The CIA triad
- Confidentiality — only authorized parties can read the data
- Integrity — data is accurate and hasn't been improperly altered
- Availability — systems and data are accessible when needed
Authentication factors
| Factor | Examples |
|---|---|
| Something you know | Password, PIN |
| Something you have | Token, smart card, phone app |
| Something you are | Fingerprint, facial recognition |
Multi-factor authentication requires factors from different categories. A password plus a security question is not MFA — both are "something you know."
Encryption
| Symmetric | Asymmetric (public key) | |
|---|---|---|
| Keys | One shared key for encrypt and decrypt | Public key encrypts; private key decrypts |
| Speed | Fast — good for bulk data | Slower — good for key exchange and signatures |
| Challenge | Distributing the key securely | Managing certificates and trust (PKI) |
IMPORTANT — digital signatures: The sender signs with their private key; anyone can verify with the sender's public key. This proves authenticity and non-repudiation. To send a confidential message, you encrypt with the recipient's public key so only their private key can open it. Getting these two directions straight is a favorite exam point.
Common attacks
- Phishing / spear phishing — deceptive messages harvesting credentials; the leading initial attack vector
- Ransomware — encrypts data and demands payment; defended primarily by tested offline backups
- SQL injection — malicious input to a database query; prevented by input validation and parameterized queries
- Denial of service — overwhelms availability
- Social engineering — manipulating people rather than technology
- Privilege escalation — turning limited access into administrative control
EXAM TIP: Apply least privilege (only the access needed for the role) and defense in depth (layered controls so no single failure is fatal). These two principles answer a surprising number of ISC questions.