Chartered IT Professional (CITP) Information Security, Risk and Resilience Syllabus

Distinguish a virus, a worm, and a Trojan.

A virus attaches to a host file and needs user action to spread; a worm self-replicates and spreads across networks without a host or user action; a Trojan masquerades as legitimate software to trick a user into running it.

What distinguishes a zero-day vulnerability?

It is a vulnerability unknown to the vendor (or for which no patch yet exists), so defenders have had 'zero days' to fix it; a zero-day exploit attacks such a flaw before mitigation is available.

What is the difference between phishing, spear-phishing, and whaling?

Phishing is mass, untargeted fraudulent messaging; spear-phishing is tailored to a specific individual or organisation; whaling specifically targets senior executives or high-value individuals.

Describe a Distributed Denial of Service (DDoS) attack.

An attack that overwhelms a target system, service or network with traffic from many distributed sources (often a botnet) to exhaust resources and make it unavailable to legitimate users — attacking availability.

What is the difference between symmetric and asymmetric encryption?

Symmetric encryption uses a single shared secret key for both encryption and decryption (fast, e.g. AES). Asymmetric uses a mathematically linked public/private key pair (slower, e.g. RSA/ECC), enabling key exchange and digital signatures.

What security service does a cryptographic hash function provide, and name a key property.

It provides integrity by producing a fixed-length digest of input data. A key property is being one-way (pre-image resistant) and collision-resistant, so the input cannot be feasibly recovered and two different inputs should not produce the same hash (e.g. SHA-256).

How does a digital signature provide integrity, authenticity and non-repudiation?

The sender hashes the message and encrypts the hash with their private key; the recipient decrypts it with the sender's public key and compares hashes. A match proves the message is unaltered (integrity), came from the key owner (authenticity), and the signer cannot deny it (non-repudiation).

What is the role of a firewall versus an Intrusion Detection System (IDS)?

A firewall enforces a policy controlling which traffic may pass between networks (prevention/access control). An IDS monitors traffic or hosts to detect and alert on suspicious or malicious activity (detection); an IPS additionally blocks it.

Compare signature-based and anomaly-based detection.

Signature-based detection matches activity against known patterns of malicious behaviour (low false positives but misses novel attacks). Anomaly-based detection flags deviations from a learned baseline of normal behaviour (can catch unknown attacks but produces more false positives).

What is the purpose of network segmentation, and what is a DMZ?

Segmentation divides a network into zones to limit lateral movement and contain breaches. A DMZ (demilitarised zone) is a perimeter sub-network that hosts internet-facing services, isolating them from the trusted internal network.

Distinguish penetration testing from vulnerability scanning.

Vulnerability scanning is an automated, broad identification of known weaknesses. Penetration testing is a goal-oriented, often manual exercise that actively exploits vulnerabilities to demonstrate real-world impact and chains of compromise.

What is the difference between black-box, white-box and grey-box security testing?

Black-box: the tester has no prior knowledge of the system (external attacker view). White-box: the tester has full knowledge (source code, architecture, credentials). Grey-box: the tester has partial knowledge, such as user-level credentials.

What is the difference between Verification and Validation in assurance?

Verification asks 'are we building the system right?' (conformance to specification/requirements). Validation asks 'are we building the right system?' (does it meet the actual user/business need).

What is a SOC (Security Operations Centre) responsible for?

Centralised, ongoing monitoring, detection, analysis and response to security events across the organisation — typically using SIEM tooling, threat intelligence, and defined incident response processes, often 24/7.

State the qualitative risk formula commonly used in information security risk assessment.

$Risk = Likelihood \times Impact$, where likelihood is the probability of a threat exploiting a vulnerability and impact is the magnitude of resulting harm.

Define Annualised Loss Expectancy (ALE) and its component formulas.

$ALE = SLE \times ARO$, where Single Loss Expectancy $SLE = AssetValue \times EF$ (Exposure Factor) and ARO is the Annualised Rate of Occurrence. ALE is the expected monetary loss per year from a given risk.

If an asset is worth £200,000, an incident causes 25% loss, and it occurs twice per year, what is the ALE?

$SLE = £200{,}000 \times 0.25 = £50{,}000$; $ALE = £50{,}000 \times 2 = £100{,}000$ per year.

Contrast qualitative and quantitative risk assessment.

Qualitative assessment uses descriptive ratings (e.g. high/medium/low) and is faster and more subjective. Quantitative assessment assigns numeric/monetary values (e.g. ALE) enabling cost-benefit analysis but requires more reliable data.

What is the difference between inherent risk and residual risk?

Inherent risk is the level of risk present before any controls are applied. Residual risk is the risk remaining after controls/treatments have been implemented.

Name the four standard risk treatment options.

Treat/Mitigate (reduce likelihood or impact with controls), Tolerate/Accept (retain the risk), Transfer/Share (e.g. insurance or outsourcing), and Terminate/Avoid (stop the activity causing the risk).

Define 'risk appetite' and distinguish it from 'risk tolerance'.

Risk appetite is the amount and type of risk an organisation is willing to pursue or retain to meet its objectives (set at board level). Risk tolerance is the acceptable variation around that appetite for specific risks — the threshold within which risk is acceptable.

What is the formula for Return on Security Investment (ROSI)?

$ROSI = \dfrac{(ALE_{prior} - ALE_{post}) - CostOfControl}{CostOfControl}$, i.e. the monetary risk reduction achieved by a control minus its cost, divided by its cost.

What is a risk register and what does it typically record?

A central document tracking identified risks, each with a description, owner, likelihood, impact, risk score, chosen treatment/controls, residual risk, and status/review date.

What are the main concerns of third-party and supply chain risk management?

The risk that suppliers, vendors or partners introduce vulnerabilities — e.g. through their access to data/systems, weaker security posture, compromised software/components, or fourth-party dependencies — requiring due diligence, contractual controls, and ongoing assurance.

What is a 'fourth-party' risk in supply chain terms?

Risk arising from the subcontractors and suppliers of your direct (third-party) suppliers — entities you have no direct contract with but whose failure or compromise can still affect you.

In business continuity, define RTO and RPO.

Recovery Time Objective (RTO) is the maximum acceptable time to restore a service after disruption. Recovery Point Objective (RPO) is the maximum acceptable amount of data loss measured in time (how far back the last good backup must be).

What is the difference between a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP)?

A BCP is the broad strategy to keep critical business functions operating during/after disruption. A DRP is a subset focused specifically on restoring IT systems, data and infrastructure after an incident.

What is the purpose of a Business Impact Analysis (BIA)?

To identify critical business functions and processes, assess the impact of their disruption over time, and determine recovery priorities and requirements (informing RTOs, RPOs and resource needs).

Compare hot, warm, and cold disaster recovery sites.

A hot site is fully equipped and continuously running, enabling near-instant failover (most costly). A warm site has hardware/connectivity but needs data/configuration loading (moderate cost/time). A cold site provides only basic facilities/space and must be fully provisioned (cheapest, slowest recovery).

List the standard phases of the incident management/response lifecycle (NIST SP 800-61).

Preparation; Detection and Analysis; Containment, Eradication and Recovery; and Post-Incident Activity (lessons learned).

What is the difference between an event and an incident in security management?

An event is any observable occurrence in a system or network. A security incident is an event (or series of events) that actually or potentially compromises confidentiality, integrity or availability and warrants response.

What distinguishes operational resilience from traditional business continuity?

Operational resilience is the broader ability of an organisation to prevent, adapt to, respond to, recover from and learn from operational disruptions to its important business services — assuming disruption is inevitable and focusing on service continuity and impact tolerances, rather than just recovering specific assets.

In operational resilience, what is an 'impact tolerance'?

The maximum tolerable level of disruption to an important business service — expressed by metrics such as time, volume of customers affected, or financial loss — beyond which there would be intolerable harm to the firm, its customers or market integrity.

What is the difference between MTBF and MTTR as resilience metrics?

Mean Time Between Failures (MTBF) measures average operational time between failures (reliability — higher is better). Mean Time To Repair/Recover (MTTR) measures the average time to restore service after a failure (maintainability — lower is better).