The CIA triad
The CIA triad is the foundational framework for information security: Confidentiality, Integrity, and Availability. Every security control, attack, and countermeasure can be mapped to one or more of these three properties.
Confidentiality ensures that information is accessible only to authorized parties. Threats to confidentiality: eavesdropping, data exfiltration, unencrypted storage or transmission, unauthorized access. Controls: encryption (TLS, IPsec), access control, need-to-know policies.
Integrity ensures that information is accurate and has not been tampered with, either in storage or transit. Threats to integrity: man-in-the-middle attacks, data corruption, unauthorized modification. Controls: cryptographic hashes (SHA-256), digital signatures, message authentication codes (HMAC), checksums.
Availability ensures that systems and data are accessible when needed by authorized users. Threats to availability: Denial of Service (DoS), Distributed DoS (DDoS), hardware failure, natural disaster, ransomware. Controls: redundancy, load balancing, DDoS mitigation, backups, high-availability failover.
Security decisions always involve trade-offs between the three. Increasing confidentiality (strong encryption) can reduce availability (performance overhead). Maximum availability (no authentication) reduces confidentiality. The goal is appropriate balance for the risk environment.
Threats, vulnerabilities, and exploits
These three terms are frequently confused but have specific meanings in security: a vulnerability is a weakness in a system — a bug, misconfiguration, or design flaw. A threat is any potential danger that could exploit a vulnerability — a malicious actor, malware, or environmental hazard. An exploit is the specific technique or tool used to take advantage of a vulnerability.
Risk is the intersection of threat, vulnerability, and impact: Risk = Threat × Vulnerability × Impact. A vulnerability with no known threat is low risk. A severe vulnerability with active exploitation and high business impact is critical risk.
Attack categories on CCNA: Reconnaissance (passive information gathering — port scans, OSINT); Access attacks (exploiting vulnerabilities to gain unauthorized access — password attacks, man-in-the-middle, social engineering); DoS/DDoS attacks (overwhelming a system to deny service to legitimate users); Malware (viruses, worms, ransomware, spyware — software designed to damage or gain unauthorized access).
Common attack types
Social engineering attacks exploit human psychology rather than technical vulnerabilities. Phishing uses fraudulent emails to trick users into revealing credentials or clicking malicious links. Spear phishing targets specific individuals with personalized lures. Vishing uses voice calls. Smishing uses SMS. Pretexting creates a fabricated scenario to extract information. Social engineering is often the first step in a more complex attack — technical defenses alone cannot stop it; user training is essential.
Password attacks: brute force (trying all combinations), dictionary attacks (trying common words and passwords), credential stuffing (using leaked username/password pairs from other breaches). Defense: strong password policies, account lockout, MFA.
Man-in-the-Middle (MitM) attacks position an attacker between two communicating parties to intercept or modify traffic. ARP spoofing (sending fake ARP replies to redirect traffic through the attacker's device) is the classic Layer 2 MitM attack — mitigated by Dynamic ARP Inspection. Defense: encryption (TLS), PKI certificate validation, DAI.
DoS vs DDoS: a DoS attack comes from a single source; a DDoS attack uses many compromised systems (botnets) simultaneously. DDoS is much harder to block because the traffic comes from thousands of legitimate-looking IPs. Common DDoS types: volumetric (saturate bandwidth), protocol (exploit protocol weaknesses like SYN flood), application layer (HTTP floods).
Security program elements
A security program is not just technology — it includes people, processes, and physical controls.
User awareness and training is the most effective defense against social engineering. Security awareness programs teach users to identify phishing, protect passwords, handle sensitive data, and report suspicious activity. Regular training, phishing simulations, and clear policies reduce human-layer risk.
Physical access control protects network infrastructure from physical threats: data centers with badge access, biometrics, mantrap entries (two-door airlocks), surveillance cameras, and locked network closets. Physical access to a device often bypasses all logical security — an attacker with physical access can reset passwords, capture traffic, or steal hardware.
Security policies define expected behavior, acceptable use, incident response procedures, and consequence for violations. Common policies: Acceptable Use Policy (AUP), password policy, data classification policy, incident response plan. Without documented policies, security controls lack context and enforcement authority.
Password policies and multi-factor authentication
Password policy elements: minimum length (12+ characters recommended), complexity (uppercase, lowercase, numbers, symbols), maximum age (require periodic changes), history (prevent reuse of recent passwords), lockout threshold (lock account after N failed attempts to resist brute force).
Multi-factor authentication (MFA) requires two or more authentication factors from different categories: Something you know (password, PIN), Something you have (security token, smartphone app, smart card), Something you are (fingerprint, face recognition, retina scan). MFA dramatically reduces the effectiveness of password attacks — even if a password is compromised, the attacker still needs the second factor.
Common MFA implementations: TOTP (Time-based One-Time Password) apps like Google Authenticator or Cisco Duo generate a 6-digit code that changes every 30 seconds. Hardware tokens (RSA SecurID) generate OTPs. SMS codes (less secure — SIM swapping is a known attack vector). Push notifications (Duo Security sends a push to the user's phone for approval).
Password managers allow users to use strong, unique passwords for every service without memorizing them — reducing credential reuse (the root cause of credential stuffing attacks). Enterprise PAM (Privileged Access Management) systems manage credentials for privileged accounts like network administrator logins.