Module 73: Security Introduction

Why each option is right or wrong

• “Confidentiality” (Incorrect): Nothing secret was revealed; data was changed.
• “Availability” (Incorrect): The system kept working; the data became wrong.
• “Authentication” (Incorrect): Authentication is about identity, not part of the CIA triad.
• “Integrity” is correct.

  Integrity means data is accurate and only changed by those allowed to change it. An altered invoice amount is wrong data, even if nobody else saw it and the system stayed up.

  • Confidentiality: keeping data secret from the wrong people.
  • Availability: keeping systems and data usable when needed.

📖 Revise: Lesson 1: Confidentiality, integrity, availability

Why each option is right or wrong

• “Maximum security is illegal in most countries” (Incorrect): It isn't illegal; it's impractical.
• “Computers can't run more than three security tools” (Incorrect): There's no such limit; cost and usability are the issue.
• “Attackers have stopped targeting well-protected sites” (Incorrect): Attackers still target them; balance is about cost.
• “Every control costs money, time and ease of use” is correct.

  Each extra check, approval or restriction slows people down or costs money. Too much, and people find workarounds that are less safe. Security works best when effort matches the risk.

  • Protect most: money, personal data and admin access.
  • Lighter touch: for low-risk areas.

📖 Revise: Lesson 1: Confidentiality, integrity, availability

Why each option is right or wrong

• “By physically breaking into the server room” (Incorrect): Physical attacks happen but are rare compared with phishing.
• “By breaking strong encryption with powerful computers” (Incorrect): Breaking modern encryption is far harder than tricking people.
• “Through the office printer's network cable” (Incorrect): Printers can be weak points, but people are the most common route.
• “Through people: phishing and stolen or reused passwords” is correct.

  It's usually easier to trick someone into entering their password on a fake page, or to try passwords leaked from another site, than to break software. Most breaches involve a human step like this.

  • Defences: MFA, passkeys, password managers, training.
  • Report: suspicious emails quickly.

📖 Revise: Lesson 2: Threats

Why each option is right or wrong

• “Small websites are easier to find on search engines” (Incorrect): Scanners don't need search engines; they try every address.
• “Hosting companies share their customer lists with attackers” (Incorrect): They don't; scanners find sites automatically.
• “Small sites are attacked only by mistake” (Incorrect): It's deliberate and automated, not accidental.
• “Automated scanners try every address for known weaknesses” is correct.

  Attackers don't pick sites by fame. Bots scan the whole internet for outdated plugins, open ports and default passwords, attacking whatever they find. Being small doesn't hide you.

  • Typical targets: old WordPress plugins, exposed admin panels, weak SSH passwords.
  • Defence: updates and the basics.

📖 Revise: Lesson 2: Threats

Why each option is right or wrong

• “The physical fence around a data centre” (Incorrect): Physical security is separate; trust boundaries are about data flows.
• “The moment a user's session expires and they must sign in again” (Incorrect): Session expiry is about time; a trust boundary is where data crosses between parts.
• “The limit on how many users can sign in at once” (Incorrect): It's not a capacity limit.
• “Where data moves from less trusted to more trusted parts” is correct.

  The line between a user's browser and your API is a trust boundary: anything crossing it may be malicious. Checks like validation, authentication and authorisation belong at these boundaries.

  • Other boundaries: webhooks, file uploads, third-party APIs.
  • Rule: validate everything that crosses one.

📖 Revise: Lesson 3: Attack surfaces

Why each option is right or wrong

• “One very strong firewall that blocks every attack” (Incorrect): One layer, however strong, is a single point of failure.
• “Hiding the server deep inside a large building” (Incorrect): It's about layers of controls, not physical depth.
• “Using the longest possible password” (Incorrect): Long passwords help, but they're one layer.
• “Several independent layers, so one failure doesn't expose everything” is correct.

  No single control is perfect. A firewall, authentication, authorisation, validation, encryption and monitoring each catch some attacks. If one fails, the others still stand between the attacker and the data.

  • Example: RLS in the database as well as checks in the API.
  • Independent: layers that don't share the same weakness.

📖 Revise: Lesson 3: Attack surfaces

Why each option is right or wrong

• “They're the same thing described in different words” (Incorrect): They're different: one is a source of harm, the other a weakness.
• “A vulnerability could cause harm; a threat is a weakness” (Incorrect): That's the wrong way round.
• “Threats affect hardware; vulnerabilities affect software” (Incorrect): Both can involve hardware or software.
• “A threat could cause harm; a vulnerability is a weakness it could use” is correct.

  A threat is someone or something that might cause harm, like a criminal or a flood. A vulnerability is a weakness, like an unpatched server or an open port. Risk appears where a threat meets a vulnerability.

  • Example: a ransomware gang (threat) and missing updates (vulnerability).
  • Reduce risk: fix vulnerabilities you can control.

📖 Revise: Lesson 4: Vulnerabilities and the basics

Why each option is right or wrong

• “Buying the most expensive antivirus available” (Incorrect): Price doesn't decide protection; the basics matter more.
• “Changing every password every week” (Incorrect): Frequent forced changes often make passwords weaker.
• “Hiding the website from search engines” (Incorrect): Scanners find sites without search engines.
• “Keeping software updated” is correct.

  Most attacks use weaknesses that already have published fixes. Applying updates promptly, along with MFA, least privilege and backups, blocks a large share of real-world attacks.

  • Automate: security updates where possible.
  • Inventory: know what software you run.

📖 Revise: Lesson 4: Vulnerabilities and the basics

Why each option is right or wrong

• “Cost and complexity” (Incorrect): They affect how you respond, but risk itself is likelihood and impact.
• “Threats and passwords” (Incorrect): Threats feed into likelihood, but risk is measured as likelihood and impact.
• “Passwords and firewalls” (Incorrect): Those are controls, not parts of risk.
• “Likelihood and impact” is correct.

  Risk is how likely something is to happen combined with how bad it would be. A likely but minor problem and an unlikely but disastrous one may both need attention, in different ways.

  • Risk register: list risks with both scores.
  • Prioritise: high likelihood and high impact first.

📖 Revise: Lesson 5: Risk

Why each option is right or wrong

• “Encrypting the stored card numbers” (Incorrect): That reduces the risk; the data is still stored.
• “Buying cyber insurance for a breach” (Incorrect): That transfers the financial risk, not avoids it.
• “Adding monitoring to spot card theft” (Incorrect): That reduces impact by detecting it; the risk remains.
• “Not storing card details at all by using a payment provider” is correct.

  If you don't store card numbers, they can't be stolen from you. That removes the risk entirely, rather than reducing it with encryption or extra checks. The provider handles it under strict standards.

  • Other responses: reduce, transfer (insurance), accept.
  • Ask: do we need this data at all?

📖 Revise: Lesson 5: Risk