37:41
ISC2 CC Domain 1: Security Principles | Complete Exam Prep (2026 Exam Outline)
CyberPaw
Overview
This video covers Domain 1: Security Principles for the ISC2 CC certification, representing 24% of the exam. It lays the groundwork for all subsequent domains by explaining fundamental concepts like the CIA triad (Confidentiality, Integrity, Availability), risk management processes, the governance hierarchy from laws to procedures, and the classification of security controls. The module also emphasizes professional and ethical conduct expected of ISC2 members, including due care, due diligence, and the organization's code of ethics. Understanding these principles is crucial for building a comprehensive security strategy.
How was this?
Save this permanently with flashcards, quizzes, and AI chat
Chapters
- Information security is broad, protecting data in all forms, while cybersecurity is a subset focused on digital systems.
- The CIA triad—Confidentiality, Integrity, and Availability—are the core pillars of security, often in tension with each other.
- An asset is anything valuable, a threat is anything that can cause harm, and a vulnerability is a weakness that a threat can exploit.
- Risk is the probability of a threat exploiting a vulnerability to harm an asset, calculated as Threat x Vulnerability x Asset Value.
These fundamental concepts are the building blocks for all security discussions and decisions, ensuring a common understanding of what needs protection and how it can be compromised.
A doctor locking paper files (information security) vs. a hospital using a firewall (cybersecurity); encryption for confidentiality, hash functions for integrity, and backups for availability; an unpatched server (vulnerability) being scanned by a hacker (threat) to steal data (asset) representing risk.
- AAA provides a framework for managing user access: Authentication verifies identity (something you know, have, or are), Authorization determines permissions based on identity, and Accounting tracks user actions.
- Multi-factor authentication (MFA) combines at least two authentication factors for stronger security.
- Least privilege is the principle of granting users only the minimum access necessary to perform their jobs.
- Non-repudiation ensures that an individual cannot deny having performed an action, often achieved through digital signatures.
- Privacy focuses on individuals' rights to control their personal data, distinct from confidentiality which protects organizational information.
Understanding AAA and the distinction between privacy and confidentiality is essential for implementing effective access controls and complying with data protection regulations.
Logging in with a password and a one-time code (MFA); an accountant having access to financial data but not HR records (least privilege); digitally signing a contract to prevent denial of signing (non-repudiation); GDPR regulations protecting an individual's right to have their data deleted (privacy).
- Risk management is an ongoing cycle: Identify assets, threats, and vulnerabilities; Assess likelihood and impact; Treat risks; and Monitor continuously.
- Risk appetite is the strategic level of risk an organization is willing to take, while risk tolerance is the acceptable operational variation.
- Qualitative analysis uses descriptive terms (high, medium, low), while quantitative analysis uses financial metrics (SLE, ARO, ALE) for risk assessment.
- Risk treatment options include accepting, avoiding, transferring (e.g., insurance), or mitigating (implementing controls).
A structured approach to risk management allows organizations to prioritize security efforts, allocate resources effectively, and make informed decisions about accepting or mitigating potential threats.
Identifying an unpatched server as a vulnerability; assessing a phishing attack as high likelihood/high impact; a company choosing not to store credit card data to avoid breach risk (avoidance); purchasing cyber insurance to cover potential losses (transfer).
- Inherent risk is the risk level before any controls are applied, representing maximum exposure.
- Residual risk is the risk remaining after controls are implemented and must be formally accepted by management.
- The governance hierarchy flows from top to bottom: Laws/Regulations, Frameworks/Guidelines, Standards, Policies, and Procedures.
- Each layer must align with the layer above it, with laws being the non-negotiable baseline and procedures providing specific, step-by-step instructions.
Understanding the difference between inherent and residual risk is key to evaluating the effectiveness of security controls, while the governance hierarchy provides the structure for implementing and enforcing security requirements.
A web server with no security measures has high inherent risk; after implementing a firewall and MFA, the remaining risk is residual risk; GDPR (regulation), NIST CSF (framework), TLS 1.3 (standard), password policy (policy), and incident reporting steps (procedure).
- Controls are categorized by type: Technical (firewalls, encryption), Administrative (policies, training), and Physical (locks, guards).
- Controls are also classified by function: Preventive (stop incidents), Detective (identify incidents), Corrective (restore operations), and Deterrent (discourage attackers).
- Compensating controls are alternative measures used when ideal controls cannot be implemented, provided they offer equivalent protection.
- Defense in depth involves layering multiple, overlapping controls to ensure that if one fails, others still protect the asset.
Knowing how to classify controls helps in designing a comprehensive security program, and the principle of defense in depth ensures resilience against sophisticated attacks.
A firewall is technical and preventive; an intrusion detection system is technical and detective; a warning banner is deterrent; implementing an isolated network segment for an unpatchable legacy device is a compensating control; layering firewalls, antivirus, and employee training creates defense in depth.
- The (ISC)² Code of Ethics prioritizes protecting society and the public trust (Canon 1) above all else.
- Professionals must act honorably, honestly, justly, responsibly, and legally (Canon 2), providing diligent and competent service (Canon 3) and advancing the profession (Canon 4).
- Due care is the active responsibility to take reasonable security steps, while due diligence is the research and investigation to know what those steps should be.
- Professionals must maintain competence, avoid conflicts of interest, protect confidential information, and report vulnerabilities responsibly.
Adhering to ethical standards and professional conduct is crucial for maintaining the integrity of the cybersecurity profession and building trust with employers and the public.
Reporting a data breach to authorities even if the employer wants to conceal it (Canon 1 & 2); reviewing a vendor's security before signing a contract (due diligence) and then implementing required security measures (due care); a security consultant disclosing a conflict of interest to their client.
Key takeaways
- Security principles like the CIA triad and AAA form the bedrock of all cybersecurity practices.
- Effective risk management requires a continuous cycle of identification, assessment, treatment, and monitoring.
- Understanding the governance hierarchy (Laws, Frameworks, Standards, Policies, Procedures) is essential for compliance and operational security.
- A layered approach (defense in depth) using technical, administrative, and physical controls provides more robust protection than single controls.
- Due care involves actively implementing security measures, while due diligence involves researching and understanding what those measures should be.
- The (ISC)² Code of Ethics mandates prioritizing public safety and acting with integrity, honesty, and competence.
- Residual risk must always be formally documented and accepted by management after controls are applied.
Key terms
Information SecurityCybersecurityCIA TriadConfidentialityIntegrityAvailabilityAssetThreatVulnerabilityRiskAuthenticationAuthorizationAccountingMulti-factor Authentication (MFA)Least PrivilegeNon-repudiationPrivacyRisk Management LifecycleRisk AppetiteRisk ToleranceQualitative AnalysisQuantitative AnalysisSLE (Single Loss Expectancy)ARO (Annual Rate of Occurrence)ALE (Annual Loss Expectancy)Risk AcceptanceRisk AvoidanceRisk TransferRisk MitigationInherent RiskResidual RiskGovernance HierarchyRegulationsLawsFrameworksStandardsPoliciesProceduresTechnical ControlsAdministrative ControlsPhysical ControlsPreventive ControlsDetective ControlsCorrective ControlsDeterrent ControlsCompensating ControlsDefense in Depth(ISC)² Code of EthicsDue CareDue Diligence
Test your understanding
- How does cybersecurity differ from the broader concept of information security?
- Explain the inherent tension between confidentiality and availability, and how security professionals balance these principles.
- What is the relationship between an asset, a threat, and a vulnerability, and how do they combine to form risk?
- Describe the sequence of Authentication, Authorization, and Accounting (AAA) and why the order is important.
- What are the four main phases of the risk management lifecycle, and why is it considered a continuous process?
- How do risk appetite and risk tolerance differ, and in what contexts would an organization prioritize one over the other?
- What is the difference between inherent risk and residual risk, and what must be done with residual risk?
- How do laws and regulations differ from policies and procedures in the governance hierarchy?
- Provide an example of a technical, administrative, and physical security control, and explain how they contribute to defense in depth.
- What is the primary ethical obligation for (ISC)² members according to the Code of Ethics, and how does it influence decisions when employer interests conflict?
- Explain the distinction between due care and due diligence using a practical example.