Security Fundamentals
Security Fundamentals tests whether you can reason about confidentiality, integrity, and availability, and apply controls such as least privilege, authentication, authorization, encryption, and secure network design.
Core model
Confidentiality prevents unauthorized disclosure; integrity prevents unauthorized modification; availability keeps systems usable. A threat is a potential cause of harm, a vulnerability is a weakness, and risk combines likelihood and impact. Least privilege grants only the access needed for a task, for only as long as needed.
Identity and cryptography
Authentication proves who you are; authorization decides what you may do. Multi-factor authentication combines factors from different categories: something you know, have, or are. Hashing is one-way and is used for integrity and password storage; encryption is reversible with a key and is used for confidentiality. Passwords should be salted and hashed with a slow algorithm, never encrypted for storage. TLS protects data in transit; disk or bucket encryption protects data at rest.
Network controls
Security groups and firewalls filter traffic by port, protocol, and source. 0.0.0.0/0 means any IPv4 source, so exposing SSH or a database to it is a finding, not a convenience.
Worked example: an application stores user passwords. The correct design stores a salted hash using a password-hashing function such as bcrypt or Argon2. Encrypting the passwords is wrong because the application would need the decryption key, and a stolen key exposes every password; hashing makes verification possible without retaining the original secret.
Traps: confusing authentication with authorization; confusing hashing with encryption; thinking MFA is two passwords; and treating a vulnerability scan as proof of compromise. A scan finds weaknesses; it does not show that exploitation occurred.