Security Fundamentals — Core Concepts
The five ideas every other security conversation quietly assumes — confidentiality, integrity and availability; who you are versus what you may do; the difference between a vulnerability, a threat and a risk; giving out only the access that is needed; and stacking controls so no single failure is fatal.
1The CIA TriadConfidentiality, integrity, and availability are the three plain questions behind most security decisions.Core Concepts
2Authentication vs AuthorizationAuthentication asks who you are; authorization asks what you may do after the system knows enough to decide.Core Concepts
3Vulnerability, Threat and RiskA practical guide to the three basic ideas behind security decisions: what is weak, what can act on it, and what loss might follow.Core Concepts
4Least PrivilegeLeast privilege limits access to what a person, service, or device needs now, reducing damage when mistakes or attacks happen.Core Concepts
5Defense in DepthDefense in depth is the practice of using overlapping safeguards so one mistake, exploit, or outage does not become a disaster.Core Concepts