Unit 1: Fundamental Security Concepts, Threat Types, and Cryptographic Solutions — Comprehensive Study Notes

1. Core Cybersecurity Foundations and Governance Models

1.1 The CIA Triad and Modern Security Extensions

The foundational architecture of information security centers on the CIA Triad (Confidentiality, Integrity, and Availability), complemented by the critical attributes of Authenticity and Non-Repudiation:

CODECopy Code
+-----------------------------------------------------------------------------------+
|                            THE EXTENDED CIA TRIAD MODEL                           |
|                                                                                   |
|                                  [CONFIDENTIALITY]                                |
|                                   /             \                                 |
|                         Encryption               Access Control Lists             |
|                         Data Classification      Zero Trust Policies              |
|                                 /                 \                               |
|                     [INTEGRITY] ─────────────────── [AVAILABILITY]                |
|                      Hashing & HMAC                 High Availability Clusters    |
|                      Digital Signatures             RAID & Geo-Replication        |
|                      Immutable Ledgers              DDoS Mitigation Scrubbers     |
|                                                                                   |
|         Supporting Core Principles:                                               |
|         ├── Authenticity: Identity verification (Multi-Factor Authentication)    |
|         └── Non-Repudiation: Undeniable proof of origin (Digital Signatures)     |
+-----------------------------------------------------------------------------------+

1. Confidentiality: Safeguarding sensitive assets against unauthorized access, eavesdropping, or illicit disclosure. Enforced via end-to-end symmetric/asymmetric encryption, robust Access Control Lists (ACLs), role-based permissions, and strict data classification regimes.
2. Integrity: Guaranteeing data consistency, trustworthiness, and mathematical accuracy throughout its lifecycle. Prevents unauthorized modification, injection, or deletion. Enforced via cryptographic hash functions (SHA-256), Hash-based Message Authentication Codes (HMAC), and asymmetric digital signatures.
3. Availability: Ensuring timely, authorized access to computational resources, networks, and services. Mitigates hardware failure, localized disasters, and volumetric resource exhaustion (DDoS). Enforced via multi-zone cloud replication, redundant power/networking, database clustering, and automatic failover.
4. Non-Repudiation: The cryptographic assurance that a sender cannot deny having transmitted a message or initiated a transaction. Achieved by binding an action to an entity's private signing key via digital signatures and immutable audit trails.

1.2 The AAA Framework and Identity Management

The AAA Framework governs access control architectures across distributed systems:

• Authentication: Who are you? The process of verifying a declared identity using one or more authentication factors:
  • Knowledge factor: Something you know (password, PIN, passphrase).
  • Possession factor: Something you have (hardware security key, FIDO2 WebAuthn token, TOTP authenticator).
  • Inherence factor: Something you are (biometrics: fingerprint, iris pattern, facial geometry).
  • Contextual factor: Somewhere you are or something you do (GPS geofencing, keystroke dynamics, IP reputation).
• Authorization: What are you permitted to do? Granting specific privileges to an authenticated principal based on policies (RBAC - Role-Based Access Control, ABAC - Attribute-Based Access Control, or PBAC - Policy-Based Access Control).
• Accounting (Auditing): What did you do and when? Tracking, recording, and analyzing user activity, system events, and resource consumption in append-only, tamper-evident security logs for compliance and incident forensics.

1.3 Taxonomy of Security Controls

Security controls represent technical and operational countermeasures designed to neutralize vulnerabilities:

CODECopy Code
+-----------------------------------------------------------------------------------+
|                         TAXONOMY OF SECURITY CONTROLS                             |
|                                                                                   |
|  BY MECHANISM / CATEGORY:                                                         |
|  ├── Physical: Fences, biometric door locks, mantrap entry vestibules, CCTV       |
|  ├── Technical (Logical): Firewalls, IDS/IPS, TLS encryption, MFA, ACLs           |
|  └── Administrative (Managerial): Security policies, risk assessments, training   |
|                                                                                   |
|  BY FUNCTION / OBJECTIVE:                                                         |
|  ├── Preventive: Blocks attacks proactively (IPS, Next-Gen Firewalls, Hardening)  |
|  ├── Detective: Identifies active compromises (SIEM, IDS, Audit log monitoring)   |
|  ├── Corrective: Restores operational state post-incident (Backups, Patching)     |
|  ├── Deterrent: Discourages adversaries psychologically (Warning banners, Cameras)|
|  ├── Compensating: Alternative mitigation when primary controls cannot be applied |
|  └── Recovery: Rebuilds destroyed systems (Disaster recovery sites, Snapshots)     |
+-----------------------------------------------------------------------------------+

2. Threat Actors, Vectors, and Attack Taxonomies

2.1 Threat Actor Classification Matrix

Modern cybersecurity categorizes adversaries by resource capability, sophistication, intent, and motivation:

2.2 Attack Surface Analysis and Vector Expansion

The Attack Surface is the aggregate sum of all potential ingress points where an unauthorized user can attempt to enter or extract data:

1. Network Attack Surface: Open listening ports, unauthenticated APIs, VPN gateways, unencrypted wireless protocols, and misconfigured perimeter routers.
2. Software Attack Surface: Application-layer code vulnerabilities (SQL Injection, Remote Code Execution, deserialization bugs), outdated third-party libraries, and unpatched operating system binaries.
3. Human Attack Surface: Susceptibility of personnel to cognitive bias manipulation, phishing lures, pretexting, and social engineering.

2.3 Social Engineering Attack Methodologies

Social engineering exploits human psychology rather than software flaws:

• Phishing: Mass broadcast fraudulent emails mimicking trustworthy brands to harvest credentials or distribute malware.
• Spear Phishing: Highly tailored phishing targeted at specific individuals or departments using OSINT (Open Source Intelligence).
• Whaling: High-impact spear phishing directed against executive leadership (C-Suite: CEO, CFO) to authorize fraudulent wire transfers.
• Vishing & Smishing: Voice phishing over telephone/VoIP (vishing) and SMS phishing over cellular messaging (smishing).
• Pretexting: Fabricating an elaborate scenario or assumed identity (e.g., external IT auditor) to trick victims into disclosing sensitive data.
• Watering Hole Attack: Compromising a legitimate third-party website frequently visited by the target organization to infect their devices via drive-by downloads.

2.4 Malware Classifications

• Viruses: Malicious code that attaches itself to legitimate host executables, requiring user interaction to execute and propagate.
• Worms: Autonomous, self-replicating malware that actively scans networks for unpatched vulnerabilities, propagating without human intervention (e.g., WannaCry, Conficker).
• Trojans: Disguised as legitimate software (e.g., system optimizer) but contains hidden malicious payloads (backdoors, remote access trojans - RATs).
• Ransomware: Encrypts victim filesystem using strong asymmetric/symmetric ciphers, demanding cryptocurrency ransoms for private decryption keys. Double-extortion variants exfiltrate sensitive files prior to encryption.
• Rootkits: Kernel-level or hypervisor-level malware that modifies operating system kernel tables (SSDT, IDT) to conceal processes, files, and network sockets from administrative visibility.
• Fileless Malware: Resides exclusively in volatile system RAM, executing via native administrative binaries (PowerShell, WMI, mshta) to avoid detection by signature-based antivirus scanners.

3. Cryptographic Architectures and Mathematical Foundations

3.1 Symmetric vs. Asymmetric Cryptography

Cryptography provides mathematical mechanisms for confidentiality, integrity, and authentication:

CODECopy Code
+-----------------------------------------------------------------------------------+
|                     SYMMETRIC VS ASYMMETRIC ENCRYPTION TOPOLOGY                   |
|                                                                                   |
|  SYMMETRIC ENCRYPTION: Single Shared Secret Key                                   |
|  Plaintext ──► [AES-256 Engine (Secret Key K)] ──► Ciphertext ──► [Decrypt (K)]   |
|  Pros: Extremely fast (Gigabits/sec with AES-NI instructions), minimal CPU load    |
|  Cons: Key Distribution Problem (How to securely share K across the internet?)    |
|                                                                                   |
|  ASYMMETRIC ENCRYPTION: Key Pair (Public Key & Private Key)                       |
|  Plaintext ──► [RSA / ECC Engine (Public Key)] ──► Ciphertext ──► [Private Key]   |
|  Pros: Solves key exchange; enables Digital Signatures and Non-Repudiation        |
|  Cons: Computationally intensive (100x to 1000x slower than symmetric ciphers)    |
|                                                                                   |
|  HYBRID CRYPTOSYSTEM (e.g., TLS 1.3):                                              |
|  1. Asymmetric (ECDHE) negotiates a shared ephemeral session key.                 |
|  2. Symmetric (AES-256-GCM) encrypts high-volume payload data.                    |
+-----------------------------------------------------------------------------------+

3.2 Symmetric Cipher Modes and Block Mechanics

Block ciphers encrypt fixed-size data blocks (e.g., 128-bit blocks in AES):

1. Electronic Codebook (ECB): Encrypts identical plaintext blocks into identical ciphertext blocks. Insecure because structural patterns remain visible in the ciphertext (the infamous ECB Tux penguin).
2. Cipher Block Chaining (CBC): XORs each plaintext block with the immediately preceding ciphertext block before encryption, using an unpredictable Initialization Vector (IV) for the first block. Vulnerable to padding oracle attacks if improperly authenticated.
3. Galois/Counter Mode (GCM): An Authenticated Encryption with Associated Data (AEAD) mode. Combines counter-mode encryption (CTR) with Galois field multiplication to produce an authentication tag. Delivers confidentiality, integrity, and authenticity simultaneously with high-speed hardware pipelining.

3.3 Asymmetric Cryptosystems: RSA and Elliptic Curve Cryptography (ECC)

RSA Algorithm Mechanics

Invented by Rivest, Shamir, and Adleman (1977), RSA relies on the computational intractability of the Integer Factorization Problem:

1. Select two large prime numbers, $p$ and $q$.
2. Compute modulus $n = p \times q$.
3. Compute Euler's totient function:
   $\phi(n) = (p - 1)(q - 1)$
4. Select public exponent $e$ such that $1 < e < \phi(n)$ and $\gcd(e, \phi(n)) = 1$ (typically $e = 65537$).
5. Compute private exponent $d$ via the modular multiplicative inverse:
   $d \equiv e^{-1} \pmod{\phi(n)} \iff (d \times e) \equiv 1 \pmod{\phi(n)}$
6. Encryption: $C = M^e \pmod{n}$
7. Decryption: $M = C^d \pmod{n}$

Elliptic Curve Cryptography (ECC)

ECC relies on the Elliptic Curve Discrete Logarithm Problem (ECDLP) over finite fields:
$y^2 = x^3 + ax + b$

• ECC achieves equivalent cryptographic strength to RSA with drastically smaller key sizes:
  • ECC 256-bit key provides equivalent security to an RSA 3072-bit key.
  • ECC 384-bit key provides equivalent security to an RSA 7680-bit key.
• Advantages: Exponentially reduced CPU consumption, lower memory footprints, and minimized TLS handshake packet payloads, making ECC (Curve25519, Secp256r1) the global standard for mobile and cloud communications.

3.4 Cryptographic Hash Functions and Digital Signatures

A cryptographic hash function compresses arbitrary-length input data into a fixed-size deterministic bit digest (e.g., 256 bits in SHA-256):

The Three Core Mathematical Properties

1. Pre-Image Resistance (One-Way Property): Given digest $h$, it is computationally impossible to find input $m$ such that $\text{Hash}(m) = h$.
2. Second Pre-Image Resistance (Weak Collision Resistance): Given input $m_1$, it is computationally infeasible to find a distinct input $m_2 \neq m_1$ such that $\text{Hash}(m_1) = \text{Hash}(m_2)$.
3. Collision Resistance (Strong Collision Resistance): It is computationally infeasible to find any two arbitrary distinct inputs $m_1 \neq m_2$ such that $\text{Hash}(m_1) = \text{Hash}(m_2)$.
4. Avalanche Effect: Flipping a single bit in the input message causes a cascade that changes approximately 50% of the output digest bits unpredictably.

Digital Signature Architecture

Digital signatures provide Authenticity, Integrity, and Non-Repudiation:

1. Signing: The sender hashes the document ($h = \text{SHA256}(M)$) and encrypts the digest with their Private Key:
   $\text{Signature} = \text{Sign}_{K_{\text{private}}}(h)$
2. Verification: The recipient decrypts the signature using the sender's Public Key to extract $h$, independently hashes the received message to obtain $h'$, and compares them:
   $\text{Valid} \iff \text{Verify}_{K_{\text{public}}}(\text{Signature}) == \text{SHA256}(M)$

3.5 Public Key Infrastructure (PKI) and X.509 Certificates

Public Key Infrastructure provides the hierarchical trust foundation that binds cryptographic public keys to verified entity identities:

• Digital Certificate (X.509 Standard): An electronic credential containing the subject's public key, subject distinguished name (DN), issuing Certificate Authority (CA) signature, validity dates, serial number, and Subject Alternative Names (SAN).
• Certificate Authority (CA): A trusted third party responsible for verifying identities and digitally signing X.509 certificates.
• Revocation Mechanisms:
  • Certificate Revocation List (CRL): Periodically published signed list of revoked certificate serial numbers; high latency and bandwidth overhead.
  • Online Certificate Status Protocol (OCSP): Real-time query to CA responder to check certificate validity.
  • OCSP Stapling: The web server queries the CA periodically, caches the signed timestamped OCSP response, and "staples" it to the initial TLS handshake, eliminating client-to-CA latency bottlenecks and privacy leakage.

3.6 Password Storage Engineering: Salting, Peppering, and KDFs

Storing plain or unsalted hashed passwords is fatal due to pre-computed lookup dictionaries (Rainbow Tables):

1. Cryptographic Salt: A cryptographically random unique string (e.g., 16+ bytes) appended to each user's password prior to hashing. Salts completely neutralize rainbow tables by ensuring identical passwords yield completely distinct hash digests.
2. Cryptographic Pepper: A high-entropy secret key stored external to the database (e.g., in a hardware security module - HSM) and combined with the password before hashing. If the database leaks, hashes remain uncrackable without the pepper.
3. Key Derivation Functions (KDFs): Standard hash functions (SHA-256) are designed for raw throughput (billions of hashes/sec on GPUs), making them unsuitable for passwords. Modern password security mandates memory-hard, deliberately slow KDFs:
   • Argon2id: Winner of the Password Hashing Competition; resists both GPU and ASIC brute-force attacks via configurable memory, iteration, and parallelism parameters.
   • bcrypt: Adaptive blowfish-based hashing with an adjustable work factor ($2^{\text{cost}}$).