Security Concepts and Fundamentals
Core ideas
Security rests on the CIA triad: confidentiality (only authorized parties read data), integrity (data is accurate and unaltered), and availability (systems are usable when needed). Extend it with authenticity, non-repudiation, and accountability. Know the difference between a threat (potential cause of harm), a vulnerability (a weakness), a risk (likelihood × impact), and an exploit (a technique that leverages a vulnerability). Controls are preventive, detective, or corrective, and can be technical, administrative, or physical.
Concepts to master
Defense in depth, least privilege, separation of duties, fail-safe vs. fail-secure defaults, and the security lifecycle. Understand threat modeling (identify assets, enumerate threats, rate risk, choose mitigations) and the attack surface concept.
Traps
Questions often blur threat with vulnerability, or risk with impact. A firewall blocking traffic is preventive; a log that records the block is detective. "Fail-secure" protects assets (locks deny access); "fail-safe" protects people (doors open on power loss). Read the scenario's priority before choosing.
Worked example
A badge reader loses power and the door unlocks. Is this fail-safe or fail-secure? Because human safety is prioritized over asset protection, it is fail-safe. If the door instead stayed locked, that would be fail-secure.
Rule of thumb: classify every control by when it acts (before/during/after) and how (technical/admin/physical) before answering.