UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 1.2 Free with a free account
The Core Ideas Behind Keeping Information Safe from Unauthorized Access
Ethics in Technology · Chapter 1: What Cybersecurity Means and Why Protecting Digital Information Is Everyone's ResponsibilitySection 1.2 · lesson 2 of 11614 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: How the Field of Protecting Digital Information Has Evolved Over the Decades →← What Cybersecurity Means and Why Every Organization Needs ItNext lesson: How the Field of Protecting Digital Information Has Evolved Over the Decades →
In this lesson
Use precise vocabulary to make practical security decisions.
- Separate asset, threat, vulnerability, risk, and control
- Classify controls by nature and function
- Apply least privilege and independent layers
- Distinguish the 4 access concepts
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,716 words). Read along, or search it.
Chapter 1
The Core Ideas Behind Information Safety
Security decisions depend on precise language, because different problems need different responses. A payroll concern might mean an attacker, an unlocked cabinet, or the consequences of exposure. Those possibilities cannot be prioritized sensibly, until the people discussing them agree on the terms. This lesson separates assets, threats, vulnerabilities, risks, and controls, then connects them again. We classify controls twice: by what they are, and by what they do. Least privilege limits access to the needs of the job, for the necessary time. Defense in depth adds independent layers, rather than relying on one protection. Four access concepts distinguish claiming an identity, proving it, granting permission, and recording actions. Each concept answers a different question, so none can replace the others. The practical outcome is clearer choices about what matters, what can fail, and what to fix.
Five Core Terms
Describe the Problem Before Choosing a Tool
An asset is something valuable that an organization wants to protect. Think of a bicycle stored in a garage, as an everyday example of value. A threat is a circumstance or actor with potential to cause harm, such as neighborhood thieves. A vulnerability is a usable weakness, such as the garage door's broken latch. Risk combines the likelihood of harm, and the seriousness of the resulting loss. A control reduces risk, through measures such as repairing the latch or adding a lock. Registering the serial number can help detect or reverse harm, rather than only prevent it. Threats can exist without a particular weakness, and weaknesses can exist without an immediate event. Organizations generally have more influence over their weaknesses, than over whether criminals exist. A control needs a risk-based purpose; an expensive safe protecting nothing adds little value.
Asset Inventory
Value Extends Beyond Purchase Price
Begin with an inventory, because protection cannot reliably cover assets that have never been listed. Information assets include records, financial data, research, source code, contracts, and backup copies. They can be copied without obvious physical loss, which makes their exposure difficult to notice. Hardware includes computers, phones, printers, badge readers, network equipment, and storage media. Its value combines replacement costs, and the information it holds or can reach. Software and service assets include applications, databases, cloud accounts, and the licenses supporting them. A stopped service can cost more than replacing the equipment on which it runs. People bring expertise, supplier relationships, and undocumented knowledge; reputation and trust also have value. A database of ten thousand patient records carries consequences beyond the price of its disk. Value should therefore reflect what loss means, rather than only the original purchase price.
Threats and Weaknesses
Different Causes Require Different Controls
A threat describes possible harm; a threat actor identifies its source; an event is what happens. Hostile human threats include deliberate theft, fraud, sabotage, and extortion through encrypted files. Accidental human threats include wrong recipients, mistaken deletion, fatigue, or confusing system design. Technical threats include failed disks, software defects, expired certificates, and failed updates. Environmental threats include fire, flood, extended power loss, and excessive heat in equipment rooms. Weaknesses also appear in several places, rather than only in software. Technical weaknesses include default passwords and missing patches; process weaknesses include access never removed. Human weaknesses include unrecognized deception, unquestioned urgency, and passwords reused across personal and work accounts. Physical weaknesses include propped doors, unlocked equipment rooms, exposed screens, and documents discarded without shredding. Match threats to reachable weaknesses and valuable assets, instead of buying tools against only hostile outsiders.
Risk Priorities
Combine Likelihood With Impact
Risk brings together something valuable, something that could harm it, and a usable opening. Removing any one element removes that particular exposure, though other risks may remain. Deleting data no longer needed can be inexpensive protection, because the information is no longer held. Risk assessment then asks two separate questions: how likely is harm, and how severe would it be? Neither judgment is automatically a precise numerical measurement, despite the appearance of some risk grids. A rare event with minor consequences differs from an almost certain event with severe consequences. The first may need little treatment, while the second demands urgent attention. The middle combinations require judgment, particularly when a rare event could be catastrophic. An open folder holding only a public catalog has little confidentiality impact, despite its missing password. Still review it, because contents may change or the opening may support unwanted files.
Four Responses
Reduce, Transfer, Avoid, or Accept
Four responses organize risk decisions: reduce, transfer, avoid, and accept. Reduction uses controls to lower likelihood, impact, or both, as with extra proof before releasing payments. Transfer shifts part of the financial consequence, through insurance or a provider's contractual responsibility. The event can still occur, even when someone else absorbs part of its cost. Avoidance stops the risky activity, or removes the asset that creates the exposure. Not storing card numbers, and using a payment processor instead, illustrates that choice. Acceptance consciously retains a risk, perhaps for a brief outage on a six-person internal tool. Acceptance requires an authorized, recorded decision. Silence does not turn neglected risk into an accepted risk. Residual risk is what remains after the controls have been applied. An organization must understand that remaining exposure, rather than assuming treatment eliminates every possible harm.
Control Nature
What Kind of Measure Is It?
Controls have a nature, meaning the kind of measure through which protection operates. Administrative controls are written rules and human processes, sometimes called managerial controls. Examples include training, background checks, approval workflows, and procedures for removing access when staff leave. Technical controls use systems and software, and are sometimes called logical controls. Permissions, encryption, audit logging, automatic session timeouts, and message filtering enforce rules through technology. Physical controls govern access to places and equipment, through tangible protections. Doors, badges, cameras, cable locks, shredders, and fire suppression belong to this category. The categories depend on one another, rather than competing for a single best position. A last-day access policy needs the account disabled, and the physical badge deactivated as well. Without those practical changes, the administrative rule exists on paper while access remains open.
Control Function
When Does the Measure Act?
A control's function describes when it acts, and what it achieves against harm. Preventive controls act before the event, trying to stop it from happening. A locked door, a permission check, and a required approval are preventive examples. Detective controls reveal activity during or after an event, through logs, alarms, or monitoring alerts. Account reconciliation can also reveal a problem, without having prevented the original transaction. Corrective controls act after harm, limiting damage and restoring normal operation. Restoring a backup, revoking a compromised account, and following recovery procedures provide corrective capability. A deterrent discourages attempts, as with a visible camera or a warning notice. A compensating control substitutes when a preferred measure is impractical, such as extra monitoring of older systems. Prevention alone is brittle: when it fails, the organization still needs discovery and recovery.
Two Independent Schemes
A Control Has Both Nature and Function
Nature and function are independent classifications, so a control has both at once. Administrative prevention includes training and approval policies, while administrative detection includes periodic access reviews. Administrative correction includes incident plans, retraining procedures, and other organized responses after harm. Technical prevention includes permissions and encryption; technical detection includes logs, alerts, and integrity checks. Technical correction includes restoration and automatic isolation of affected devices. Physical prevention includes locked rooms and badges, while physical detection includes cameras and door sensors. Physical correction includes fire suppression, spare equipment, and a secondary site ready for use. A quarterly review of administrator access is administrative and detective, because people discover unnecessary permissions. Restoring a database is technical and corrective; an unusual-download alert is technical and detective. Ask what the control is made of, then when it acts, rather than guessing from one classification.
Least Privilege
Limit Access by Job and by Time
Least privilege grants only the access required for a function, and only while it is needed. It limits damage from mistakes, malicious behavior, or an account taken over by someone else. Reception needs appointments, names, and contacts, without clinical notes, billing records, or system settings. Nurses need records of current patients, rather than unrelated patients, payroll, or user administration. Billing staff need codes, invoices, and insurance details, without clinical notes beyond billing requirements. Administrators should use standard accounts routinely, reserving elevated accounts for administration tasks. Trusting an employee does not remove the possibility of a mistake or stolen credentials. Privilege creep occurs when role changes add permissions, while previous permissions are never removed. Scheduled reviews re-justify current access, reducing that accumulation of unnecessary authority. Separation of duties addresses another limit: one person raises a payment, while another person releases it.
Defense in Depth
Layers Must Be Independent and Diverse
Defense in depth arranges multiple controls, so one failure does not expose everything behind it. The first requirement is independence: layers must not share a single point of failure. Two password checks using the same broken directory can behave like one layer, despite looking separate. The second requirement is diversity, mixing different control natures and different functions. In the patient-database example, training encourages reporting a deceptive message before it is opened. Device protection limits harmful activity, while least privilege limits the files a compromised account can reach. Network separation obstructs movement toward database servers, and logging reveals unusual patterns of access. Encrypted storage limits the usefulness of copied files, while tested backups support recovery from damage. Detection remains valuable even when it cannot prevent the first action, because it reduces undisturbed time. The aim is a harder, noisier sequence to complete, with opportunities to notice and contain it.
Four Access Concepts
Claim, Prove, Permit, and Record
Identification asks who you claim to be, through a username or other unique identifier. Authentication asks whether you can prove that claim, using evidence the system judges sufficient. Authorization asks what the proven identity may do, by checking permissions for particular actions. Accountability records what was done, tied to the identity, in records the user cannot alter. At a guarded door, state a name, prove it with a badge, check permitted floors, and record entry. A shared login may still authenticate and receive permissions, while failing to identify the individual person. Its logs then name the shared account, rather than proving which person performed a transaction. The source's four-person bookshop has outdated software, a shared administrator login, and untested nightly backups. Replace that login with four named accounts; only the owner can export the whole customer list. Packing staff need assigned delivery addresses. Updates, handling policies, export logs, and quarterly restore tests add controls. Separate database credentials, provider-held payment details, and an offline tested backup add protection beyond the storefront. The vocabulary turns these weaknesses into specific decisions, rather than a vague instruction to improve security.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About The Core Ideas Behind Keeping Information Safe from Unauthorized Access
What is the difference between a threat, a vulnerability, and a risk?
What does defense in depth mean in cybersecurity?
What are preventive, detective, and corrective security controls?
What is the difference between identification, authentication, authorization, and accountability?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →