Security Fundamentals and Concepts
This domain tests the vocabulary and mental models CJCA candidates use to reason about security decisions: the CIA triad, risk, controls, and trust boundaries. Expect questions that ask you to classify a control or identify which security property a measure protects.
Core rules
- Confidentiality protects data from unauthorized disclosure (encryption, access control). Integrity protects data from unauthorized modification (hashing, digital signatures). Availability ensures timely access (redundancy, backups, DDoS mitigation).
- AAA separates authentication (who you are), authorization (what you may do), and accounting (what you did).
- Risk combines threat, vulnerability, likelihood, and impact. A vulnerability alone is not a risk until a threat can exploit it.
- Controls are preventive (stop), detective (notice), corrective (recover), or compensating (alternative). They can be administrative, technical, or physical.
- Least privilege, separation of duties, defense in depth, and zero trust reduce blast radius.
Worked example
A hospital encrypts patient records at rest and writes an audit log entry for every record read. Encryption is a preventive technical control for confidentiality. The audit log is a detective control supporting accountability; it does not prevent modification. If the hospital also stores a SHA-256 hash of each record and verifies it nightly, that hash supports integrity, not confidentiality. Calling the audit log an integrity control would be wrong unless it is tamper-evident and used to detect changes.
Traps
Do not confuse authentication with authorization. A firewall is preventive, not detective. Hashing is not encryption and does not provide confidentiality. Compliance with a framework does not prove security. Availability failures are security failures even when no attacker is present.