Security, Privacy, and Troubleshooting
Fundamentals
The CIA triad - confidentiality, integrity, availability - frames most questions. Authentication proves identity; authorization decides what that identity may access; auditing records what happened. Baseline controls are least privilege, multi-factor authentication, a strong password policy, timely patching, and endpoint protection.
Threats and social engineering
Malware differs by propagation and payload: viruses attach to files, worms self-spread across networks, trojans masquerade as legitimate software, ransomware encrypts data and demands payment, spyware and keyloggers steal information. Social engineering targets people: phishing by email, vishing by voice, smishing by text, tailgating through physical doors, shoulder surfing in public spaces. Phishing is the most common scenario in exam questions.
Protecting data and privacy
Encryption protects data at rest and in transit; hashing verifies integrity and is used to store passwords, never reversible encryption alone. PII is any data that identifies a person - collect only what is needed, store it per policy, and never place it in personal email or unapproved cloud storage. Backups follow 3-2-1: three copies, on two media types, with one offsite.
Response and disposal
For suspected malware or a breach: disconnect the host from the network, avoid powering off if evidence matters, report per policy, and preserve logs. Wipe or physically destroy storage before disposal and factory-reset mobile devices.
Rule of thumb
Any scenario that begins with a user clicking a link or attachment starts with containment and reporting, not with replying to the sender or running a scan first. Worked example: ransomware is detected on a shared drive - isolate the affected host from the network, notify the security team, then restore from a known-good backup after containment is confirmed.