HTML Lab • Chapter 1 • Mastering Information Security

Hands‑On Lab: The Essence of Information Security

This lab reinforces the core concepts from Chapter 1 using practical mini‑activities. You can run it offline: open this file in any browser. No internet required.

Lab Orientation

5–10 minutes

Complete the activities in order. Your score is tracked locally in the browser (no data is sent anywhere).

0
Total Points
0/6
Activities Completed
Instructor Tip: Ask learners to justify answers in one sentence. The goal is security thinking, not memorization.

Activity 1 — Classify Information (Digital / Physical / Verbal)

10 minutes • 10 pts

Drag each item into the correct category. Then click Check.

Items to classify
Customer database in a cloud service
Printed HR files in a cabinet
Strategy discussion in a meeting room
Source code repository
Whiteboard notes after a workshop
A password shared over the phone
Digital
Stored/processed electronically
Physical
Paper, printouts, artifacts
Verbal
Spoken, heard, remembered
Not checked yet.

Activity 2 — Cybersecurity vs Information Security

7 minutes • 8 pts

Select the most accurate statement.

Which statement is most accurate?
Not checked yet.

Activity 3 — Map Controls to the CIA Triad

10 minutes • 12 pts

For each control, pick the primary CIA objective it supports.

1) Encrypt data at rest
2) Change control and approvals for production updates
3) Redundant systems + tested backups
Not checked yet.

Activity 4 — Security Myths: Myth or Reality?

8 minutes • 10 pts

Mark each statement as a Myth or Reality.

1) “If we buy the right tools, we will be secure.”
2) “Security is an organizational discipline, not only an IT function.”
3) “Trust should be engineered and governed, not assumed.”
Not checked yet.

Activity 5 — TPSRSR in Practice (Insider Risk Design)

12 minutes • 15 pts

Read the scenario and propose design improvements using TPSRSR. Then compare with the model answer.

Scenario

A single payroll administrator can: create employees, change bank accounts, approve payroll, and export payroll reports. There is no peer review. Audits happen annually.

Your response (3–6 bullets)
Not checked yet.

Activity 6 — One‑Page Security Definition (Your Organization)

15 minutes • 20 pts

Write a short definition of information security for a non‑technical leader. Include: scope (all forms), purpose (trust/resilience/continuity), and accountability.

Your one‑page definition
Not checked yet.

Completion

Wrap‑up

If you are using this in class, discuss: Which activity changed your understanding the most—and why?

Next step: Move to Chapter 2 (Core Elements) and repeat the same pattern: definition → boundaries → principles → governance → practice.
© Dr. Nader Iranpour • Mastering Information Security • Chapter 1 Lab • v1.0