1.2 Summarize fundamental security concepts

From class (Day 1): Confidentiality → encryption. Integrity → SHA-256 (was the file modified? hash it — hashes are one-way; SHA-256 is safe; a collision attack is when two inputs produce the same hash). Availability → server clustering, load balancers, RAID. Non-repudiation → digital signature. Obfuscation → "hard to figure out." Confidentiality controls — managerial: least privilege, need to know, separation of duties ("just give control as much as needed"); technical: encryption, access control (smart cards), steganography. Integrity controls: hashing, digital signatures, backups, version control. Availability controls: redundancy, fault tolerance, patch management. Implicit allow = everything allowed by default (bad); implicit deny is the secure default. Zero Trust → "verify everything before use." Windows share permissions: RO / RW / FC / NA, assigned via AGDLP (Accounts → Global → Domain Local → Permissions). A MAC address should be unique.

Breakdown 1 — The CIA triad (and its two extensions)

Property	Question it answers	Protected by	Attacked by
Confidentiality	Can only authorized people read it?	Encryption, access controls, classification, DLP	Eavesdropping, data breach, shoulder surfing
Integrity	Is it unchanged and trustworthy?	Hashing, digital signatures, checksums, version control, change management	Tampering, on-path modification, malware
Availability	Can I get to it when I need it?	Redundancy, backups, load balancing, UPS, patching	DoS/DDoS, ransomware, hardware failure

Two properties the exam adds to the triad:

• Non-repudiation — the sender cannot deny having sent/signed it. Provided by digital signatures (private key signs, public key verifies). Hashing alone does not give non-repudiation; a MAC (shared secret) does not either, because both parties hold the key.
• Authenticity — proof that data/people are genuine; also from digital signatures and certificates.

Exam tip: If the question says "prove who sent it and that they can't deny it" → digital signature / non-repudiation. If it says "prove it wasn't changed" → hash / integrity.

Breakdown 2 — AAA

A	Meaning	Answers	Examples
Authentication	Prove you are who you claim	Who are you?	Password, MFA, certificate, biometric
Authorization	What you're allowed to do once authenticated	What can you do?	ACLs, permissions, RBAC, policies
Accounting	Record what you did	What did you do?	Logs, audit trails, session records

• Authenticating people — factors: something you know / have / are / somewhere you are.
• Authenticating systems — devices prove identity with certificates (802.1X, device certs), TPM-backed keys, API keys, mutual TLS.
• Authorization models — DAC, MAC, RBAC, rule-based, ABAC (detail in 4.6). Know that authorization happens after authentication and is enforced by policy.

Protocols that provide AAA: RADIUS (UDP, encrypts only the password, combines authN+authZ), TACACS+ (TCP, encrypts the whole payload, separates all three — Cisco device admin), Kerberos, Diameter.

Breakdown 3 — Gap analysis

Compare where you are (current security posture) with where you should be (a framework, regulation, or target state), then list the gaps and a plan to close them. Steps: define scope/baseline → gather data (interviews, scans, audits) → analyze deltas → prioritize → remediation roadmap. Often the first step when adopting a standard (e.g., NIST CSF, ISO 27001, PCI DSS).

Breakdown 4 — Zero Trust

Motto: "never trust, always verify." No implicit trust based on network location; every request is authenticated, authorized, and continuously evaluated.

Two planes (from NIST SP 800-207):

Plane	Role	Components
Control plane	Decides whether access is granted	Policy Engine (makes the decision), Policy Administrator (issues/revokes the session token & tells the enforcement point), adaptive identity (risk-based, context-aware authentication), threat scope reduction (limit blast radius: least privilege, micro-segmentation), policy-driven access control
Data plane	Actually carries and enforces the access	Subject/system (the user/device asking), Policy Enforcement Point (PEP) (gateway that allows/denies per the control plane's decision), implicit trust zones (the small area behind the PEP where the connection is trusted for that session)

Policy Engine + Policy Administrator together are called the Policy Decision Point (PDP).

Exam tip: "Which component enforces the decision?" → PEP (data plane). "Which component makes the decision?" → Policy Engine (control plane). "Which component communicates the decision to the PEP?" → Policy Administrator.

Breakdown 5 — Physical security

Control	What it does	Type
Bollards	Posts/barriers that stop vehicles, not people	Preventive
Access control vestibule (mantrap)	Two interlocking doors; only one opens at a time — stops tailgating/piggybacking	Preventive
Fencing	Perimeter barrier; height/design sets how much it prevents vs. deters	Preventive/Deterrent
Video surveillance	Cameras; deters when visible, detects when reviewed; can use motion detection/object recognition	Deterrent/Detective
Security guard	Human judgment, can challenge people, check IDs, respond	Deterrent/Detective/Preventive
Access badge	Proof of authorization; can be smart card, RFID, proximity; combine with PIN for MFA	Preventive
Lighting	Removes hiding spots; deters and aids cameras/guards	Deterrent
Sensors	Infrared (body heat), pressure (weight on floor/mat), microwave (motion via reflected radio), ultrasonic (motion via sound)	Detective

Breakdown 6 — Deception and disruption technology

Tool	What it is	Purpose
Honeypot	A deliberately vulnerable-looking system	Lure attackers, study their techniques, waste their time
Honeynet	A whole network of honeypots	Larger, more realistic lure; observe lateral movement
Honeyfile	A fake file with an attractive name ("passwords.xlsx")	Access to it = alert; nobody legitimate should touch it
Honeytoken	Fake data (credentials, API key, DB record, email address)	If it's ever used, you know exactly where the leak came from

Deception = detective control + threat intelligence; it also disrupts attackers by feeding them bad data (e.g., fake DNS records, bogus hosts).

Quick self-check

• Which CIA property does a backup protect? (Availability.) A hash? (Integrity.)
• Digital signature gives which two properties beyond integrity? (Authenticity and non-repudiation.)
• Name the data-plane component that enforces Zero Trust decisions. (PEP.)
• What kind of sensor detects body heat? (Infrared.)