How it works
Security is not just blocking bad things. It is deciding what matters, what could go wrong, how likely it is, how much it would hurt, and which control changes the outcome.
For any scenario, write a four-part sentence: The asset is __, the vulnerability is __, the threat is __, so the mitigation should __.
Common error
Do not label everything as a threat. Weak password policy is a vulnerability; account takeover is a threat; multi-factor authentication is a mitigation.
Worked example
A scheduling account has a reused password and can export all student records. Identify the risk chain.
Evidence
Asset: student records
Condition: reused password and broad export access
Observed compromise: not establishedThe records are the asset. Password reuse and excessive permission are vulnerabilities. Credential abuse could lead to unauthorized export. Reduce that risk with stronger authentication and role-appropriate export permissions, and review access evidence without claiming a breach has already occurred.
Exercises
1.1.1
A former employee still has an active account. Identify the vulnerability and a plausible threat.
Show solution
The vulnerability is access that was not removed after the role ended. A plausible threat is use of that account to read or alter organizational data without authorization.
1.1.2
Compare MFA and least privilege for this account. Which part of the risk does each reduce?
Show solution
MFA reduces some forms of credential-only account takeover. Least privilege limits which data or actions the account can reach if it is misused. Neither alone guarantees the account cannot be abused.