Fundamental concepts

This is a massive and incredibly important objective. These are the core architectural philosophies and tactical tools that dictate how modern security is designed.

Let’s break these down section by section with clear, practical examples.

1. The Core Pillars: CIA & Non-Repudiation

These represent the fundamental goals of all information security programs.

Confidentiality, Integrity, and Availability (CIA Triad)

• Confidentiality: Ensuring that data is only viewed by authorized users.
  • Example: Using AES-256 encryption on a database server so that even if an attacker steals the hard drives, they cannot read the files.
• Integrity: Ensuring that data has not been altered, tampered with, or corrupted.
  • Example: Using a hashing algorithm (like SHA-256) to verify that a downloaded software update hasn’t been modified by a malicious third party.
• Availability: Ensuring that systems and data are accessible to authorized users when needed.
  • Example: Implementing load balancers and redundant power supplies so that if one server or power grid goes down, the application stays online.

Non-repudiation

Non-repudiation means a user cannot deny having performed a specific action (such as sending a message or making a transaction) because there is undeniable proof they did so.

• Example: When you digitally sign a legal document using your private key (like with a smart card or DocuSign), your unique cryptographic signature proves you signed it, and you cannot later claim, “That wasn’t me.”

2. AAA (Authentication, Authorization, and Accounting)

AAA is the framework for managing identity and access control.

Authentication (Who are you?)

Proving an identity. This is broken down by what is being authenticated:

• Authenticating People: Validating a human user. This uses factors like something you know (password), something you have (hardware token), or something you are (fingerprint).
• Authenticating Systems: Validating that a device or server is legitimate before letting it join a network.
  • Example: Using 802.1X certificates where a computer must present a digital certificate to a network switch to get an IP address, preventing random laptops from plugging into an office wall jack.

Authorization Models (What are you allowed to do?)

Once authenticated, what permissions do you have? Security+ focuses on distinct models:

• Role-Based Access Control (RBAC): Permissions are tied to a job role, not an individual. (e.g., Every user in the “Network Admin” group automatically gets access to the OPNsense firewall).
• Attribute-Based Access Control (ABAC): Permissions are granted based on context and attributes (e.g., “Allow access only if the user is in the HR department, and it is between 8 AM and 5 PM, and they are connecting from an internal IP”).
• Discretionary Access Control (DAC): The file owner decides who has access. (e.g., you create a folder on your desktop and choose to share it with a coworker).
• Mandatory Access Control (MAC): The system enforces access based on security clearances and data labels (e.g., Secret, Top Secret). Users cannot change permissions.

Accounting (What did you do?)

Tracking and logging user behavior for auditing purposes.

• Example: An administrator reviews syslog records to see exactly which user account modified a firewall rule at 2:00 AM.

3. Gap Analysis

A gap analysis is a high-level comparison between your current security posture and your desired target state (usually dictated by a framework such as NIST or ISO 24001).

• Example: Your target state is to have MFA on all systems. Your analysis shows that 15 legacy servers don’t have it. The “gap” is those 15 servers, and the analysis outputs a plan to remediate them.

4. Zero Trust Architecture (ZTA)

The fundamental philosophy of Zero Trust is: “Never trust, always verify.” Old security relied on a perimeter (trust everything inside the office network). Zero Trust treats the office network like a public coffee shop.

Zero Trust splits its operations into two distinct planes: the Control Plane (the brains/decision-makers) and the Data Plane (the muscle/where data moves).

The Control Plane

This plane makes the policy decisions and decides who gets access.

• Adaptive Identity: Validating identity continuously, not just at login. It looks at changing risk factors (e.g., if you suddenly log in from Arizona and then 10 minutes later from London, the system flags the “impossible travel” and re-authenticates you).
• Threat Scope Reduction: Intentionally minimizing what an attacker could potentially see or exploit if they compromised a single account or system (microsegmentation).
• Policy-Driven Access Control: Dynamic rules that dictate access based on corporate policy.
• Policy Engine (PE): The core brain. It evaluates the request against security policies and decides whether to Grant, Deny, or Challenge it.
• Policy Administrator (PA): The executioner of the engine’s decision. It issues the command to establish or sever the connection between the user and the resource.

The Data Plane

This plane handles the actual traffic and data movement based on the Control Plane’s commands.

• Implicit Trust Zones: The strict boundary containing the resource. Absolutely nothing is trusted until it passes security checks.
• Subject/System: The user or device requesting access to a resource.
• Policy Enforcement Point (PEP): The gatekeeper on the ground. This is a device (such as a firewall, API gateway, or reverse proxy) that physically allows or blocks traffic based on instructions from the Policy Administrator.

5. Physical Security Controls

Protecting the physical perimeter to prevent attackers from gaining direct access to hardware.

• Bollards: Short, sturdy vertical posts designed to stop a vehicle from crashing through a building’s entrance.
• Access Control Vestibule (formerly called a Mantrap): A two-door entry system. Door A opens, the user steps into a small room, and Door A closes. Door B will not open until identity is verified via a guard or badge reader, preventing “tailgating” (someone slipping in behind an authorized user).
• Fencing: Defines boundaries and deters casual intruders. (Note: High barbed-wire fences provide added protection).
• Video Surveillance (CCTV): A detective control for monitoring areas and reviewing incidents, as well as a deterrent when highly visible.
• Security Guard: A dynamic control that can act as a deterrent, preventive measure, or detective control by physically stopping intruders and monitoring systems.
• Access Badge: Keycards (RFID/Prox cards) used to unlock physical electronic doors.
• Lighting: A deterrent control. Illuminating dark corners eliminates hiding spots for intruders and ensures CCTV cameras get clear footage.
• Sensors: Used to detect unauthorized movement or environmental changes:
  • Infrared: Detects changes in heat signatures (body heat).
  • Pressure: Mats placed under carpets that trigger an alarm when stepped on.
  • Microwave & Ultrasonic: Sensors that bounce waves off a room to detect subtle movement or structural changes in the environment.

6. Deception & Disruption Technology

These are proactive defense measures designed to waste an attacker’s time, track their methods, and alert defenders early.

• Honeypot: A single fake server or device exposed on the network designed to look vulnerable (e.g., a fake database server with no real data). Legitimate users have no reason to access it, so any traffic to it triggers an immediate high-priority alert.
• Honeynet: A network of multiple honeypots linked together to simulate a larger corporate network, allowing defenders to watch how an attacker moves laterally.
• Honeyfile: A fake file planted on a legitimate file share (e.g., passwords.txt or Q4_Layoff_Plan.xlsx). If anyone opens or copies it, an alert goes off instantly.
• Honeytoken: A piece of digital data embedded in a file or database (such as a fake credit card number or a fake API key). If an attacker steals data and tries to use that API key on the internet, the defender gets a notification showing exactly where the attacker is connecting from.