Information Security Fundamentals
This domain tests the vocabulary and mechanics used everywhere else: the CIA triad, authentication and authorization models, cryptographic primitives, and how trust is placed across a network. Expect to be asked what a given control protects, or which property a specific mechanism provides.
Core properties and access control
- Confidentiality (disclosure), integrity (alteration), availability (access when needed). Weighing them is a business decision, not a technical one.
- Identification → authentication → authorization → accountability. Authentication proves identity; authorization decides permitted actions; audit trails make actions attributable.
- Factors: something you know, have, or are, plus contextual signals such as location and behaviour. MFA requires factors from different categories.
- Models: DAC (owner grants access), MAC (labels and clearances; Bell-LaPadula for confidentiality, Biba for integrity), RBAC (access via role, strong joiner-mover-leaver hygiene), ABAC (attributes and policy, suited to fine-grained, context-aware rules). Layer least privilege with separation of duties.
Cryptographic primitives
- Symmetric (AES) is fast and used for bulk data; the key distribution problem is solved by asymmetric exchange (RSA, ECDH) or a KMS.
- Hashing (SHA-256, SHA-3) gives a fixed-length one-way, collision-resistant digest; used for integrity and password storage with salt and a slow KDF such as Argon2.
- A digital signature is a hash of the message encrypted with the sender's private key; the verifier recomputes the hash and decrypts with the sender's public key. It provides integrity, authenticity and non-repudiation - not confidentiality.
- PKI binds keys to identities through certificates issued by a CA; revocation uses CRL or OCSP.
Architecture
Defense in depth layers preventive, detective and corrective controls. Segmentation and DMZs limit lateral movement; zero trust replaces "trusted internal network" with per-request verification. Hardening baselines, patch cadence and centralized logging feed detection.
Worked example
A supplier must send a signed price file that only your finance team may read. Encrypt the file with a symmetric key, encrypt that key with the recipient's public key (envelope encryption) for confidentiality, and sign the plaintext hash with the supplier's private key for integrity and non-repudiation. Signing alone leaves plaintext readable - a common wrong answer.
Traps
- Saying a digital signature provides confidentiality.
- Confusing authentication (who) with authorization (what).
- Treating encryption as integrity protection; ciphertext can be altered undetected unless authenticated (AES-GCM).
- Reading "MAC" as mandatory access control when the context means message authentication code.