Security Fundamentals

Information Security

The protection of data and information from unauthorized access, unlawful modification, disruption, disclosure, corruption, and destruction. Focuses on the information itself, not the systems holding it.

Information System Security

The protection of the systems that hold, process, and transmit critical data, including computers, servers, network devices, and smartphones. Focuses on the systems and devices, not the information itself.

CIA Triad

Confidentiality, Integrity, Availability — the three pillars of security. Every security decision maps back to protecting at least one of these three properties.

Confidentiality

Ensures information is only accessible to those with appropriate authorization. Violated when unauthorized users can view or access data.

Integrity

Ensures data remains accurate and unaltered unless modification is authorized. Example: checksums verify a file was not changed or corrupted during network transfer.

Availability

Ensures information resources are accessible and functional when needed by authorized users. Example: redundancy measures keeping a website online under high traffic.

Non-repudiation

Guarantees a specific action or event has taken place and cannot be denied by the parties involved. Example: a digital signature proves the sender cannot deny sending the message.

CIANA

CIA expanded with Non-repudiation (N) and Authentication (A) — a five-property pentagon model. The exam may reference both the original triad and this expanded form.

Authentication

The process of verifying the identity of a user or system. Example: username and password checked against stored credentials.

Authorization

Determines what actions or resources an authenticated user has permission to perform. Example: employee can VIEW database records but not EDIT them (read without write).

Accounting

Tracking user activities and resource utilization for auditing or billing. Example: logging all network actions to detect unusual or unauthorized behavior.

Security Controls

Measures or mechanisms put in place to mitigate risks and protect the CIA of information systems and their data. Every control has both a category and a type.

Zero Trust

Security model where no one — inside or outside the organization — is trusted by default. Verification is required from everyone attempting to access resources.

Threat

Anything that could cause harm, loss, damage, or compromise to a system or its data. A threat creates danger, but it only creates risk when a matching vulnerability exists.

Vulnerability

A weakness in design, implementation, configuration, or process that can be exploited by a threat. Vulnerabilities are internal weaknesses that the organization can often remediate.

Risk

The potential for loss or damage when a threat can exploit a vulnerability. Risk exists only when both a threat and a matching vulnerability are present.

Risk Management

The process of deciding how to handle identified risks. Every response falls into one of four strategies: Mitigate, Transfer, Avoid, or Accept.

Confidentiality

Protection of information from unauthorized access and disclosure. Ensures private or sensitive data is not available to unauthorized individuals, entities, or processes.

Encryption

Converting plaintext into ciphertext to prevent unauthorized access. Only readable by someone who holds the correct decryption key.

Plaintext

Data in its original readable format, before encryption is applied.

Ciphertext

Data after encryption — scrambled and unreadable without the corresponding decryption key.

Data Masking

Obscuring specific fields within a database so unauthorized users cannot see the real values, while authorized users retain access to the full data. Example: credit card number showing only last 4 digits.

PII — Personally Identifiable Information

Any data that can identify a specific individual: name, address, SSN, date of birth. Subject to regulatory protection; failure to protect results in fines.

PHI — Protected Health Information

Health-related data tied to an individual (diagnoses, treatment records). Regulated under HIPAA in the US. Mandatory confidentiality category alongside PII and financial data.

Integrity

Ensures data remains accurate and unchanged from its original state unless intentionally modified by an authorized individual. Verifies the accuracy and trustworthiness of data over its entire lifecycle.

Hashing

Converting data into a fixed-size value (hash digest). Any change to the original data — even one character — produces a dramatically different hash, revealing tampering. The primary integrity verification method.

Hash Digest

The output of a hashing function. Serves as a digital fingerprint for a piece of data — unique to its exact content. If the digest changes, the data has been altered.

Digital Signature

Ensures both integrity and authenticity. Process: (1) file is hashed to produce a hash digest, (2) digest is encrypted with the sender's private key. Any alteration to the file changes the hash and invalidates the signature.

Checksum

A value calculated from data and sent alongside it during transmission. The receiver recalculates the checksum on arrival — if values match, integrity is maintained; if different, tampering or corruption occurred.

Regular Audits

Systematically reviewing logs and operations to ensure only authorized changes have been made. Detects unauthorized modifications to systems, configurations, or data.

Availability

Ensures information, systems, and resources are accessible and operational when needed by authorized users. Measured by uptime percentage and expressed in 'nines'.

Redundancy

Duplication of critical components or functions of a system to enhance reliability. If one component fails, the backup takes over to ensure uninterrupted service.

Five Nines (99.999%)

The gold standard of availability. Permits a maximum of 5.26 minutes of downtime per calendar year. Requires robust infrastructure, proactive monitoring, and redundancy at every layer.

Three Nines (99.9%)

Permits a maximum of 8.76 hours of downtime per calendar year. Common baseline SLA for many service providers.

Server Redundancy

Using multiple servers in a load-balanced or failover configuration. If one server is overloaded or fails, others take over the load and continue serving users.

Data Redundancy

Storing data in multiple locations so that if one storage site fails, data remains accessible from another. Achieved via RAID locally or hybrid on-premises and cloud-based backup systems.

Network Redundancy

Multiple network paths so that if one path fails, data routes through an alternative. Example: primary fiber + secondary cable + cellular failover.

Power Redundancy

Backup power sources — generators and Uninterruptible Power Supply (UPS) systems — that keep systems operational during power outages or disruptions.

Non-repudiation

A security measure ensuring individuals or entities involved in a communication or transaction cannot deny their participation or the authenticity of their actions. Provides undeniable proof.

Digital Signature

The primary tool for achieving non-repudiation. Created by: (1) hashing the message to produce a hash digest, then (2) encrypting that hash digest with the sender's private key using asymmetric encryption. Only the private key holder can produce it — cannot be faked.

Asymmetric Encryption (in digital signatures)

Digital signatures use asymmetric encryption: the sender signs with their private key; the recipient verifies with the sender's public key. The private key is never shared, making the signature unique and non-deniable.

Authentication

A security measure that ensures individuals or entities are who they claim to be during a communication or transaction. Focuses on verifying identity before granting access.

Knowledge Factor (Something You Know)

Authentication relying on information the user can recall — passwords, PINs, passphrases, security questions. In a username-and-password login, the secret knowledge factor is the password or PIN.

Possession Factor (Something You Have)

Authentication relying on a physical item the user presents — employee badge, smartphone (for OTP), hardware token. Example: one-time SMS code sent to your phone.

Inherence Factor (Something You Are)

Authentication relying on a unique physical or behavioral characteristic. Also called biometric authentication. Examples: fingerprint scan, facial recognition, iris scan, voice recognition.

Action Factor (Something You Do)

Authentication relying on a unique action performed by the user. Examples: handwriting analysis, gait analysis (how you walk), keystroke dynamics.

Location Factor (Somewhere You Are)

Authentication relying on the user being in a specific geographic location. Examples: geofencing (must be within X feet of a location), country-based access restrictions.

MFA — Multi-Factor Authentication

A security process requiring users to provide two or more authentication factors from different categories to verify identity. Even if one factor is compromised, the attacker cannot proceed without the others.

2FA — Two-Factor Authentication

A specific form of MFA using exactly two authentication factors from different categories. A subset of MFA.

Biometric Authentication

An inherence-factor authentication method using unique physical characteristics (fingerprint, face, iris, voice). Falls under 'something you are.'

Authorization

The permissions and privileges granted to users or entities AFTER they have been authenticated. Determines what an authenticated identity is allowed to do, view, or modify within a system.

Role-Based Authorization (RBAC)

Access permissions determined by the user's assigned role in the system. Example: nurses can view patient vitals; only doctors can alter treatment plans. Covered in depth in Domain 4 (IAM).

Rule-Based Authorization

Access determined by predefined rules set by administrators, independent of user role. Example: no access allowed outside business hours regardless of who the user is.

Attribute-Based Authorization (ABAC)

Access determined by attributes of the user, the resource, and the environment (e.g. department, clearance level, time of day, location). More flexible than role-based. Covered in depth in Domain 4.

Permissions / Privileges

The specific actions a user is authorized to perform — read, write, modify, delete, execute. Granted after authentication based on identity and role.

Accounting

A security measure ensuring all user activities during a communication or transaction are properly tracked and recorded. Focuses on monitoring and logging actions of users or entities during digital interactions.

Audit Trail

A chronological record of all user activities used to trace changes, unauthorized access, or anomalies back to a specific user or point in time. The primary output of an accounting system.

Syslog Server

Aggregates logs from various network devices and systems into a central location so administrators can analyze them to detect patterns or anomalies across the organization.

Network Analyser (e.g. Wireshark)

Captures and analyzes network traffic to provide detailed insights into data moving across the network. Used to inspect packet-level detail for troubleshooting and forensic investigation.

SIEM — Security Information and Event Management

Provides real-time analysis of security alerts generated by hardware and software infrastructure across the organization. Aggregates, correlates, and alerts on log data. Covered in depth in Domain 4 (Day 26).

Technical Controls

Technologies, hardware, and software mechanisms implemented to manage and reduce risk. Operate at the system/technology layer and provide automated protection. Examples: antivirus, firewalls, encryption, intrusion detection systems (IDS).

Managerial Controls (= Administrative Controls)

Strategic planning and governance side of security. Ensure the organization's security strategy aligns with business goals and risk tolerance. Examples: risk assessments, security policies, training programs, incident response strategies. Also called Administrative Controls — both names are used on the exam.

Operational Controls

Day-to-day procedures and measures designed to protect data, governed by internal processes and human actions. Examples: password rotation policies, backup procedures, account reviews, user awareness training.

Physical Controls

Tangible, real-world measures that protect assets outside the digital realm. Examples: surveillance cameras, biometric scanners, reinforced doors, barbed wire fences, security guards, door locks, secure document shredding.

Preventative Control

Proactive measures implemented to thwart potential threats before an incident occurs. Fortifies systems ahead of time. Example: firewall filtering traffic to block harmful packets before they enter the network.

Deterrent Control

Discourages potential attackers by making an attack seem less appealing or more risky. Does not block or detect — only discourages. Example: warning signs, security banners on websites, visible cable locks.

Detective Control

Monitors and alerts to malicious activity as it occurs or shortly after. Goal is detection and notification — not prevention. Examples: security cameras, IDS (Intrusion Detection System), audit logs, SIEM alerts.

Corrective Control

Mitigates damage and restores systems to normal state after a threat has been detected. Activated after a detective control identifies an incident. Example: antivirus quarantining and removing malware after detection.

Compensating Control

An alternative measure implemented when the primary or ideal control is not feasible. Provides equivalent protection using a different approach. Example: WPA2 + VPN when a legacy system cannot support WPA3.

Directive Control

Guides, informs, or mandates actions through policy or documentation. Sets standards for behavior within an organization. Example: Acceptable Use Policy (AUP) governing how employees may use company IT assets.

AUP — Acceptable Use Policy

A directive control that defines how employees are permitted to use company-owned IT assets. A policy document — therefore always classified as a directive control.

IDS — Intrusion Detection System

Constantly scans network traffic for suspicious activity and notifies administrators when anomalies are detected. A detective control — it detects and alerts but does not block. Contrast with IPS (Intrusion Prevention System) which blocks.

Zero Trust

A cybersecurity approach that assumes no user, device, or system is trusted by default — regardless of whether they are inside or outside the network. Requires continuous verification for every access request. Mantra: 'Trust nothing and verify everything.'

Deperimeterization

The breakdown of traditional network perimeters, making perimeter-only defences insufficient. Driven by cloud migration, remote work, mobile devices, wireless networks, and outsourcing. The primary reason Zero Trust emerged.

Control Plane

The overarching framework responsible for defining, managing, and enforcing access policies in a Zero Trust architecture. Contains: Adaptive Identity, Threat Scope Reduction, Policy-Driven Access Control, Secured Zones, Policy Engine, and Policy Administrator.

Data Plane

Executes the policies defined by the Control Plane. Contains: the Subject/System (entity requesting access) and the Policy Enforcement Point (where access is granted or denied).

Adaptive Identity

Continuous real-time validation of identity using user behavior, device state, location, and context. Replaces static one-time login verification — identity is constantly re-evaluated and adjusted throughout a session.

Threat Scope Reduction

Limiting user access to only what is needed for their specific work tasks. Reduces the attack surface and minimizes the blast radius if credentials are compromised — an attacker cannot move freely through the whole network.

Policy-Driven Access Control

Developing and enforcing access policies based on user roles and responsibilities. Ensures users can only access data pertinent to their role, reducing potential for data breaches.

Secured Zones

Isolated environments within a network designed to house sensitive data. Only users with explicitly granted permissions can access them — an additional layer of protection beyond standard access controls.

Policy Engine

Cross-references an access request with predefined policies to determine whether the request aligns with the subject's permissions. Acts as the rule book — makes the allow/deny decision.

Policy Administrator

Establishes and manages the access policies that the Policy Engine enforces. Dictates who gets access to what and ensures policies align with the organization's security protocols and business objectives.

Policy Enforcement Point (PEP)

The final gatekeeper in the Zero Trust data plane. Executes the Policy Engine's allow or deny decision — physically grants or restricts access to sensitive systems or data.

Subject / System

The individual or entity attempting to gain access — an employee, a workstation, or a software application. Must be continuously verified before access to sensitive data or systems is granted.

Gap Analysis

A process of evaluating the differences between an organization's current performance/security posture and its desired state. Identifies areas where improvements are needed to bridge the gap.

Technical Gap Analysis

Evaluates an organization's current technical infrastructure and identifies where it falls short of required technical capabilities — e.g. outdated encryption, insufficient network speed for Zero Trust, weak security protocols.

Business Gap Analysis

Evaluates current business processes and identifies where they fall short of required capabilities — e.g. data management processes not suited for cloud, budgeting processes not aligned with new systems.

POA&M — Plan of Action and Milestones

A document that outlines specific measures to address each identified gap or vulnerability, allocates resources, and sets timelines for remediation tasks. The actionable output of a gap analysis — gets the organization from current state to desired state.