Fundamental security concepts

This objective is the foundation the rest of the exam builds on: the CIA triad, non-repudiation, AAA, gap analysis, zero trust with its control and data planes, physical security, and deception technologies such as honeypots.

CIA, non-repudiation, and AAA

Confidentiality keeps data away from people who shouldn't see it (encryption, access control). Integrity makes sure data hasn't been altered without detection (hashing, digital signatures). Availability keeps systems usable when needed (redundancy, backups, DDoS protection). Most controls serve one leg of the triad more than the others, and exam questions often ask which leg a control protects.

Non-repudiation means a sender can't credibly deny an action. A digital signature gives non-repudiation because only the holder of the private key could have produced it. A shared password does not, because anyone who knows it could have acted.

Authentication applies to systems as well as people. A device certificate or an agent check can authenticate a laptop before it joins the network, and authorization models (role-based, attribute-based) then decide what it can reach.

Gap analysis

A gap analysis compares where the organization is today with where a framework or goal says it should be. The output is a list of missing controls, ranked so the team can plan budget and work. It is commonly done against a framework such as NIST CSF or ISO 27001 before an audit.

Zero trust

Zero trust removes implicit trust based on network location. Every request is authenticated, authorized, and evaluated against policy each time, using signals such as identity, device health, location, and time. A user on the office LAN gets no more trust than one on a coffee-shop network.

The policy engine makes the decision, the policy administrator turns it into action (for example issuing a session token), and the policy enforcement point is the gate in the data path that lets the session through or blocks it. Adaptive identity means the strength of authentication changes with risk: a login from a new country may trigger a step-up challenge.

Physical security and deception

Physical controls slow and expose intruders: bollards stop vehicles, access control vestibules (mantraps) stop tailgating by holding one person at a time, and lighting plus cameras make intruders visible. Sensors include infrared (heat and motion), pressure (weight on a floor or mat), microwave (motion through walls), and ultrasonic (sound reflection).

Deception technology lures attackers into fake assets so defenders learn about them. A honeypot is a single decoy system, a honeynet is a network of them, a honeyfile is a bait document whose access triggers an alert, and a honeytoken is fake data, such as a credential or database row, that should never be used. Any use is a high-confidence alert.

Key terms

Confidentiality

Keeping information from being disclosed to people or systems that aren't authorized to see it.

Integrity

Assurance that data has not been altered in an unauthorized or undetected way.

Availability

Making sure systems and data are accessible to authorized users when they need them.

Non-repudiation

Proof that a specific party performed an action, so they can't credibly deny it later.

Authentication, authorization, and accounting (AAA)

A framework that verifies identity, grants permitted actions, and records what was done.

Gap analysis

A comparison of the current security posture against a target framework to find missing controls.

Zero trust

An architecture that grants no implicit trust by network location and verifies every request against policy.

Policy engine

The zero trust component that evaluates signals and decides whether to grant, deny, or revoke access.

Policy enforcement point

The gate in the data path that allows, monitors, or ends a session as instructed by the control plane.

Adaptive identity

Authentication that changes its requirements based on real-time risk signals about the request.

Access control vestibule

A small space with two interlocking doors that admits one person at a time to stop tailgating.

Honeypot

A decoy system that looks valuable so attackers engage with it and reveal their methods.

Honeytoken

Fake data, such as a credential or record, that no legitimate process should ever use, so any use triggers an alert.

Bollards

Short, sturdy posts that keep vehicles away from buildings and entrances.