1. Data handling

The data lifecycle: Create → Store → Use → Share → Archive → Destroy.

Classification: grouping data by sensitivity and the harm that disclosure would cause (for example public, internal, confidential, restricted). The data owner decides the classification.
Labelling: marking the data or media with its classification so people handle it correctly.
Retention: keep data only as long as law or business need requires, then destroy it. Keeping it longer increases risk.
Data states: at rest (stored), in transit (moving across a network), in use (being processed). Encrypt data at rest and in transit.

Destroying data:

Method	What it does	Note
Clearing	Overwriting so normal tools cannot recover the data	Media can be reused in the same organisation
Purging	Stronger removal that resists laboratory recovery	Includes degaussing
Degaussing	A strong magnetic field erases magnetic media	Does not work on SSDs or optical discs
Physical destruction	Shredding, crushing, incinerating	The most certain method

Data masking hides part or all of a value so that people who do not need the real data cannot see it. Examples: showing only the last four digits of a card number, or replacing real customer names with realistic fake ones in a test system.

Sanitisation is the general term for removing data from media so it cannot be recovered, before the media is reused or disposed of. The table above shows the methods. For solid-state drives, use the drive's secure erase or cryptographic erase, or destroy it physically.

2. Cryptography basics

Type	Keys	Strength	Weakness
Symmetric	One shared key encrypts and decrypts	Fast, good for large data	Sharing the key safely is hard
Asymmetric	A public and private key pair	Solves key sharing, enables digital signatures	Slow
Hashing	No key; one-way	Proves integrity	Cannot be reversed, so it is not encryption

For confidentiality: encrypt with the recipient's public key; they decrypt with their private key.
For a digital signature: sign with the sender's private key; anyone verifies with the sender's public key. This gives integrity, authentication and non-repudiation.
A hash turns any input into a fixed-length digest. The same input always gives the same digest, and any change to the input changes it.

Salting adds a unique random value to each password before hashing, so identical passwords produce different hashes and precomputed tables are useless.

Quantum-resistant cryptography: a large quantum computer could break today's common asymmetric algorithms (RSA, elliptic curve). Symmetric encryption and hashing are much less affected; larger key sizes are enough.

Harvest now, decrypt later: attackers can store encrypted data today and decrypt it once quantum computers are capable, so long-lived secrets are already at risk.
Post-quantum cryptography means new algorithms designed to resist quantum attack. NIST published its first standards in 2024.
Organisations should know where they use cryptography so they can replace algorithms when needed (crypto-agility).

3. Logging and monitoring

Logs record who did what and when. They support accountability and incident investigation.
Protect logs from alteration, store them centrally, and review them regularly.
Ingress monitoring watches traffic coming in (firewalls, IDS/IPS, anti-malware). Egress monitoring watches data leaving; data loss prevention (DLP) tools do this.

4. Detecting and preventing threats

IDS (intrusion detection system): monitors and alerts. HIDS watches one host; NIDS watches network traffic.
IPS (intrusion prevention system): sits in the traffic path and blocks attacks.
SIEM: collects and correlates logs from many sources to find patterns.
Anti-malware, vulnerability scans and patching keep systems clean and current.

5. Security event triage

A security operations centre receives far more alerts than it can investigate in depth. Triage is the quick first assessment that decides what matters most.

Prioritisation: rank by severity, by how critical the affected asset is, and by how far the problem has spread. Malware on a domain controller outranks malware on a test laptop.
Correlation: linking related events from different sources to see one incident. A failed-login alert, a new admin account and a large upload may be one attack.
Use cases: predefined scenarios the team wants to detect, with the logs and rules needed for each.

Result	Meaning
True positive	An alert for real malicious activity
False positive	An alert for harmless activity. Too many cause alert fatigue.
False negative	Malicious activity that raised no alert. The most dangerous outcome.

AI and automation help sort and correlate large volumes of alerts, but a person should confirm important decisions.

6. Threats and attacks

Threat	What it is
DoS / DDoS	Flooding a target so legitimate users cannot reach it. DDoS uses many compromised machines.
Virus	Malware that attaches to a file and needs a user action to spread
Worm	Malware that spreads across networks by itself
Trojan	Malware disguised as legitimate software
Ransomware	Encrypts data and demands payment
On-path (man-in-the-middle)	The attacker secretly sits between two parties, reading or altering traffic
Phishing	Fraudulent messages that trick people into revealing information
Side-channel	Learning secrets from indirect signals such as timing or power use
Advanced persistent threat (APT)	A skilled, well-funded attacker that stays hidden for a long time
Insider threat	Someone with legitimate access who causes harm, deliberately or by accident

7. Threat actors and their motivations

Threat actor	Typical motivation	Capability
Nation-state (often an APT)	Espionage, disruption, strategic advantage	Very high, patient, well funded
Organised crime	Money: ransomware, fraud, data theft	High
Hacktivist	Political or social cause	Varies
Insider	Malicious (revenge, money) or accidental (mistakes)	Already has legitimate access
Script kiddie	Curiosity, notoriety	Low; uses tools made by others
Competitor	Commercial advantage	Varies

8. Cyber threat intelligence and threat frameworks

Cyber threat intelligence (CTI) is evidence-based knowledge about threats that helps an organisation make decisions and prepare defences.

Indicators of compromise (IoCs): evidence that an attack has happened, such as a malicious file hash, IP address or domain.
Tactics, techniques and procedures (TTPs): how an attacker behaves. They are harder for attackers to change than IoCs, so more valuable.
Sources: vendor feeds, government alerts, open-source reports, and industry sharing groups.

Framework	What it describes
MITRE ATT&CK	A knowledge base of real-world attacker tactics and techniques, used to map detection coverage
Cyber Kill Chain	The stages of an attack: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, actions on objectives
STRIDE	Threat categories for threat modelling: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege

9. Incident response terms

Event: any observable occurrence (a login, a file being opened).
Incident: an event that actually or potentially harms confidentiality, integrity or availability.
Breach: unauthorised access to, or disclosure of, protected information.
Exploit: a particular attack that takes advantage of a vulnerability.
Intrusion: an attacker deliberately gaining unauthorised access.
Zero day: a vulnerability not yet known to the vendor, so no patch exists.

10. The incident response lifecycle

Phase	What happens
1. Preparation	Write the policy and plan, train the team, set up tools and contact lists
2. Detection and analysis	Monitor, confirm that an incident is real, assess scope and priority
3. Containment, eradication and recovery	Isolate affected systems, remove the cause, restore to normal
4. Post-incident activity	Lessons learned, update the plan, keep evidence

The incident response team is cross-functional: security, IT, management, legal, HR and communications.

The incident response plan (IRP) sets out roles and responsibilities, how to classify incidents, escalation and communication routes, and the steps for each phase. It works together with the data handling policy, which determines how affected data is treated and who must be notified of a breach.

Evidence: record who handled each item and when (chain of custody).
Communication: only designated people speak to media, customers and regulators.
Exercises: test the plan regularly. A tabletop exercise talks through a scenario; simulations and live tests go further. The aim is to find gaps before a real incident.

11. Asset lifecycle management

You cannot protect what you do not know you have. An accurate asset inventory of hardware, software, data and cloud services is the starting point.

Lifecycle: plan, acquire, deploy, operate and maintain, retire and dispose.

End of life (EOL) / end of support: the vendor stops providing security patches. New vulnerabilities stay open for ever.
If an EOL system cannot be replaced yet: isolate it, restrict access, add monitoring, and plan its replacement.
Disposal: sanitise media and remove the asset from the inventory.
Shadow IT (including unapproved AI tools) is technology used without approval. It is unmanaged and missing from the inventory.

12. System hardening and configuration management

Hardening: reducing the attack surface by removing unneeded software and services, closing unused ports and changing default passwords.
Baseline: the approved minimum secure configuration for a type of system.
Patch management: identify, test, approve, deploy, then verify. Always have a rollback plan.
Configuration management steps: identification, baseline, change control, verification and audit.

13. Security testing

Team	Role
Red team	Simulates real attackers to test defences
Blue team	Defends: monitors, detects and responds
Purple team	Red and blue working together and sharing findings to improve detection

Test	What it does
Vulnerability scan	Automated check for known weaknesses. It identifies but does not exploit.
Penetration test	Authorised attempt to exploit weaknesses to show real impact
Static analysis (SAST)	Examines source code without running it. Finds flaws early.
Dynamic analysis (DAST)	Tests the running application from the outside
Threat modelling	Identifies likely threats and countermeasures at the design stage

All testing needs written authorisation and an agreed scope (rules of engagement) before it starts.

Physical penetration testing checks whether people and physical controls can be bypassed. Common methods are phishing to gain a foothold, tailgating through secure doors, and impersonation of staff, couriers or technicians.

Exam tips

Hashing gives integrity, not confidentiality.
Public key to encrypt for someone. Private key to sign.
Quantum computers mainly threaten asymmetric algorithms such as RSA.
A false negative is worse than a false positive.
Red attacks, blue defends, purple is both working together.
A scan finds weaknesses. A penetration test exploits them, with written permission.