Information Security Management Examination (SG) | Section A Security Fundamentals 01

Confidentiality is the property that only those permitted can access the information.

Integrity is the property that information is accurate and complete and has not been altered without authorisation.

Redundancy makes it easier to keep the service running even when part of it fails.

Risk is assessed by considering the impact if a threat exploits a vulnerability.

Knowing where assets are, who manages them and how important they are is the basis of proper management.

Passing part of the loss to an insurer through a policy is risk transfer.

The risk left after controls have been implemented is called residual risk.

The policy sets the direction of the organisation, so it needs management's involvement and approval.

Limiting access rights to the minimum needed keeps down the impact of fraud and mistakes.

Assigning tasks such as requesting and approving to different people creates mutual checks.