6.2Fundamental security concepts

Security talk feels intimidating for its many terms, but at its root is a simple question: "what to protect, from whom, and how." The measuring stick for what to protect is CIA (confidentiality, integrity, availability), and the mechanism to verify users, grant rights, and record activity is AAA (authentication, authorization, accounting). On top of these two foundations, this section ties together MFA that strengthens identity checks, encryption and certificates that protect data in transit and at rest, password complexity, Active Directory that centralizes identities, and common threats such as phishing, malware, and DoS—through the lens of "which part of CIA each control protects."

6.2.1CIA and AAA

• CIA is the three properties to protect: Confidentiality (only authorized people can view—preventing leaks), Integrity (content stays unaltered and correct), and Availability (usable when needed). Every security control exists to protect one of these three.
• AAA is the three steps for handling users: Authentication (verify who they are, e.g., a password or MFA), Authorization (decide what the verified party is allowed—access rights), and Accounting (record who did what—logs).
• The two work as a pair: verifying users and limiting rights with AAA ends up protecting CIA's confidentiality and integrity. Note that "authentication (verifying identity)" and "authorization (granting rights)" differ—passing authentication does not allow actions you are not authorized for.

6.2.2Tools for identity checks and data protection

• MFA (multi-factor authentication) combines two or more of "knowledge (password)," "possession (phone/token)," and "biometrics (fingerprint/face)" to strengthen identity checks. Even if a password leaks, an attacker cannot get in without the second factor, greatly raising safety.
• Encryption transforms data into a form unreadable without a key, protecting confidentiality; it applies to traffic (e.g., HTTPS) and to stored data. A certificate is an electronic ID by which a third party (a certificate authority) vouches that a public key is genuine, preventing impersonation of the party you communicate with.
• Password complexity—long, mixed character types, and not reused—is a basic measure against guessing and brute force. Active Directory is an identity store (directory service) that centralizes user and PC identity information in Windows environments, managing authentication and rights in one place.

6.2.3Common threats and vulnerabilities

• Phishing is fraud that impersonates a legitimate service via email or sites to trick users into entering passwords or card details. Spam is bulk junk mail, often a carrier for phishing or malware. Both are prime examples of "social engineering" that deceives people.
• Malware is a general term for malicious software (viruses, worms, ransomware, spyware, etc.). Once infected, it may steal information or encrypt data and demand a ransom (ransomware). A vulnerability is a weakness in software or configuration that, left unaddressed, becomes an entry point (mitigation: applying updates, etc.).
• DoS (denial of service) floods a server or network with traffic or requests to paralyze it and deny legitimate users. When launched simultaneously from many devices it is DDoS. This attack targets availability within CIA—a different target than phishing, which aims at confidentiality.

Suppose an employee reports: "I opened a link in an email claiming to be from a business partner and entered my company system ID and password." This is classic phishing, targeting confidentiality within CIA (leaked credentials). Consider the first response along the fundamental concepts. First, to keep a leaked password alone from allowing unauthorized login, check whether MFA is enabled on that employee's account. With MFA, an attacker who knows the password but lacks the "possession" factor (e.g., phone approval) cannot get in, greatly reducing damage. At the same time, reset the password immediately, and check the account's status and logs (accounting records) in an identity store such as Active Directory for any suspicious logins. Here the distinction between authentication and authorization matters: even if an attacker breaks authentication, giving the employee only the minimum necessary authorization (rights) limits what they can touch and contains the spread of damage. For prevention, enforce complex passwords, roll out MFA company-wide, and teach how to spot phishing emails. The point is not to memorize each control in isolation but to map "which part of CIA a threat targets, and which control (authentication, authorization, MFA, encryption) protects it." Once this mapping is second nature, even an unfamiliar case can be reasoned through: "what to protect first, and what to check next."

6.2.4Section summary

• CIA (confidentiality/integrity/availability) is what to protect; AAA (authentication/authorization/accounting) verifies, controls, and records users—authentication and authorization are distinct
• MFA hardens authentication with 2+ factors; encryption/certificates/password complexity protect data and identity checks; Active Directory centralizes identities
• Organize threats by targeted CIA: phishing/malware mainly target confidentiality/integrity, while DoS targets availability