A layered view
After security foundations, explore physical spaces, networks, devices, applications and data. Separate the asset, threat, vulnerability and impact in each context.
Reason from evidence
Connect timestamps, users and actions in a log. Compare against normal behaviour before concluding that an attack occurred. State what further evidence is needed.
Selecting controls
Several controls may reduce the same risk. Explain both security benefits and usability effects. For example, combine multifactor authentication with strong passwords and log monitoring.