Information security foundations are valuable because every employee and technical professional handles information that can be lost, altered, exposed, or made unavailable. The essential concepts are confidentiality, integrity, availability, threats, vulnerabilities, risk, controls, policy, people, physical protection, technical safeguards, and the legal or regulatory context in which information is used. Foundation-level study should create a mental model that explains why organizations protect information and how different controls work together.<\/p>\n
EXIN EX0-105<\/a> is the legacy Information Security Foundation based on ISO\/IEC 27002 exam code. EXIN\u2019s current security portfolio now uses Information Security Foundation based on ISO\/IEC 27001, and in 2026 EXIN also introduced Information Security Essentials as a shorter entry-level awareness credential. Candidates should therefore use EX0-105 for durable security concepts while preparing against current EXIN objectives rather than treating the old code as the live exam.<\/p>\n Confidentiality limits information to authorized people and systems. Integrity protects accuracy, completeness, and authorized change. Availability ensures information and services remain accessible when the business needs them. These three properties provide a practical way to understand why different controls exist.<\/p>\n A payroll database needs confidentiality because salaries are sensitive, integrity because incorrect values cause financial harm, and availability because payroll must run on schedule. Different information assets can place different emphasis on the three properties.<\/p>\n Security decisions should consider business use as well as technology. An internal announcement may need little confidentiality but high integrity, while a medical record can need all three properties at a very high level. Classification and risk assessment help translate that difference into appropriate controls.<\/p>\n The EXIN certifications<\/a> page provides the broader vendor context. Current EXIN information-security study should be aligned to the live ISO\/IEC 27001-based path.<\/p>\n A threat is a potential cause of harm, while a vulnerability is a weakness that can be exploited or triggered. Risk reflects the possibility and consequence of a threat affecting an asset through a vulnerability. These terms are related but should not be used as synonyms.<\/p>\n Risk assessment identifies important assets, threats, weaknesses, existing controls, likelihood, impact, and residual risk. The purpose is not to create a perfect numerical score; it is to support decisions about which risks need treatment and which controls are justified.<\/p>\n Risk treatment can include reducing the risk through controls, avoiding the activity, sharing or transferring part of the risk, or accepting residual risk when management determines that further treatment is not justified. Acceptance should be explicit and owned, not simply the result of a technical issue remaining unresolved.<\/p>\n The risk assessment<\/a> material provides additional context for scoping, analysis, treatment, and residual risk.<\/p>\n Information security is not solved by technology alone. Organizational controls can define policy, roles, supplier expectations, change processes, and incident responsibilities. People controls include awareness, training, screening, and clear responsibilities. Physical controls protect facilities, equipment, media, and entry points.<\/p>\n Technical controls include authentication, access control, encryption, logging, endpoint security, network protection, backup, and secure configuration. Strong programs combine control types because one safeguard rarely addresses the entire risk.<\/p>\n Defense in depth is useful when controls are independent enough that one failure does not immediately expose the asset. A stolen password is less damaging when MFA, device controls, segmentation, monitoring, and limited privilege reduce what the attacker can do.<\/p>\n Controls also need owners and evidence. A policy requiring backups has little value if nobody can show recent successful copies or a tested restore. A firewall rule is only useful when the organization knows why it exists and reviews whether the allowed path is still needed.<\/p>\n Users should receive the access needed for their responsibilities and no more. Joiner, mover, and leaver processes help ensure permissions are created, updated, and removed as employment or job roles change.<\/p>\n Privileged accounts deserve stronger governance because they can alter systems, permissions, logs, and security settings. Administrative activity should be attributable, monitored, and separated from ordinary user activity where practical.<\/p>\n Authentication strength should match risk. Passwords alone can be insufficient for remote or privileged access, while multi-factor authentication can reduce the impact of stolen credentials. Service accounts and automation identities also need owners, limited permissions, and credential lifecycle management.<\/p>\n Periodic access review helps identify permissions that were appropriate when granted but are no longer necessary. The review should compare actual access with current job responsibilities instead of assuming that an old approval remains valid forever.<\/p>\n Not all information requires identical protection. Classification can distinguish public information from internal, confidential, regulated, or highly sensitive data so access, encryption, sharing, retention, and disposal controls reflect business impact.<\/p>\n Handling rules should follow the information throughout its lifecycle. A confidential file can be protected in the main system but exposed through an email attachment, test copy, backup, printout, export, or third-party service if those secondary paths are ignored.<\/p>\n Data owners should understand who can access information, why it is retained, where it is stored, and how it is disposed of. Security becomes easier to manage when information value and responsibility are visible.<\/p>\n Supplier handling matters as well. Cloud services, processors, support providers, and contractors can receive sensitive information, so contracts, access, deletion, incident notification, and security expectations should reflect the classification of the data they handle.<\/p>\n Servers, laptops, network equipment, backup media, offices, and data centres can be affected by theft, fire, water, power loss, unauthorized entry, or environmental conditions. Physical entry controls, secure areas, visitor management, equipment protection, and environmental safeguards reduce those risks.<\/p>\n Portable devices create additional exposure because they can leave controlled facilities. Encryption, screen locking, secure storage, inventory, remote management, and clear loss-reporting procedures can reduce the impact of a missing laptop or phone.<\/p>\n Media disposal also matters. Deleting a file does not always remove recoverable data from a device, so disposal and reuse procedures should match the sensitivity of the information and the storage technology.<\/p>\n Business continuity depends on physical protection as well as cyber controls. Reliable power, cooling, fire protection, backup locations, and alternate work arrangements can determine whether information remains available during a facility incident.<\/p>\n Security incidents include more than malware. Lost devices, unauthorized access, data leakage, service disruption, configuration mistakes, fraud, and physical events can all require coordinated response.<\/p>\nInformation security begins with confidentiality, integrity, and availability<\/h2>\n
Threats, vulnerabilities, and risk should be distinguished clearly<\/h2>\n
Security controls can be organizational, physical, people-focused, or technical<\/h2>\n
Identity and access management should follow least privilege<\/h2>\n
Information classification helps match controls to business value<\/h2>\n
Physical and environmental security protect the systems beneath software controls<\/h2>\n
Incident management should prepare the organization before a breach<\/h2>\n