Information Security
Information Security tests the CIA triad, authentication, malware, network defence, cryptography and security policies. Questions often ask which control addresses which risk.
Core rules
- CIA: confidentiality means secrecy; integrity means unaltered; availability means accessible. Non-repudiation prevents denial of an action.
- Authentication factors: something you know such as a password, something you have such as a token or OTP, something you are such as a biometric. MFA combines different factor types.
- Symmetric encryption uses one shared key, for example AES; asymmetric encryption uses a public/private key pair, for example RSA; hashing is one-way, for example SHA-256, and checks integrity rather than providing encryption.
- A digital signature signs with the sender's private key and verifies with the sender's public key; it provides integrity, authentication and non-repudiation.
- A firewall filters traffic by rules; IDS detects and logs; IPS can block; antivirus uses signatures and heuristics; phishing is social engineering.
Worked example
A file is hashed before and after transfer. The original SHA-256 is a1... and the received hash is b2.... They differ, so integrity failed. Reasoning: a secure hash changes drastically with any input change; encryption alone would not prove integrity unless combined with a hash or MAC.
Traps
Hashing is not reversible encryption. Public-key encryption protects data for the recipient, whose private key decrypts it. HTTPS uses asymmetric key exchange plus symmetric session encryption. A firewall does not remove malware already on a host.