Simple explanation
This lesson covers the vocabulary everything else in the course builds on: the three promises security makes (CIA), how systems prove who you are and what you can do (AAA), the "never trust, always verify" mindset (Zero Trust), and the practice of setting traps for attackers (deception technology).
Technical explanation
- Confidentiality — only authorized parties see the data (encryption, ACLs, least privilege).
- Integrity — data hasn't been altered in unauthorized ways (hashing — SHA-256, digital signatures, checksums).
- Availability — authorized users can access data/systems when needed (redundancy, backups, failover, DDoS protection).
- Non-repudiation — someone can't credibly deny having performed an action (digital signatures, audit logs).
- AAA: Authentication (proving identity — something you know/have/are), Authorization (what an authenticated identity is permitted to do), Accounting (logging what was done, for audit).
- Authenticating people vs. systems — people use passwords/biometrics/tokens; systems/services often authenticate via certificates or API keys, since there's no human to prompt.
- Zero Trust — assumes no user or device is trusted by default, even inside the network perimeter. Two planes: the control plane (adaptive identity, policy engine, policy administrator) decides whether access is allowed; the data plane (subject/system, policy enforcement point) actually carries out and enforces that decision on every request, not just at login.
- Physical security — bollards, access control vestibules, badges, lighting, sensors (infrared, pressure, microwave, ultrasonic).
- Deception and disruption technology — honeypots (fake vulnerable systems), honeynets (whole fake networks), honeyfiles (fake sensitive documents that trigger an alert when opened), honeytokens (fake credentials/data planted to detect unauthorized use). These don't prevent attacks — they detect and study them.
Synonyms / related terms
| Term | Means | |---|---| | AIC triad | CIA triad, reordered to avoid confusion with the U.S. Central Intelligence Agency | | Least privilege | The practical application of the "A" in Authorization — grant only what's needed | | Honeynet | A network of honeypots |
Concept Check
"A hospital's patient heart-rate monitor must remain online during a cyberattack — which triad leg is most at risk?" Not Confidentiality (nothing here is about secrecy), not Integrity (nothing is being altered) — Availability, because "must remain online" is entirely about uptime and access.
Interview-style Q&A
Q: How would you explain Zero Trust to a non-technical executive? A: "Traditional security trusted anyone already inside the building. Zero Trust assumes a badge alone doesn't prove you should be in every room — every request gets checked against policy, every time, regardless of where it originates."
Memory trick
"See I Ay, Triple A, Zero Trust, Honey" — say the acronyms in order (CIA → AAA → Zero Trust → deception/"honey" technology) and the whole lesson's structure comes back to you.