Security Concepts and Threats

Week of 2026-12-15 · Download .docx

Objectives

Define the CIA Triad and map security controls to each property
Explain authentication factors and the principle of least privilege
Identify common attack types including phishing, ransomware, and SQL injection

Key terms

CIA Triad: Confidentiality, Integrity, Availability — the three fundamental information security properties.
Confidentiality: Only authorized parties can access data — enforced by encryption and access controls.
Integrity: Data has not been altered — enforced by hashing, digital signatures, and audit logs.
Availability: Systems are accessible when needed — protected by redundancy and DDoS mitigation.
MFA: Multi-Factor Authentication — requires proof from two or more distinct factor categories.
Least privilege: Users receive only the minimum permissions required for their job function.
Zero-day: Vulnerability exploited before the vendor has released a patch.
Phishing: Fake emails designed to steal credentials or deliver malware.
Ransomware: Malware encrypting victim files and demanding payment for the decryption key.
SQL injection: Injecting SQL code into a web form to manipulate a backend database.
Symmetric encryption: Uses one shared key for both encryption and decryption (AES, 3DES).
Asymmetric encryption: Uses a public/private key pair (RSA, ECC) — public encrypts, private decrypts.

The concept

THE CIA TRIAD

Every information security decision maps to at least one of three properties. Confidentiality ensures only authorized users can read data — enforced with encryption, access controls, and need-to-know policies. Integrity ensures data has not been tampered with — protected by cryptographic hashes, digital signatures, and audit logs that detect unauthorized changes. Availability ensures systems and data are accessible when needed — defended by redundancy, failover, backup, and DDoS mitigation.

AUTHENTICATION FACTORS

Authentication factors fall into three categories: something you know (password, PIN, security question), something you have (smart card, authenticator app, hardware token), and something you are (fingerprint, face scan, retina — inherence/biometrics). Multi-Factor Authentication (MFA) requires proof from at least two different categories. Two passwords are not MFA — both are 'something you know.'

ACCESS CONTROL PRINCIPLES

Least privilege grants users only the minimum access needed for their job function — if a clerk does not need admin rights, they do not have them. This limits the blast radius if the account is compromised. Separation of duties ensures no single person controls an entire critical process (e.g., the person who creates purchase orders cannot also approve them).

COMMON ATTACK TYPES

Phishing uses deceptive emails impersonating trusted organizations to steal credentials or deliver malware. Ransomware encrypts the victim's files and demands cryptocurrency payment. SQL injection exploits unsanitized web form inputs to manipulate backend databases — returning unauthorized data or bypassing login. A zero-day vulnerability is exploited before any patch exists, leaving all systems running the affected software vulnerable with no available fix.

Worked examples

Example 1: An organization's CIA assessment: a ransomware attack that encrypts all files violates Availability (files inaccessible) and potentially Integrity (files modified/encrypted). A data breach where an attacker reads but does not alter customer records violates only Confidentiality. A DDoS attack taking the web server offline violates only Availability.

Example 2: An employee account is compromised. Under least privilege, the damage is limited to that user's data and permissions. If that employee had unnecessary admin rights, the attacker gains domain admin access. The security control that would have limited this is least privilege — the employee should have had standard user rights only.

Common mistakes

Confusing symmetric (one shared key — AES) with asymmetric (key pair — RSA) encryption.
Thinking two passwords constitute MFA — both are 'something you know'; different categories are required.
Confusing phishing (email) with vishing (voice call) and smishing (SMS) — medium determines the type.
Believing zero-days only target old software — they can affect the most current, fully patched software.
Confusing integrity (data not altered) with confidentiality (data not read by unauthorized parties).

Self-check

Try each question before reading the answer. Answers at the bottom of this page.

1. The CIA Triad stands for:

Confidentiality, Integrity, Availability
Control, Identity, Authentication
Confidentiality, Identity, Access
Compliance, Integrity, Audit

2. A biometric fingerprint scan is which authentication factor?

Something you are (inherence)
Something you have
Something you know
Something you do

3. The principle of least privilege means:

Users receive minimum permissions needed for their job
All users need admin rights
Permissions are generous to avoid productivity loss
All department users share the same access

4. Ransomware:

Encrypts victim files and demands payment for the decryption key
Silently exfiltrates data
Remotely controls the victim's computer
Hides in the OS

5. Symmetric encryption uses:

The same key for both encryption and decryption
A public/private key pair
A hash function
No key at all

Self-check answers

1. A — CIA = Confidentiality, Integrity, Availability — the foundation of information security.
2. A — Physical characteristics like fingerprints are the 'something you are' (inherence) factor.
3. A — Least privilege limits damage from compromised accounts by granting only what is needed.
4. A — Ransomware encrypts files and demands payment for the key.
5. A — Symmetric encryption (AES) uses one shared key; asymmetric uses a key pair.

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top