Information Security Fundamentals

Confidentiality, integrity, availability (CIA)

Confidentiality → encryption, access control. Integrity → hashing, signatures, change control. Availability → redundancy, backups, disaster recovery.

Threats

Phishing (spear, whaling) · business email compromise · ransomware · malware · denial of service · man-in-the-middle · injection · insiders · supply chain · zero-day.

Controls

• Preventive · detective · corrective; administrative · technical · physical.
• Defense in depth; zero trust ("never trust, always verify").

Access

• Multi-factor authentication (MFA) = different categories (know, have, are).
• Single sign-on (SSO) + MFA; role-based access; least privilege; privileged access management.

Cryptography

• Symmetric: one key, fast. Asymmetric: public encrypts, private decrypts.
• Hash: one-way, integrity. Digital signature: hash + sender's private key → non-repudiation.

Frameworks

National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0: Govern, Identify, Protect, Detect, Respond, Recover · International Organization for Standardization (ISO) 27001 · Center for Internet Security (CIS) Controls.

Exam traps

• A password plus a personal identification number (PIN) isn't MFA — both are "something you know".
• To keep a message confidential, encrypt with the recipient's public key; to sign it, use the sender's private key.
• Hashing isn't encryption — it can't be reversed to recover the original data.