IT systems security and control: formula sheet

Key formulas

CIA triad

Confidentiality + Integrity + Availability

Use it to classify the harm a threat causes. Ransomware mainly hits availability; a data leak hits confidentiality; fraud by altering records hits integrity.

Risk

Risk = Likelihood × Impact

A common way to prioritise threats. It is a framework for judgement, not a precise calculation.

Threat classification

Threat source: external or internal; intent: deliberate or accidental

Hacking and ransomware are external and deliberate. Insider fraud is internal and deliberate. Human error is internal and accidental.

Answer structure

Threat → Scenario link → Impact → Control

Use this chain for each point so your answer is applied, not a list of definitions.

ITGC vs application control

ITGC = environment-wide (access, change, operations, backup); Application control = within one system (input, processing, output)

Use this as your first split in any answer. Say which level each control works at.

Control purpose

Preventive = stop it; Detective = find it; Corrective = fix it

Label each control you recommend. Give a concrete example, not just the label.

Application control groups

Input → Processing → Output

Follows the flow of a transaction. Use it to structure a list of controls.

Dependency rule

Weak ITGCs reduce reliance on application controls

Application controls are only reliable if ITGCs stop them being changed or bypassed.

Common control objectives

Completeness, Accuracy, Validity (authorisation), Restricted access

Tie each control to one of these objectives to show purpose.

Three authentication factors

Something you know + something you have + something you are

MFA needs at least two different factors. Two items from the same factor is not MFA.

Access control chain

Identification → Authentication → Authorisation → Accountability (logging)

Use this order to structure an answer. Logs let you trace who did what.

Encryption

Ciphertext = Encrypt(plaintext, key); Plaintext = Decrypt(ciphertext, key)

Symmetric encryption uses one shared key. Asymmetric uses a public key and a private key pair.

Least privilege

User rights = minimum needed to perform the role

Review rights on joining, role change and leaving.

GDPR data protection principles

Lawfulness, fairness and transparency | Purpose limitation | Data minimisation | Accuracy | Storage limitation | Integrity and confidentiality | Accountability

Use these as a checklist against the scenario. Pick the ones the facts breach rather than listing all seven by rote.

Information security objectives (CIA)

Confidentiality + Integrity + Availability

Confidentiality: only authorised people see data. Integrity: data is accurate and unaltered. Availability: data is accessible when needed.

ISO 27001 cycle

Assess risk → Select controls → Implement → Monitor and review → Improve

A continuous, risk-based management system, not a one-off project.

Content of an information security policy

Purpose and scope | Roles and responsibilities | Acceptable use rules | Access and classification | Incident response | Training | Monitoring and sanctions | Review

A useful structure when asked to recommend or draft policy content.

Three layers of protection

People + Process + Technology

Good answers cover all three, not just technical controls.

BCP vs DRP

BCP = whole-business continuity of critical activities; DRP = restoring IT and data

DRP sits inside BCP. Say this clearly when asked for the difference.

Recovery time objective (RTO)

RTO = maximum acceptable downtime

Shorter RTO means a hotter, costlier recovery site.

Recovery point objective (RPO)

RPO = maximum acceptable data loss, measured in time

Shorter RPO needs more frequent backup or real-time replication.

Recovery site ranking

Hot: fastest and costliest; Warm: middle; Cold: slowest and cheapest

Match the site type to how critical the system is.

Backup types

Full = all data; Incremental = changes since last backup; Differential = changes since last full backup

Incremental is quick to take but slower to restore. Differential is the reverse.

Plan cycle

Analyse impact → design plan → document → train → test → review

Use this as a structure for any plan-related requirement.

Risk exposure

Risk exposure = likelihood × impact

A qualitative guide. Rate each as high, medium or low, or use estimated values. It helps rank risks, not prove an exact loss.

Risk response (TARA)

Transfer, Avoid, Reduce, Accept

Match the response to risk level and appetite. High impact and high likelihood usually means avoid or reduce.

Incident response stages

Prepare → Detect → Contain → Eradicate → Recover → Review

Use as a checklist for any incident response question.

Cyber governance chain

Board (sets appetite, oversees) → Management (implements) → Assurance (audit committee, internal audit)

Use to structure who is responsible for what.

Quick revision

• Every control must answer a specific risk in the scenario.
• Threats come from outside (hackers, malware, phishing) and inside (errors, misuse, disgruntled staff).
• General controls cover the overall IT environment; application controls cover individual systems and transactions.
• Application controls typically cover input, processing and output accuracy and completeness.
• Access controls decide who can see or change what; apply the principle of least privilege.
• Authentication proves identity; multi-factor authentication is stronger than a password alone.
• Encryption protects data if it is intercepted or stolen, but key management must be sound.
• Data protection means handling personal data lawfully, fairly and securely, with clear accountability.
• An information security policy sets rules, and staff training makes it work in practice.
• Backups, disaster recovery and continuity plans must be tested, not just written.
• Cyber risk is a board issue, not only an IT issue.
• Always weigh control cost against the risk reduced, and state the residual risk.

Common mistakes

• Listing definitions of malware, phishing and ransomware with no link to the scenario. Fix: Use each definition in one sentence only, then spend the rest applying it to the business in the case.
• Treating IT security as only an external hacking problem. Fix: Always check for insider fraud and human error. Look for weak segregation of duties, poor training or unrestricted access in the scenario.
• Treating general controls and application controls as the same thing. Fix: Ask whether the control protects the whole environment or one system. Passwords for all users are general. A validation check on one input screen is application.
• Listing textbook controls without linking them to the scenario. Fix: Open each point with a fact from the case and show the risk to this business. Generic lists earn little credit.
• Calling a password plus a security question multi-factor authentication. Fix: Check that the proofs come from different categories: know, have, are.
• Listing controls without linking them to the scenario. Fix: Use a scenario fact in each point, such as remote sales staff using laptops, then name the control.
• Listing the seven GDPR principles with no link to the case. Fix: Select only the principles the scenario facts breach and quote the fact beside each one.
• Treating security as purely a technology issue. Fix: Always cover people and process too: policy, training, responsibilities, monitoring and culture.
• Treating business continuity and disaster recovery as the same thing Fix: State that BCP covers the whole business and DRP restores IT and data within it. Then give an example of each.
• Listing hot, warm and cold sites from memory with no link to the scenario Fix: Choose one option for the scenario's system and justify it using downtime cost, data volume and budget.

Exam tips

• Always tie the threat to a fact in the scenario. Generic lists earn few marks in SBL.
• Cover both external and internal threats unless the requirement limits you, and say which is more likely for this business.
• Discuss impact in several categories and rank them. Showing judgement scores higher than listing.
• Write in the format asked, such as a briefing note to the board, with plain business language to earn professional skills marks.
• Link controls to threats and keep them proportionate. Mention cost and practicality where the scenario suggests limited resources.
• Always state which level a control works at: general or application. The marker looks for that split.
• Anchor every control to a fact in the scenario. Quote the weakness first, then give the fix.
• Label controls as preventive, detective or corrective, and add input, processing or output where relevant, but keep the labels short so you have time for explanation.