Fundamental Security Concepts
Summarize fundamental security concepts
What you will learn
- Explain the CIA triad and tie each letter to the control that protects it.
- Separate identification, authentication, authorisation and accounting, and put them in the right order.
- Explain Zero Trust and place its components across the control plane and the data plane.
- Know when deception technology is used and what it is actually for.
This objective is the vocabulary the rest of the syllabus is built on. Its questions rarely ask for a definition outright; they describe a situation and wait for you to name the concept that governs it. What is wanted is the distinctions, not the definitions.
The triad, and what is added to it
| Confidentiality | Only those entitled may see the information. Protected by encryption and access control. |
|---|---|
| Integrity | The information has not been altered without authorisation. Protected by hashing and digital signatures. |
| Availability | The information is there when the person who needs it needs it. Protected by redundancy, backups and recovery plans. |
| Non-repudiation | Whoever did something cannot later deny it. Delivered by a digital signature — not by encryption or hashing alone. |
The access sequence
Four distinct steps. The exam confuses the second and third more than anything else in this objective.
Identification
Who do you claim to be? A username.
Authentication
Prove it. A password, a fingerprint, a one-time code.
Authorization
You are who you say — so what are you allowed to do? Permissions.
Accounting
What did you do? Logging and audit trails.
Authentication vs authorisation
| Authentication | Authorization | |
|---|---|---|
| The question | Who are you? | What may you do? |
| Order | First | Always after it |
| A failure means | You did not prove who you are | Your identity is proven but you lack permission |
| Example | Entering the password | Being refused the payroll file |
The classic trap on this objective
The question says the user signed in successfully and was then refused a folder. The words "signed in" pull you toward authentication, but authentication succeeded — the refusal happened at authorisation. The rule: if the identity is established and the problem is what came after, the answer is authorisation.
Zero Trust is the shift from defending the network perimeter to defending the resources themselves. NIST describes it as a set of concepts that move defences from a static, network-based perimeter to focus on users, assets and resources, granting no implicit trust to any asset or account merely because of its network location or ownership. In practice: nothing is trusted for being "inside the network", and every access request is evaluated on its own before a session opens.
The two planes
The control plane decides
The Policy Engine evaluates the request and issues the decision; the Policy Administrator passes that decision to the enforcement point. Adaptive identity, policy-driven access control and threat scope reduction live here.
The data plane enforces
The Policy Enforcement Point is the gate that actually allows or blocks. Implicit trust zones and the subject/system requesting access also sit here.
The separation is the point
Whoever decides is not whoever enforces. The decision stays central and consistent while enforcement is distributed at each resource.
The two planes in one line
The control plane says yes or no; the data plane opens or closes the door. If a question names the Policy Engine or Administrator it is the control plane; if it names the Enforcement Point or an implicit trust zone it is the data plane.
Real-world example: an employee requesting a file from a café
Under the old model, access from inside the office was trusted automatically and from outside was blocked. Under Zero Trust there is no such default: the request reaches the enforcement point, which asks the control plane. The Policy Engine weighs the identity, the device and its patch level, the time, the location and the risk score, and may decide to allow reading the file but not downloading it. That is exactly what adaptive identity means: the decision changes with the context rather than being granted once at sign-in.
Deception and disruption
| Honeypot | A decoy system that looks like an attractive target, meant to be attacked so the attacker's methods can be studied. It has no production value, so any interaction with it is inherently suspicious. |
|---|---|
| Honeynet | A whole network of decoy systems, giving a broader picture of how an attacker moves between machines. |
| Honeyfile | A bait file with a tempting name such as "passwords". Opening it is a strong signal of intrusion. |
| Honeytoken | Bait data such as a fake account or a dummy key. Seeing it somewhere else proves data left, and shows where from. |
Deception is not a defence
A honeypot neither prevents nor stops an attack. Its purpose is detection, study, and slowing the attacker down. Treating it as a preventive control mistakes its purpose — and the exam usually asks about purpose.
What matters on the exam
- "Signed in, then refused a resource" = authorisation. "Could not sign in" = authentication.
- Tie each CIA letter to its control: encryption for confidentiality, hashing for integrity, redundancy and backups for availability. The question describes the control and asks for the principle.
- Non-repudiation means a digital signature. Any option offering encryption alone to prove "who did it" is wrong.
- In Zero Trust: decides → control plane, enforces → data plane. Remember the verb, not the name.
- Any interaction with a honeypot is automatically suspicious, because it has no legitimate use. That is where its analytic value comes from.
Quick check
Answer in your head first, then reveal.
An employee enters their password successfully, then sees "you do not have permission". Which concept?Reveal the answer
Authorisation. Authentication succeeded; the refusal came at the next step, which decides what they are allowed to do.
Which CIA letter does a standby server in another site serve?Reveal the answer
Availability. The point is that the service stays reachable when the first site fails. It has nothing to do with confidentiality or integrity.
In Zero Trust, who makes the decision and who enforces it?Reveal the answer
The Policy Engine in the control plane decides, the Policy Administrator relays the decision, and the Policy Enforcement Point in the data plane actually allows or blocks. Separating decision from enforcement is the heart of the design.
A dummy account the company had planted in its database turns up for sale on a forum. What does that prove?Reveal the answer
That the honeytoken did its job: data really did leak, and it leaked from the specific database it was planted in. The value of bait is that it exists nowhere but where it was planted.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.