Security
Security tests whether you can identify threats, choose controls, and explain why a control fits. Expect questions on the CIA triad, authentication, malware, encryption, network defense, and incident response.
Core rules
- Confidentiality limits disclosure; integrity prevents unauthorized changes; availability keeps systems usable. A threat exploits a vulnerability; risk combines likelihood and impact.
- Authentication proves identity through knowledge, possession, or inherence. Multifactor authentication combines different factor types. Authorization decides what an authenticated principal may do.
- Malware categories: a virus needs a host file and usually user action; a worm self-propagates across networks; a Trojan disguises itself as useful; ransomware encrypts data for extortion; spyware collects activity.
- Social engineering targets people: phishing, spear phishing, pretexting, and baiting. Verify unusual requests through a separate known channel.
- Symmetric encryption uses one shared key and is fast. Asymmetric encryption uses a public/private key pair and helps with key exchange and signatures. TLS combines both.
- Hashing is one-way and supports integrity checks. A digital signature encrypts a hash with the sender's private key, so receivers verify origin and integrity.
- Controls: firewalls filter traffic by rules; IDS detects suspicious activity; IPS can block it; VPNs encrypt traffic over untrusted networks; patching removes known vulnerabilities; least privilege limits damage.
- Backups follow 3-2-1: three copies, two media types, one offsite. Test restores, because an untested backup is unproven.
Worked example
An employee receives an email claiming to be from IT and asking them to confirm their password through a link. The request uses urgency and a familiar brand. Reasoning: legitimate IT staff do not ask for passwords; the link may lead to a credential-harvesting page. The safe response is not to click, to verify by calling the help desk using a known number, and to report the message. MFA reduces the damage if credentials are stolen, but it does not make phishing harmless.
Traps
- Confusing authentication with authorization.
- Treating encryption and hashing as interchangeable; hashing is not reversible.
- Believing a firewall removes malware from an email attachment.
- Assuming HTTPS means a site is trustworthy.
- Calling a backup successful without a restore test.