Unit 1: Summarize Fundamental Security Concepts, Compare Threat Types, Explain Cryptographic Solutions

Information security rests on protecting the value of data and systems against loss, exposure, and tampering. This unit builds from the governing goals of security, through the controls and adversaries that shape risk, to the cryptography that enforces confidentiality and trust.

• Core triad (CIA): Confidentiality (only authorised parties read data), Integrity (data is unaltered and authentic), Availability (data and services are reachable when needed).
• Supporting pillars: Authentication (prove identity), Authorisation (grant least-privilege access), Accounting/Auditing (log actions), plus Non-repudiation (sender cannot deny an action).
• Risk vocabulary: a vulnerability is a weakness, a threat is a potential cause of harm, an exploit is the technique used, and risk is the likelihood × impact of a threat meeting a vulnerability.
• Gap concept: the AAA framework (Authentication, Authorisation, Accounting) underpins access decisions referenced throughout.

II. Security Concepts

The foundational properties every control ultimately serves.

A. The CIA triad and its extensions

Security is measured against the triad plus authenticity and non-repudiation.

• Confidentiality: enforced by encryption and access control — e.g. encrypting a laptop disk so a thief reads only ciphertext.
• Integrity: enforced by hashing and digital signatures — a changed byte changes the SHA-256 digest.
• Availability: enforced by redundancy, backups, and anti-DoS measures — e.g. load balancing across two servers so one failure is survivable.
• Non-repudiation: a signed email cannot later be disowned because only the sender holds the private signing key.

B. Zero Trust and defence in depth

Assume breach; verify every request regardless of network location.

• Zero Trust: "never trust, always verify" — split into a Control Plane (policy decisions, adaptive identity) and a Data Plane (the enforcement point that permits or blocks traffic).
• Defence in depth: layered controls so one failure is not catastrophic — perimeter firewall, host hardening, and encryption stacked together.
• Gap application: the AAA model implements Zero Trust at the request level by re-authenticating and logging each access.

III. Security Controls

The mechanisms that reduce risk, classified by function and type.

A. Control categories (type)

Controls are grouped by how they are implemented.

• Technical: enforced by technology — firewalls, encryption, antivirus.
• Managerial: administrative/policy-based — risk assessments, security policies.
• Operational: executed by people — security guards, awareness training.
• Physical: tangible barriers — locks, fences, badge readers.

B. Control functions

Controls are also grouped by the role they play against a threat.

• Preventive: stop an incident — a locked door, an ACL denying access.
• Deterrent: discourage an attacker — warning signage, visible cameras.
• Detective: identify an incident in progress — IDS, audit logs.
• Corrective: remediate after the fact — restoring from backup.
• Compensating: an alternative when the primary control is infeasible — isolating a legacy server that cannot be patched.
• Directive: instruct behaviour — an acceptable-use policy.

IV. Threat Actors

The adversaries, distinguished by motivation, resources, and intent.

A. Actor types and attributes

Classify each actor by capability and sophistication.

• Nation-state: highest resources; conducts Advanced Persistent Threats (APTs) for espionage.
• Organised crime: financially motivated; runs ransomware and fraud.
• Hacktivist: ideological; defaces sites or leaks data to make a point.
• Insider threat: has legitimate access; may act maliciously or negligently.
• Script kiddie / unskilled attacker: low skill, uses pre-built tools.
• Shadow IT: unsanctioned internal systems that expand risk unintentionally.

B. Attributes and motivations

Profile actors to predict their behaviour.

• Attributes: internal vs external; resources/funding; sophistication.
• Motivations: financial gain, data exfiltration, espionage, service disruption, revenge, ideological belief, war.

V. Attack Surfaces

The sum of points where an attacker can attempt entry; the goal is minimisation.

A. Threat vectors and surfaces

Each exposed interface is a potential vector.

• Message-based: email, SMS, instant messaging carrying malicious links or attachments.
• Network/wireless: open ports, unsecured Wi-Fi, Bluetooth.
• Supply chain: compromise via vendors, MSPs, or hardware/software suppliers.
• Removable media and default credentials: USB drops, unchanged factory passwords.
• Reduction principle: disable unused services and close unused ports to shrink the surface.

VI. Social Engineering

Manipulating people, not machines, to bypass technical controls.

A. Principles of influence

Attackers exploit predictable psychological levers.

• Authority: impersonating a manager or IT to compel compliance.
• Urgency / Scarcity: "act now or lose access" pressures hasty decisions.
• Intimidation, Consensus (social proof), Familiarity, Trust: reduce the target's scepticism.

B. Common techniques

Recognise the delivery methods.

• Phishing: fraudulent email at scale; Spear phishing targets an individual; Whaling targets executives.
• Vishing / Smishing: phishing by voice call / SMS.
• Pretexting: inventing a scenario to extract information.
• Business Email Compromise (BEC): impersonating an executive to authorise a fraudulent transfer.
• Watering hole: compromising a site the target group routinely visits.

VII. Cryptographic Algorithms

The mathematical primitives providing confidentiality, integrity, and authenticity.

A. Symmetric vs asymmetric encryption

The two families differ in key handling.

1. Symmetric: one shared secret key encrypts and decrypts; fast, ideal for bulk data.
   • Examples: AES (128/192/256-bit), ChaCha20.
   • Weakness: secure key distribution is hard — n users need n(n−1)/2 keys.
2. Asymmetric: a mathematically linked public/private key pair; slow, ideal for key exchange and signatures.
   • Examples: RSA, ECC (Elliptic Curve — equal strength at smaller key size), Diffie-Hellman (key agreement only).
   • Rule: encrypt with the recipient's public key; only their private key decrypts.

B. Hashing and modes

Hashing proves integrity; it is one-way.

• Hash functions: map arbitrary input to a fixed digest — SHA-256, SHA-3; a single-bit change cascades through the output (avalanche effect).
• Salting: append a random value before hashing passwords to defeat rainbow tables.
• HMAC: keyed hash combining a secret with the message for integrity and authenticity.
• Block cipher modes / nonces: modes like GCM add authentication; a nonce/IV ensures identical plaintexts encrypt differently.

C. Hybrid encryption (worked example)

Real systems combine both families for speed and safety.

1. Alice generates a random symmetric session key K
2. Alice encrypts the large message with AES using K      (fast)
3. Alice encrypts K with Bob's RSA public key             (secure exchange)
4. Alice sends: AES_K(message) + RSA_pub(K)
5. Bob uses his private key to recover K, then decrypts the message

• Symbols: K = session key; AES_K = AES under K; RSA_pub = encryption under Bob's public key. This is how TLS protects web traffic.

VIII. Public Key Infrastructure

The framework binding public keys to verified identities through trusted authorities.

A. PKI components

Trust is anchored in a hierarchy of authorities.

• Certificate Authority (CA): issues and signs digital certificates vouching for identity.
• Registration Authority (RA): verifies identity before the CA issues a certificate.
• Digital certificate (X.509): binds a public key to a subject; contains the key, owner, issuer, validity dates, and the CA's signature.
• Root of trust: a self-signed Root CA signs Intermediate CAs, forming a chain the browser validates.

B. Certificate lifecycle and trust

Certificates must be issued, validated, and revoked.

• Issuance: subject generates a key pair and submits a Certificate Signing Request (CSR) with the public key.
• Validation: clients walk the chain to a trusted root; a broken chain is untrusted.
• Revocation: compromised certificates are listed on a CRL (Certificate Revocation List) or checked live via OCSP (Online Certificate Status Protocol).
• Key escrow: a copy of private keys held by a trusted third party for recovery.

IX. Cryptographic Solutions

Applying the primitives to real protection goals.

A. Encryption at rest, in transit, and in use

Match the technique to the data's state.

• At rest: full-disk (BitLocker), file, or database encryption protects stored data.
• In transit: TLS/IPSec protects data crossing networks.
• In use: emerging techniques (secure enclaves, homomorphic encryption) protect data during processing.

B. Digital signatures and certificates

Signatures provide integrity, authentication, and non-repudiation together.

• Signing: the sender hashes the message and encrypts the digest with their private key.
• Verification: the receiver decrypts the signature with the sender's public key and compares digests; a match proves origin and integrity.

C. Specialised tools and limitations

Hardware and design choices strengthen key handling, but limits remain.

• TPM: a chip storing keys on the device for secure boot and disk encryption.
• HSM: a hardened appliance generating and guarding keys for servers.
• Key stretching: PBKDF2/bcrypt slow brute-force on weak passwords.
• Limitations: weak key management defeats strong algorithms; quantum computing threatens RSA/ECC, driving post-quantum cryptography; encryption secures data but not a compromised endpoint holding the keys.