Information Security Fundamentals

Why this topic matters

Security, Confidentiality, and Privacy is Area II of Information Systems and Controls (ISC), 35–45% of the section. It tests the goals of information security, common threats, the layers of controls that defend against them, identity and access management, encryption, and the major cybersecurity frameworks.

Goals — confidentiality, integrity, and availability (CIA)

Goal	Meaning	Example controls
Confidentiality	Information is disclosed only to authorized parties	Encryption, access controls, data classification
Integrity	Information is accurate, complete, and changed only in authorized ways	Hashing, digital signatures, change management, input validation
Availability	Systems and data are accessible when needed	Redundancy, backups, distributed denial-of-service protection, disaster recovery

Together these form the "CIA triad", the standard way to frame security objectives. Related concepts: authentication (proving identity), authorization (what you may do), and non-repudiation (a party can't deny an action — achieved with digital signatures and logs).

Threats and attacks

Threat	Description
Phishing (spear phishing, whaling)	Deceptive messages to steal credentials or deliver malware; spear phishing targets specific people, whaling targets executives
Business email compromise	Impersonating executives or vendors to redirect payments — a leading cause of financial loss
Social engineering	Manipulating people (pretexting, tailgating, baiting)
Ransomware	Encrypts or steals data and demands payment
Malware — viruses, worms, trojans, spyware, keyloggers	Malicious software; worms self-replicate across networks; trojans hide inside legitimate-looking programs
Denial of service (DoS) and distributed denial of service (DDoS)	Overwhelming systems to make them unavailable
Man-in-the-middle	Intercepting communications between two parties
Structured query language (SQL) injection and cross-site scripting	Inserting malicious code through application inputs
Credential stuffing and brute force	Automated password guessing or reuse of stolen passwords
Insider threats	Malicious or careless employees and contractors
Advanced persistent threats	Well-resourced attackers maintaining long-term hidden access
Supply chain attacks	Compromising a vendor or software update to reach its customers
Zero-day exploits	Attacks on vulnerabilities unknown to the vendor (no patch yet)

Types of controls

By function	By nature
Preventive — stop incidents (firewalls, multi-factor authentication, encryption)	Administrative — policies, training, background checks
Detective — identify incidents (logs, intrusion detection, reviews)	Technical (logical) — software and hardware controls
Corrective — limit damage and restore (backups, incident response, patching)	Physical — locks, badges, cameras, guards

Defense in depth layers multiple controls so one failure doesn't expose the organization. Zero trust assumes no user or device is trusted by default — every request is verified ("never trust, always verify"), with least privilege and micro-segmentation.

Identity and access management

• Authentication factors: something you know (password), something you have (token, phone), something you are (biometrics). Multi-factor authentication (MFA) combines two or more different categories — a password plus a security question is still single-factor.
• Single sign-on (SSO) lets users authenticate once for many systems — convenient, but it concentrates risk, so pair it with MFA.
• Role-based access control assigns permissions to roles, not individuals; least privilege grants only what's needed; privileged access management controls and monitors administrator accounts.
• Provision and deprovision access promptly; review access periodically.

Encryption and related tools

Technique	How it works	Use
Symmetric encryption	One shared secret key encrypts and decrypts (for example, the Advanced Encryption Standard (AES))	Fast — bulk data at rest and in transit
Asymmetric (public key) encryption	A key pair: data encrypted with the recipient's public key can be decrypted only with their private key	Key exchange, secure email
Hashing	A one-way function producing a fixed-length digest; any change to the data changes the hash	Integrity checks, password storage (with salting)
Digital signature	The sender encrypts a hash of the message with their private key; anyone verifies with the sender's public key	Authenticity, integrity, non-repudiation
Digital certificates and public key infrastructure	A certificate authority vouches that a public key belongs to an entity	Websites (Transport Layer Security (TLS) — the padlock), code signing

Encrypt data at rest (databases, laptops, backups) and in transit (TLS, virtual private networks); protect and rotate keys.

Network and endpoint security

• Firewalls filter traffic by rules; next-generation firewalls inspect applications and content.
• Intrusion detection systems alert on suspicious activity; intrusion prevention systems also block it.
• Network segmentation and a demilitarized zone (DMZ) isolate public-facing servers from internal networks.
• Endpoint protection — antivirus and endpoint detection and response tools, device encryption, and mobile device management.
• Patch and vulnerability management — scan regularly, prioritize by severity, patch promptly. Penetration testing simulates attacks to find weaknesses.
• Logging and monitoring — centralized security information and event management (SIEM) systems correlate logs and raise alerts.
• Security awareness training and phishing simulations reduce human risk.

Cybersecurity frameworks

• National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 — six functions: Govern (added in 2.0), Identify, Protect, Detect, Respond, Recover.
• International Organization for Standardization (ISO) standard 27001 — requirements for an information security management system (certifiable).
• Center for Internet Security (CIS) Critical Security Controls — a prioritized set of safeguards.
• NIST Special Publication 800-53 — a detailed control catalog.

How it is tested

• Match a control to the CIA goal it supports, or to preventive, detective, or corrective.
• Identify an attack type from a scenario.
• Distinguish symmetric and asymmetric encryption, hashing, and digital signatures.
• Map activities to NIST Cybersecurity Framework functions.