Core Concepts

12m 41s

This Lesson introduces the core concepts and definitions used in information security and will provide you with an important foundation for the rest of the Lesson. It then builds on that knowledge by outlining how information security contributes to achieving the objectives of an organisation through strong governance, risk management, and compliance.

Learning objectives

The objectives of this Lesson are to provide you with and understanding of:

  • What security means
  • The core concepts and definitions used in information security
  • The key business drivers and how they shape the organisation’s approach to governance, risk management and compliance
  • The benefits of information security
  • The role information security plays in an organisation
  • How an organisation can make information security an integral part of its business

Intended audience

This Lesson is ideal for members of information security management teams, IT managers, security and systems managers, information asset owners and employees with legal compliance responsibilities. It acts as a foundation for more advanced managerial or technical qualifications.


There are no specific pre-requisites to study this Lesson, however, a basic knowledge of IT, an understanding of the general principles of information technology security, and awareness of the issues involved with security control activity would be advantageous.


We welcome all feedback and suggestions - please contact us at if you are unsure about where to start or if would like help getting started.

About the Author
Fred Hickling, opens in a new tab
Cyber Security Trainer
Learning paths

Fred is a trainer and consultant specializing in cyber security.  His educational background is in physics, having a BSc and a couple of master’s degrees, one in astrophysics and the other in nuclear and particle physics.  However, most of his professional life has been spent in IT, covering a broad range of activities including system management, programming (originally in C but more recently Python, Ruby et al), database design and management as well as networking.  From networking it was a natural progression to IT security and cyber security more generally.  As well as having many professional credentials reflecting the breadth of his experience (including CASP, CISM and CCISO), he is a Certified Ethical Hacker and a GCHQ Certified Trainer for a number of cybersecurity courses, including CISMP, CISSP and GDPR Practitioner.