1Essential Security Principles

• 1.1Foundations of security principles

  Building on the distinction among a weakness (vulnerability), a danger that could exploit it (threat), the means of abuse (exploit), and the probability-times-impact measure (risk), this section covers the attack vector as an entry point, hardening that shrinks the attack surface, layered defense in depth, the three properties to protect (CIA), and the types of attackers and code of ethics, as the foundation for telling "is this a threat or a risk."

• 1.2Common threats and vulnerabilities

  Covers the kinds of malware including ransom-demanding ransomware, service-halting DoS and the zombie army of a botnet, the human-deceiving social engineering family (phishing/spear phishing/vishing/smishing/tailgating), the traffic-intercepting man-in-the-middle attack, and IoT weaknesses, insider threats, and the advanced persistent APT, as the foundation for telling "what attack this email or symptom is."

• 1.3Principles of access management

  Covers the three pillars of AAA—who you are (authentication), what you may do (authorization), and what you did (accounting)—the centralized authentication of RADIUS, strengthening identity with multi-factor authentication (MFA) across knowledge/possession/inherence, and the password policy that resists guessing and reuse, as the foundation for judging "is this access legitimate."

• 1.4Encryption methods and their application

  Covers the difference between fast same-key symmetric encryption and key-distribution-solving asymmetric encryption, the one-way hash that protects integrity rather than encrypts, the certificate and PKI that assure a public key's authenticity, strong vs. weak algorithms, and protecting data by its state—in transit / at rest / in use—as the foundation for choosing "which encryption for which data state."