Tauseef FayyazChapter 01
Security foundations
The ideas every security role shares: what security protects, how risk is judged, the networking and access basics, cryptography as concepts, and the law on testing.
CIA triad
Also called confidentiality, integrity, availability
- What
- The three properties security protects: confidentiality (only the right people can read it), integrity (nobody can change it unnoticed) and availability (it works when needed).
- Why
- Almost every control serves one of the three, and real decisions trade them off, so naming which one is at stake makes a discussion precise.
- Example
- Ransomware hits availability by encrypting files and often confidentiality too, when the attackers copy the data first and threaten to publish it.
Watch out
Thinking security only means secrecy and ignoring integrity and availability.
Risk, threat and vulnerability
Also called risk assessment, likelihood and impact
- What
- A vulnerability is a weakness, a threat is someone or something that could exploit it, and risk combines how likely that is with how bad the outcome would be.
- Why
- Teams can never fix everything, so they rank risks and spend effort where likelihood and impact are highest.
Watch out
Calling every finding critical, which makes people stop listening.
CVSS
Also called Common Vulnerability Scoring System, severity score
- What
- An open standard from FIRST that scores a vulnerability from 0 to 10 using factors such as how it is reached, the privileges needed and its impact. Version 4.0 is current.
- Why
- A shared scale lets scanners, advisories, developers and testers talk about severity consistently and decide what to fix first.
Watch out
Using the base score alone without adjusting for your own context, such as internet exposure or data sensitivity.
Defence in depth
Also called layered security
- What
- Using several independent layers of control, such as MFA, patching, network rules, monitoring and backups, so one failure does not mean a breach.
- Why
- Every control fails sometimes; layers buy time to detect and respond before damage is done.
Watch out
Relying on one strong control, such as a firewall, and leaving everything behind it soft.
Least privilege
Also called principle of least privilege, need to know
- What
- Giving each person, service and process only the access it needs to do its job, and only for as long as it needs it.
- Why
- It limits what an attacker can do with a stolen account or a compromised service, and limits damage from honest mistakes.
Watch out
Making everyone an administrator because it is quicker to set up.
Networking basics for security
Also called TCP/IP, ports, DNS, HTTP
- What
- IP addresses and subnets, TCP and UDP, ports, DNS, HTTP and HTTPS, and what firewalls and proxies do: the path every connection takes.
- Why
- Logs, packet captures and web weaknesses all make sense only when you know what a normal connection looks like.
- Example
- Opening a website: DNS turns the name into an address, the browser opens TCP to port 443, TLS sets up encryption, then HTTP requests flow.
Watch out
Memorising port numbers without understanding the protocols behind them.
TLS
Also called HTTPS, SSL, certificate
- What
- The protocol that encrypts and authenticates connections such as HTTPS. The server proves its identity with a certificate, then both sides agree keys for fast symmetric encryption.
- Why
- It protects data in transit from being read or changed, and tells the browser it is talking to the real site.
Watch out
Turning off certificate verification in code to make an error go away.
Multi-factor authentication
Also called MFA, 2FA, passkeys
- What
- Requiring two or more kinds of proof to sign in: something you know, something you have or something you are. Passkeys and security keys resist phishing best.
- Why
- Stolen passwords are the most common way into accounts; a second factor stops most of those attempts.
Watch out
Treating SMS codes as strong; they help, but can be phished or intercepted.
Hashing
Also called hash, SHA-256, bcrypt, Argon2, Argon2id, salt
- What
- A one-way function that turns data into a fixed-size fingerprint. Password storage uses slow, salted algorithms such as Argon2id or bcrypt; integrity checks use fast ones such as SHA-256.
- Why
- You can check a password or a file without storing or trusting the original, and any change produces a different hash.
Watch out
Storing passwords with a fast hash like SHA-256 or MD5, which is quick to guess at scale.
Symmetric and asymmetric encryption
Also called AES, public key, private key, digital signature
- What
- Symmetric encryption uses one shared key and is fast. Asymmetric encryption uses a public and private key pair, which also enables digital signatures.
- Why
- Systems combine both: key pairs to agree or protect a key safely, and a fast symmetric key for the data itself.
Watch out
Writing your own cryptography instead of using a well-reviewed library.