Information Security
CIA and classification
Information security protects confidentiality (only authorized disclosure), integrity (accuracy and completeness), and availability (access when needed). Classify data (for example public, internal, confidential, restricted) and let handling rules follow the label. Access is granted by least privilege and need to know. Access control models include discretionary (owner decides), mandatory (labels and clearances), role-based (job function), and attribute-based (context).
Technical basics
Authentication factors are something you know, have, or are; multi-factor combines categories. Encryption protects confidentiality in transit and at rest; hashing verifies integrity but is not encryption. Perimeter technologies such as firewalls, intrusion detection/prevention, and network segmentation reduce exposure but do not replace patching and configuration discipline. Log, monitor, and review; logs nobody reads are not a control.
Response and continuity
Incident response covers preparation, detection, containment, eradication, recovery, and lessons learned. Preserve evidence (image the machine) before wiping it. Data retention and privacy obligations (GDPR, state privacy laws) restrict what you collect and how long you keep it. Insider threat controls span both logical and physical access.
Traps
- Blaming "the firewall" for a failure that was really a process gap.
- Confusing availability with integrity in scenario questions.
- Deleting or rebuilding a compromised machine before imaging it.
- Granting broad access "temporarily."
Worked example
A shared HR folder: replace open access with role-based groups (HR staff, hiring managers), apply a confidential label, require MFA for remote access, log access to sensitive files, and review entitlements quarterly. The set maps directly to least privilege and verified need to know.