Fundamental Security Concepts

CIA Triad, Non-repudiation, AAA, Gap Analysis, Zero Trust, Deception Technologies.

The CIA Triad

The three core pillars of information security:

Pillar	Definition	Example Attack	Control
Confidentiality	Only authorized parties can read data	Eavesdropping, data breach	Encryption, access controls, MFA
Integrity	Data is accurate and unaltered	Man-in-the-middle tampering, ransomware	Hashing, digital signatures, version control
Availability	Data is accessible to authorized users when needed	DDoS attack, ransomware, hardware failure	Redundancy, backups, load balancing, DR plans

Memory Aid: CIA — like the spy agency, but for your data. Think: Can I Access (it) safely?

Non-Repudiation

Ensures that a party cannot deny having performed an action. Achieved through digital signatures and audit logs.

Example: Alice signs a contract with her private key. She cannot later claim she didn't sign it — the signature is mathematically tied to her key.
Non-repudiation requires both authentication (proving identity) and integrity (proving the content wasn't changed).

AAA Framework — Authentication, Authorization, Accounting

Component	Question Answered	Examples
Authentication	Who are you?	Password, fingerprint, smart card, MFA
Authorization	What are you allowed to do?	ACLs, RBAC, permissions, group policies
Accounting	What did you do?	Audit logs, SIEM, session recording

RADIUS and TACACS+ are common AAA protocols. RADIUS combines authentication and authorization; TACACS+ separates all three for finer control.

Gap Analysis

A gap analysis compares an organization's current security posture against a desired target state (a framework, regulation, or best-practice baseline).

Output: a score, list of missing/misconfigured controls, and remediation recommendations
Often performed when adopting NIST CSF, ISO 27001, or meeting a new compliance requirement
May involve third-party consultants for objectivity

Zero Trust Architecture

Zero Trust assumes no implicit trust — every access request must be authenticated, authorized, and continuously validated regardless of network location.

Old Perimeter Model

Trust inside the network
Firewall at the edge = security
VPN grants full access once connected

Zero Trust Model

Never trust, always verify
Microsegmentation — each resource requires auth
Least privilege enforced at every layer

Key Zero Trust concepts: Control Plane (policy engine + policy administrator), Data Plane (policy enforcement points — PEPs), Subject/System, Policy Decision Point (PDP).

Deception and Disruption Technologies

Technology	Description	Purpose
Honeypot	A single decoy system designed to attract attackers	Detect, study, and delay attackers
Honeynet	A network of honeypots simulating a real environment	Study attacker behavior on a larger scale
Honeyfile	A fake file with enticing name (e.g., passwords.xlsx) that triggers an alert when accessed	Detect insider threats or lateral movement
Honeytoken	A fake credential or API key planted in code/repos	Alert when stolen credentials are used
DNS Sinkhole	Redirects malicious DNS queries to a controlled IP	Block C2 communications, identify infected hosts

Exam Tip: Honeypots are detective controls. They don't prevent attacks — they detect and study them. A honeytoken is useful for detecting credential theft even when the attacker never accesses your live systems.

Physical Security

Physical security protects hardware, facilities, and people. Key elements:

Fencing & Barriers: Bollards, turnstiles, mantraps (access control vestibules)
Locks: Pin tumbler, electronic, biometric
Surveillance: CCTV, motion sensors, lighting
Guards: Provide deterrent + detective + responsive control
Visitor Management: Sign-in logs, escort policies, badges