Essential Security Principles: CIA, AAA, Least Privilege, and Control Types
Start with the goal
Most questions in this domain ask you to classify something - a control, a principle, a crypto tool - rather than to compute anything. So anchor every scenario to what is being protected or proven.
CIA triad. Confidentiality = no unauthorized disclosure (encryption, access control, need-to-know). Integrity = data is unaltered and trustworthy (hashing, digital signatures, file integrity monitoring). Availability = data and services are reachable (redundancy, backups, DDoS protection, UPS).
AAA and identity. Authentication proves who you are; authorization decides what you may do; accounting records what you did. Authentication factors fall into categories: something you know, something you have, something you are, plus location and behavior. MFA requires factors from different categories - password plus PIN is still one category. Non-repudiation (digital signatures) means a party cannot later deny an action.
Supporting principles. Least privilege (only the access needed, only as long as needed), separation of duties, defense in depth (layered controls so one failure is not fatal), and zero trust (verify explicitly, assume breach) instead of trusting anything merely because it sits inside the network.
Control types. Preventive (firewall, lock), detective (IDS, SIEM alert, audit log review), corrective (restore from backup), deterrent (banner, guard), compensating (a substitute when the ideal control is infeasible). One control can play two roles - a camera both deters and detects.
Crypto traps. Hashing is one-way (integrity, password storage); encryption is reversible (confidentiality); encoding is not security at all. Symmetric crypto (AES) is fast but needs a shared key; asymmetric crypto (RSA/ECC) solves key exchange and signatures. A salt defeats precomputed rainbow tables but does not make a weak password strong.
Rule of thumb
Ask what is being proven or protected: secrecy → confidentiality; trustworthiness → integrity; uptime → availability; 'can't deny it' → non-repudiation; 'only what's needed' → least privilege.