Skip to content

Fundamentals of Security

The fundamentals of cybersecurity are essential to understanding how to protect networks and systems. Security professionals need to balance technical defenses against both external threats and internal challenges, including user behavior, which often seeks to bypass security for convenience.

Key Concepts

  1. Security vs. Usability
    • There's an inherent conflict between security and usability. Users tend to prefer convenience, even if it weakens security, e.g., simplifying passwords.
    • Stronger security measures, while necessary, often reduce ease of use, leading users to find ways around them.
  2. Information Security vs. Information System Security
    • Information Security: Focuses on protecting data from unauthorized access, alteration, or destruction.
    • Information System Security: Focuses on securing the systems (e.g., computers, servers) that store and process data.

Core Security Objectives

The basics of security are organized around several essential principles, often represented as frameworks and models.

C.I.A. Triad

The C.I.A. Triad stands for:

  • Confidentiality: Ensures only authorized users can access data.
  • Integrity: Guarantees that data remains accurate and unaltered.
  • Availability: Ensures resources are accessible and functional when needed.

Extended C.I.A.N.A. Model

This newer model expands the triad to include:

  • Non-repudiation: Ensures actions/events cannot be denied (e.g., digital signatures).
  • Authentication: Verifies the identity of users or systems.

AAA Framework

The AAA framework includes: - Authentication: Confirms user identities. - Authorization: Grants permissions based on authentication. - Accounting: Tracks user activities for auditing and monitoring purposes.

Security Controls

Security controls are measures to mitigate risks. They are grouped as follows:

Categories

  • Technical: Mechanisms like encryption and firewalls.
  • Managerial: Policies and processes.
  • Operational: Day-to-day practices, like training.
  • Physical: Physical protections, like locks and CCTV.

Types

  • Preventative: Stop incidents before they happen.
  • Deterrent: Discourage potential threats.
  • Detective: Identify and alert on incidents.
  • Corrective: Reduce impact after an incident.
  • Compensating: Provide alternatives to standard controls.
  • Directive: Guide security behavior through policies.

Zero Trust Model

  • The Zero Trust model assumes that no one, inside or outside an organization, should be trusted by default.
  • Control Plane: Includes identity management, policy enforcement, and secured zones.
  • Data Plane: Focuses on policy engines, administrators, and enforcement points.

Key Objectives in Security Learning

  • Objective 1.1: Compare and contrast various types of security controls.
  • Objective 1.2: Summarize fundamental security concepts.