Unit 1: Summarize Fundamental Security Concepts, Compare Threat Types, Explain Cryptographic Solutions

1. Introduction: Foundations of Cybersecurity

Information security protects computing systems, networks, and data from unauthorized access, disruption, modification, or destruction. As organizations transition critical assets to interconnected digital environments, security has evolved from isolated perimeter firewalls into systematic, multi-tiered risk management.

Understanding fundamental security tenets—the CIA Triad, Zero Trust architecture, threat actor classifications, social engineering vectors, and modern cryptography—is essential for designing resilient computing systems aligned with industry certifications such as CompTIA Security+.

2. Core Security Concepts & Models

The CIA Triad

The core model of information security balances three interrelated objectives:

1. Confidentiality: Preventing unauthorized disclosure of information.
   • Mechanisms: Encryption (AES, TLS), Access Control Lists (ACLs), multi-factor authentication (MFA), data masking.
2. Integrity: Ensuring information and systems remain accurate, complete, and protected against unauthorized modification or tampering.
   • Mechanisms: Cryptographic hash functions (SHA-256), digital signatures, file integrity monitoring (FIM), version control.
3. Availability: Ensuring authorized users have timely, reliable access to data and resources when needed.
   • Mechanisms: Hardware redundancy (RAID), high availability clusters, load balancing, offsite backups, and DDoS mitigation.

Non-Repudiation & The Parkerian Hexad

• Non-Repudiation: The assurance that the sender of data or author of an action cannot deny the authenticity of their signature or message. Achieved using digital signatures paired with asymmetric cryptography and audit logs.
• The Parkerian Hexad: An expanded security model consisting of six atomic attributes:
  • Confidentiality, Integrity, Availability
  • Authenticity: Verifying the genuine origin and identity of the data or user.
  • Utility: The usefulness or accessibility of the information in its current state (e.g., encrypted data for which the key is lost retains integrity but loses utility).
  • Possession / Control: Physical or logical ownership of data storage media (e.g., if an encrypted laptop is stolen, confidentiality may remain intact, but possession is breached).

Zero Trust & Defense in Depth

• Zero Trust Architecture (ZTA): A security paradigm based on the principle "Never trust, always verify." Traditional security assumed internal perimeter network traffic was safe. Zero Trust eliminates perimeter trust: every access request—regardless of origin (inside or outside the corporate LAN)—must be authenticated, authorized, and cryptographically verified based on context (identity, device health, location).
• Defense in Depth (Layered Security): Deploying multiple overlapping defensive layers (physical, perimeter, network, host, application, data). If an attacker penetrates one layer, subsequent controls prevent complete system compromise.

3. Classification of Security Controls

Security controls mitigate vulnerabilities and minimize risk across distinct types and functional roles:

Control Categories (Types)

• Technical / Logical Controls: Implemented via hardware, software, or firmware (e.g., firewalls, encryption, antivirus, IDS/IPS).
• Administrative / Managerial Controls: Implemented through organizational policies, security awareness training, hiring vetting, and standard operating procedures (SOPs).
• Physical Controls: Tangible mechanisms restricting physical access to facilities and hardware (e.g., biometric door locks, security guards, fences, CCTV, badge readers).
• Operational Controls: Day-to-day procedures performed by humans (e.g., routine backup rotations, log reviews, tabletop incident drills).

Control Functions

4. Threat Actors, Vectors, and Attack Surfaces

Threat Actor Classifications

1. Nation-State Actors / Advanced Persistent Threats (APTs): State-sponsored organizations with immense financial resources, military-grade sophistication, and long-term espionage/disruption objectives.
2. Cybercriminals (Organized Crime): Highly motivated by direct financial gain (ransomware, extortion, credential trafficking, bank fraud).
3. Hacktivists: Driven by political, ideological, or social causes (website defacement, DDoS, leaking sensitive documents).
4. Insider Threats: Current or former employees, contractors, or business partners:
   • Malicious Insiders: Deliberately exfiltrate intellectual property or sabotage systems for revenge or profit.
   • Negligent Insiders: Unintentionally cause data exposure through phishing clicks, lost laptops, or misconfigured storage.
5. Script Kiddies: Inexperienced individuals using automated pre-built tools and exploit kits without understanding underlying code; motivated by peer recognition or curiosity.
6. Competitors: Driven by industrial espionage, proprietary source code theft, and competitive sabotage.
7. Shadow IT: Employees deploying unauthorized software, cloud services, or hardware to bypass IT friction, introducing unmanaged vulnerabilities.

Attack Surfaces and Vectors

• Attack Surface: The sum total of all vulnerable points where an adversary can enter or extract data (open network ports, exposed APIs, physical USB drives, human personnel).
• Attack Vectors: The pathway or method used to compromise a target:
  • Email / Phishing: Socially engineered attachments or deceptive links.
  • Unpatched Software: Exploiting unmitigated CVEs in operating systems or web frameworks.
  • Supply Chain: Compromising upstream software dependencies or hardware vendors.
  • Removable Media: Dropping malware-infected USB flash drives in parking lots.

5. Social Engineering Principles and Techniques

Social engineering manipulates human psychology rather than exploiting software vulnerabilities.

Principles of Influence (Psychological Drivers)

• Authority: Pretending to be an executive, law enforcement officer, or IT director to compel obedience.
• Intimidation: Threatening negative consequences (job termination, legal lawsuits, network disconnection).
• Urgency: Demanding immediate action to bypass logical scrutiny (e.g., "Account suspended in 15 minutes!").
• Scarcity: Fabricating limited-time offers to induce hasty decisions.
• Consensus / Social Proof: Claiming colleagues or peers have already approved or performed the requested action.
• Familiarity / Liking: Establishing rapport and friendly banter to lower natural suspicion.
• Trust: Building false credibility over extended conversations before launching an attack.

Common Social Engineering Attacks

• Phishing: Mass broadcast fraudulent emails mimicking banks or vendors to steal passwords.
• Spear Phishing: Highly customized, targeted phishing directed at specific individuals using gathered OSINT.
• Whaling: Spear phishing targeting high-level corporate executives (CFOs, CEOs).
• Vishing & Smishing: Voice phone scams (vishing) and SMS text message phishing (smishing).
• Business Email Compromise (BEC): Impersonating a CEO or vendor via compromised email to redirect wire transfers.
• Pretexting: Fabricating a believable scenario or backstory to extract sensitive data.
• Watering Hole Attack: Compromising a niche website frequently visited by target organizations to infect visitors.
• Tailgating / Piggybacking: Closely following an authorized employee through secure doors without badge scanning.
• Dumpster Diving & Shoulder Surfing: Scavenging physical waste for sensitive documents or looking over a user's shoulder to capture PINs and keystrokes.

6. Cryptographic Solutions: Ciphers, Hashes, and PKI

Symmetric vs. Asymmetric Encryption

Symmetric Cipher Modes of Operation

• Electronic Codebook (ECB): Encrypts each 128-bit plaintext block with the identical key independently. Identical plaintext blocks produce identical ciphertext blocks, preserving visual data patterns. Insecure and strictly prohibited.
• Cipher Block Chaining (CBC): XORs each plaintext block with the previous ciphertext block before encryption, using a random Initialization Vector (IV) for the first block. Strong, but vulnerable to padding oracle attacks.
• Galois/Counter Mode (GCM): Combines Counter (CTR) mode with Galois authentication, providing Authenticated Encryption with Associated Data (AEAD). Delivers high speed, parallel hardware acceleration, and integrated tamper detection.

Cryptographic Hash Functions

A hash function is a one-way mathematical algorithm that converts an arbitrary-length input into a fixed-length string (digest):

• Core Properties: One-way (pre-image resistance), collision-resistant (no two inputs yield the same output), deterministic, and avalanche effect (slight input change drastically alters the hash).
• Algorithms:
  • MD5 & SHA-1: Cryptographically broken; vulnerable to collision attacks. Deprecated.
  • SHA-2 (SHA-256, SHA-512): Industry standard for digital certificates and integrity verification.
  • SHA-3: Keccak-based alternative design immune to SHA-2 vulnerability patterns.
• HMAC (Hash-based Message Authentication Code): Combines a cryptographic hash function with a shared secret key, verifying both data integrity and authenticity.

Digital Signatures

Ensures authenticity, integrity, and non-repudiation:

1. Sender computes a SHA-256 hash digest of the original message.
2. Sender encrypts the hash digest using their Private Key (generating the digital signature).
3. Receiver decrypts the signature using the sender's Public Key to reveal the original hash digest.
4. Receiver independently computes the SHA-256 hash of the received message.
5. If both hashes match, the message was genuinely signed by the sender and was not altered in transit.

Public Key Infrastructure (PKI)

PKI manages the issuance, distribution, and revocation of digital certificates:

• Certificate Authority (CA): Trusted third-party entity that validates identities and cryptographically signs digital certificates (e.g., Let's Encrypt, DigiCert).
• Registration Authority (RA): Verifies the identity of applicants on behalf of the CA before certificate issuance.
• Certificate Revocation Mechanisms:
  • Certificate Revocation List (CRL): A periodically published list of revoked certificate serial numbers; can suffer from caching delays.
  • Online Certificate Status Protocol (OCSP): Real-time query to check a certificate's revocation status.
  • OCSP Stapling: The web server queries the CA periodically and appends a timestamped, cached OCSP response directly during the TLS handshake, reducing CA server load and improving client privacy.

7. States of Data and Advanced Cryptography

1. Data at Rest: Data stored persistently on disks, tapes, or databases. Protected via full-disk encryption (BitLocker, LUKS) or file/database encryption (AES-256).
2. Data in Transit (in Motion): Data traveling across internal or public networks. Protected via TLS 1.3, IPsec VPNs, or SSH.
3. Data in Use: Data actively resident in volatile system RAM, CPU registers, or caches. Vulnerable to memory-scraping attacks. Protected via Confidential Computing (hardware secure enclaves like AWS Nitro Enclaves or Intel SGX) and Homomorphic Encryption (allowing computation directly on encrypted data without decrypting it).

8. Common Pitfalls & Exam Tips

1. ECB Mode Failure: Never use Electronic Codebook (ECB) mode for block ciphers; repeating plaintext blocks produce repeating ciphertext patterns (the infamous "ECB Penguin").
2. Hashing vs. Encryption: Hashing is a one-way function without a key; encryption is a two-way function requiring a decryption key.
3. Public vs. Private Key Roles: In asymmetric encryption, the recipient's public key encrypts, and their private key decrypts. In digital signatures, the sender's private key signs, and their public key verifies.
4. Collision Resistance: A collision occurs when two distinct inputs produce the identical output digest ($H(x) = H(y)$). A broken algorithm (MD5) is susceptible to collision generation attacks.

9. Quick Revision Summary

• The CIA Triad (Confidentiality, Integrity, Availability) guides security architecture, expanded by Authenticity, Utility, and Possession.
• Zero Trust requires continuous verification, eliminating implicit internal network trust.
• Controls are classified by category (Technical, Administrative, Physical, Operational) and function (Preventive, Detective, Corrective, Deterrent, Compensating, Recovery).
• Threat actors range from script kiddies to nation-state APTs; social engineering attacks exploit psychological principles like authority, urgency, and trust.
• Symmetric ciphers (AES-GCM) provide fast bulk encryption; asymmetric ciphers (RSA, ECC) enable secure key exchange and digital signatures.
• Hashes (SHA-256) enforce integrity; digital signatures provide authenticity and non-repudiation.
• PKI validates identities via CAs and X.509 digital certificates with OCSP revocation checking.