1Security fundamentals

• 1.1Security Fundamentals (CIA, Authenticity, Accountability, Non-Repudiation)

  Learn the three pillars of information security (confidentiality, integrity, availability, i.e. CIA) and the complementary properties that extend them: authenticity, accountability, non-repudiation, and reliability. Since SG focuses on managing information security from the user-organization side, the aim is not rote memorization but understanding which management objective each property serves in practice.

• 1.2Threats and Vulnerabilities (Human, Technical, and Physical Threats; Insider Misuse and Negligence)

  Learn the three categories of threats (human threats, technical threats, physical threats) and their relationship to vulnerabilities, and how risk materializes. SG places particular management emphasis on insider misuse and negligence—not just external attacks but how an organization manages intentional and unintentional risks from people inside it.

• 1.3Cyberattack Techniques (Malware, Targeted Attacks, Web App Attacks, DoS, Supply Chain Attacks)

  Learn the types of malware, targeted attacks, phishing, and BEC (business email compromise), web application attacks such as SQL injection, XSS, and CSRF, DoS/DDoS attacks, password attacks, social engineering that exploits human psychology, and supply chain attacks that route through business partners. SG emphasizes not the attack mechanics themselves but how an organization detects, defends against, and responds to them.

• 1.4Cryptography (Symmetric-Key, Public-Key, Hybrid Cryptography, Hashing, Key Management)

  Learn how symmetric-key cryptography and public-key cryptography work and when to use each, the hybrid cryptography that combines both, hash functions used to detect tampering, the phenomenon of cryptographic obsolescence where an older cryptographic scheme stops being safe, and, importantly for a manager, key management—the lifecycle of generating, storing, rotating, and disposing of keys.

• 1.5Authentication and Digital Signatures (MFA, PKI, SSL/TLS)

  Learn about multi-factor authentication (MFA) and biometric authentication, which verify identity via multiple factors; digital signatures that prove authorship; the PKI (public-key infrastructure) and certificate authorities (CAs) that guarantee a public key's validity; challenge-response authentication that prevents impersonation over a network; and SSL/TLS that protects web communications.