Security Fundamentals and Threat Concepts
Vocabulary
The CIA triad - confidentiality, integrity, availability - anchors most questions; add authentication, authorization, accounting (AAA) and non-repudiation. A vulnerability is a weakness; a threat is a potential actor or event; risk combines likelihood and impact. Threat actors range from script kiddies and insiders to organized crime, hacktivists, and nation-states.
Attack families
Social engineering targets people: phishing, spear phishing, whaling, vishing, pretexting, tailgating, watering-hole sites. Malware: virus (needs a host file), worm (self-propagating), trojan (disguised as legitimate), ransomware, rootkit, keylogger, logic bomb, botnet. Network and application attacks: MITM, DoS/DDoS, spoofing, ARP poisoning, SQL injection, XSS, password spraying.
Controls
Administrative (policy, training), technical (firewalls, IDS/IPS, EDR, MFA, encryption), and physical controls. Principles: least privilege, separation of duties, defense in depth, zero trust, patch management, hardening, DMZ and segmentation. An IDS detects and alerts passively; an IPS sits inline and blocks. A honeypot is deception, not prevention.
Incident response
Preparation → detection/identification → containment → eradication → recovery → lessons learned. Order matters: contain before you eradicate so the adversary cannot simply re-enter.
Traps
Swapping IDS and IPS; claiming antivirus is signature-only when heuristic/behavioral detection exists; confusing vulnerability scanning (finds weaknesses) with penetration testing (proves exploitability).
Worked example
Risk = likelihood × impact. A critical flaw on an isolated host that is unreachable from any network may rank below a medium flaw exposed directly to the internet and actively exploited.