Security
Core ideas
Confidentiality, integrity, and availability form the CIA triad. Authentication proves identity; authorization decides access; auditing records actions. MFA combines something you know, have, or are. Least privilege limits the blast radius of a compromise.
Threats
Phishing and spear-phishing, malware (virus, worm, trojan, ransomware), social engineering, credential stuffing, and unpatched software. Encryption protects data in transit (TLS/HTTPS) and at rest (BitLocker, FileVault). Hashing is one-way and used for integrity and password storage; it is not encryption and cannot be reversed.
Defense in depth
Patching, endpoint protection, firewalls, strong unique passwords or a password manager, MFA, backups, user training, and physical security.
Traps
- 'HTTPS means the site is safe' only means the connection is encrypted.
- Assuming antivirus catches everything.
- Reusing passwords across sites.
- Clicking 'verify your account' links in email.
- Confusing hashing with encryption.
- Thinking a firewall stops phishing email.
Worked example
A user forwards an email asking them to 'confirm payroll details' from a lookalike domain. Do not click or reply; report it to security, check the sender's actual domain, and verify through a known phone number. If credentials were entered, reset the password and revoke active sessions immediately.