Security fundamentals

The ideas everything else is built on. Get these and the rest starts to make sense.

14 sketches

• CIA triadThree properties, lost one at a time
• Assume breachDesign as if something is already in
• Attack surfaceMore ways in than anyone counts
• Compensating controlA stand in for the control that will not fit
• ComplexityComplexity defeats understanding
• ControlFitted is not the same as working
• Residual riskWhat is left, and whose name is on it
• RiskA scenario becomes a risk when you say how likely
• Risk appetiteThree marks on the hull
• Secure defaultsSafe in the state it arrives
• ThreatThe water, the crack and the wet floor
• Trust boundaryCheck where the ground changes
• VulnerabilityThe same crack, three different problems
• A security exception with no expiry date can become a permanent control decision nobody deliberately madeStill propped open