Security Paradigms sets the vocabulary the other eight chapters silently assume. It covers the CIA triad (confidentiality, integrity, availability), the classification of assets into asset security levels, the place of security testing inside a security audit, zero trust as a paradigm, and the consequences of reusing open-source software (OSS) components.
The danger is that this reads like background material, so candidates skim it and then lose points on single-word distinctions. An audit is a formal assessment of whether controls and policies are in place; testing is one activity that can feed it — they are not synonyms and they do not have the same output. Zero trust is not a product, and not a stricter perimeter: it removes the assumption of a trusted internal network altogether, which changes what your tests have to prove. The zero trust learning objective is at application level, so expect to be asked how it reshapes a test, not what it means.
Study each concept by asking what it changes about a concrete test: which asset security level raises the required rigour, which reused component widens the attack surface, which part of the triad a given failure actually violates.
Security audit vs security testing — the audit assesses compliance and control coverage; testing produces evidence the audit consumes.
Asset security level vs test difficulty — the sensitivity of the information dictates how rigorous testing must be, not how technically hard it is.
Zero trust vs perimeter defence — "inside the network" grants nothing; every request is verified regardless of origin.
Confidentiality vs integrity — unauthorized reading and unauthorized modification are different failures with different tests.
Availability is a security property — a denial-of-service condition belongs to security, not only to performance.
Reusing OSS moves risk, it does not remove it — there is no vendor accountable for the component you adopted.
Public component, public weaknesses — an attacker reads the same published vulnerability lists for that OSS library that you do.
This chapter is covered most heavily (6 questions) in CT-STE — Mock Exam 1 (Zero Trust, Access Control & Threat Modelling), CT-STE — Mock Exam 2 (Attacker Profiling, DevOps Pipelines & Standards as Oracles), CT-STE — Mock Exam 3 (Reconnaissance Analysis, Standards & Regression)