What is the CIA triad in information security?
Confidentiality, Integrity, and Availability — the three core security objectives.
What is confidentiality?
Preventing unauthorized reading of information; keeping data secret from unauthorized entities.
What is integrity in information security?
Ensuring data cannot be altered by unauthorized or unknown means.
What is availability?
Ensuring authorized users can access information and services when needed.
What type of attack threatens availability?
Denial of Service (DoS) attacks.
Why is availability important for both users and organizations?
Users need access to services; organizations lose revenue and trust if systems are unavailable.
What is Denial of Service (DoS)?
An attack aimed at reducing or preventing access to information or services.
Why is CIA not sufficient alone for security?
It does not address identity verification, permissions, or accountability.
What is authentication?
Verifying the identity of an entity (user, system, device).
What is entity authentication?
Confirming the identity of a person, computer, or device.
What is message authentication?
Verifying the source of information (data origin authentication).
Why is network authentication difficult?
Attackers can intercept, modify, replay, or forge messages.
What is replay attack?
Reusing old valid messages to impersonate a legitimate user.
What role does cryptography play in authentication?
It secures credentials and protects authentication protocols.
What is authorization?
Restricting what an authenticated user is allowed to do.
How does authorization differ from authentication?
Authentication verifies identity; authorization controls permissions.
What is access control?
The combined process of authentication and authorization.
What is non-repudiation?
Preventing an entity from denying previous actions or commitments.
What is a digital signature used for?
Binding information to an entity and supporting integrity and non-repudiation.
What is certification?
Endorsement of information by a trusted entity.
What is validation in security objectives?
Ensuring authorization is timely and still valid.
What is timestamping?
Recording the time of creation or existence of information.
What is witnessing?
Verifying information creation or existence by a third party.
What is receipt?
Acknowledgement that information has been received.
-
1. Need For Security37
-
2. People, Process, & Technology18
-
3. Threat Model43
-
4. Security Requirements29
-
5. Access Control (DAC)44
-
6. Access Control (RBAC, ABAC)58
-
7. Access Control (MAC)54
-
8. Introduction to applied cryptography63
-
9. Applied Cryptography70
-
10. Symmetric Cryptography66
-
11. Hash Functions50
-
12. Public Key Cryptography66
-
13. Blockchain68
