before locking anything down, the company has to answer a basic question: Do we know what we have and where it is?

Mission-critical systems and data

Physical risk vectors

Security Policies

Policies put the company's security expectations into writing. They tell employees what is allowed, who approves changes, and how assets and data should be handled.

Reference Sources