General Security Concepts
General Security Concepts
This domain tests whether you can describe security in the language of principles, guarantees, and control classifications rather than products. Expect items that ask you to name the property a mechanism provides, classify a control on two independent axes, or identify the design principle that a failure violated.
Confidentiality, integrity, availability - and the rest
- Confidentiality: only authorized parties read the data (encryption, access control, need-to-know).
- Integrity: data is unaltered and changes are attributable (hashing, MACs, digital signatures, versioning).
- Availability: timely access (redundancy, backups, DDoS mitigation, capacity planning).
- Non-repudiation: a party cannot credibly deny an action - digital signatures tied to private-key possession, signed audit logs.
- AAA: authentication (who you are), authorization (what you may do), accounting (what you did) are three separate functions and three separate failure points.
Classifying controls on two axes
- Category: technical (firewall, EDR), managerial (policy, risk assessment), operational (guard force, awareness training), physical (bollard, lock, mantraps).
- Function: preventive, deterrent, detective, corrective, compensating, directive. A single control holds one position on each axis. A badge reader is technical + preventive; CCTV is physical + detective, and often deterrent as a side effect; log review that triggers a rollback is detective + corrective.
Principles to memorize verbatim
Least privilege, separation of duties, defense in depth, fail-safe defaults, complete mediation, economy of mechanism, zero trust (verify explicitly, never trust implicitly, assume breach). Data exists in three states - at rest, in transit, in use - and each state needs its own protection, because disk encryption does nothing for a compromised running process.
Worked example
After an insider fraud, an organization requires a second approver before wire transfers release. The principle is separation of duties: no single identity can both initiate and release. The addition is preventive, and managerial if enforced by policy with a technical workflow. If the question instead described reviewing transfer logs to detect unusual approvals after the fact, the function shifts to detective - same business process, different control category.
Traps that cost marks
Encryption alone does not provide integrity; without an AEAD mode or a MAC, ciphertext can be malleable. Hashing is not encryption and is not reversible - it proves integrity, not confidentiality. Encoding and obfuscation provide no confidentiality at all. "Compensating" is not a synonym for "corrective": a compensating control substitutes for a control you cannot apply, while a corrective control restores service after an event.