Security Fundamentals
Security Fundamentals tests confidentiality, integrity, and availability through identity, least privilege, cryptography, network controls, patching, and incident response. Questions often ask for the control that reduces risk without breaking operations.
Identity, authorization, and secrets
Authentication proves identity; authorization decides actions. Use MFA for interactive accounts, unique service accounts, and role-based access control. Grant the minimum permissions and review them. sudo should be limited by policy. Secrets such as API keys belong in a secret manager or protected environment, never in Git or world-readable files.
Cryptography and network defense
Symmetric encryption is fast for bulk data; asymmetric encryption supports key exchange and signatures. Hashing verifies integrity but is not encryption. TLS protects data in transit and uses certificates to authenticate endpoints. Firewalls restrict ports and source ranges; patch known vulnerabilities; disable unused services. Log and monitor authentication failures and privilege changes.
Worked example
An internet-facing SSH server allows root login with passwords and shows repeated failed logins. The fix is not merely a longer password. Set PermitRootLogin no and PasswordAuthentication no in sshd_config, install public keys for named admins, restart SSH, and restrict port 22 to an administrative network or VPN. Add MFA at the gateway if available. This removes the password-guessing path, removes direct root access, and reduces exposure. Verify with a second session before closing the first to avoid lockout.
Traps
chmod 777 is not a security fix. Hashing is not reversible encryption. Hiding an admin URL is not access control. Secrets in environment variables can still leak through logs or process dumps. Disabling SELinux or the firewall to “make it work” removes defense.