Security, Confidentiality, and Privacy
Core model
Everything hangs on the CIA triad: confidentiality, integrity, availability. Confidentiality is delivered through data classification, least privilege, need to know, and encryption. Access models: DAC (owner grants), MAC (labels and clearances), RBAC (roles), with periodic access recertification and removal of terminated users as classic control tests. Authentication relies on something you know, have, or are; MFA combines factors of different types. Logging, monitoring, and privileged access management address insider and administrator risk.
Cryptography
Symmetric encryption (AES) is fast and used for bulk data but has key-distribution problems; asymmetric encryption (RSA) is slow and used for key exchange and signatures - practical systems are hybrid (as in TLS). A hash is one-way and fixed-length and provides integrity only. A digital signature (hash plus sender's private key) provides integrity, authentication of origin, and nonrepudiation. Traps: signing with the private key but encrypting a confidential message with the recipient's public key; confusing hashing with encryption.
Network and threats
Firewalls filter traffic; the DMZ hosts externally facing services; an IDS detects and alerts, an IPS blocks. Threats include phishing, ransomware, social engineering, and insider misuse. Incident response: prepare, detect, contain, eradicate, recover, lessons learned.
Privacy
Know PII/PHI, and the shape of GDPR (lawful basis, data subject rights, 72-hour breach notification), CCPA/CPRA, HIPAA, and state breach laws. Privacy requires purpose limitation, retention limits, secure disposal, and tools like masking and pseudonymization.
Rule of thumb: if the question says "prevent a later denial of sending," choose digital signature; if it says "protect data at rest," choose encryption.