Security Fundamentals
HOUSE OF THE SHIELD
MODULE PROGRESS
0 / 5 Sections

Security Fundamentals

Master the foundational principles that underpin all cybersecurity practices. From the CIA Triad to cryptography, from authentication to network security - this comprehensive module covers the essential knowledge every security professional must possess. Build your shield from the ground up.

Module Contents

1

Core Security Principles

The foundational concepts that define information security

The CIA Triad: The Foundation of Security

Every security control, policy, and technology serves to protect one or more aspects of the CIA Triad. Understanding this model is essential for analyzing threats, designing defenses, and evaluating risk.

The CIA Triad
CONFIDENTIALITY INTEGRITY AVAILABILITY

Principle of Least Privilege

Users, processes, and systems should have only the minimum access rights necessary to perform their functions. This limits the damage from accidents, errors, or malicious actions.

Why It Matters: If a user account is compromised, the attacker can only access what that user had permission to access. If every user has admin rights, every compromise is a complete system takeover.

Implementation Strategies:

  • Regular access reviews and audits to remove unnecessary permissions
  • Just-in-time (JIT) access that grants elevated privileges only when needed
  • Separation of duties - no single user should have complete control
  • Default deny - start with no access, grant only what's necessary
  • Service accounts with minimal permissions for automated processes

Defense in Depth

Multiple layers of security controls throughout an IT system. If one layer fails, others continue to provide protection. Also known as "layered security" or the "castle approach."

Defense in Depth Layers
1

Physical Security

Locks, guards, access cards, surveillance cameras, secure facilities

2

Network Perimeter

Firewalls, IDS/IPS, DMZ, network segmentation, VPNs

3

Host Security

Antivirus, host-based firewalls, EDR, patch management

4

Application Security

Input validation, secure coding, WAF, application firewalls

5

Data Security

Encryption, DLP, access controls, data classification

6

Policies & Procedures

Security awareness training, incident response plans, acceptable use policies

Key Principle: No single security control is perfect. By implementing multiple layers, you ensure that even if an attacker breaches one layer, they still face additional obstacles. This dramatically increases the cost and difficulty of a successful attack.
2

Threats & Risks

Understanding and assessing security threats and vulnerabilities

Understanding the Threat Landscape

Before you can defend against threats, you must understand what they are and how they differ from related concepts. These terms are often confused, but each has a specific meaning in security.

Threat
Any circumstance or event with the potential to adversely impact an asset through unauthorized access, destruction, disclosure, modification, or denial of service. Examples: hackers, malware, natural disasters, insider threats.
Click to reveal
Vulnerability
A weakness in a system, application, or process that could be exploited by a threat. Examples: unpatched software, weak passwords, misconfigured firewalls, missing encryption, poor physical security.
Click to reveal
Exploit
A method or technique used to take advantage of a vulnerability. Could be code (like an exploit kit), a procedure (like phishing), or a physical action (like tailgating into a secure facility).
Click to reveal
Risk
The likelihood that a threat will exploit a vulnerability, combined with the potential impact if it does. Risk = Threat × Vulnerability × Impact. It's what we're actually trying to manage in security.
Click to reveal
The Relationship: A threat actor (hacker) identifies a vulnerability (unpatched web server). They use an exploit (publicly available code) to attack the system. The risk is determined by how likely this is to happen and how much damage it would cause.

Risk Assessment Basics

Risk assessment is the process of identifying, analyzing, and evaluating risks to determine appropriate security controls. It answers three fundamental questions:

1. What can go wrong?

  • Identify assets (data, systems, people)
  • Identify threats to those assets
  • Identify vulnerabilities that could be exploited

2. How likely is it?

  • Probability of threat occurrence
  • Ease of exploiting vulnerabilities
  • Threat actor motivation and capability

3. What are the consequences?

  • Financial impact (losses, fines, recovery costs)
  • Operational impact (downtime, lost productivity)
  • Reputational impact (customer trust, brand damage)

Risk Assessment Methodologies:

Methodology Approach Best For
Qualitative Uses descriptive scales (High/Medium/Low) based on expert judgment Quick assessments, limited data, strategic planning
Quantitative Uses numerical values and statistical analysis (ALE, SLE, ARO) Financial justification, detailed analysis, comparing options
Semi-Quantitative Combines descriptive scales with numerical ranges Balancing precision with practicality

Key Quantitative Terms:

  • Asset Value (AV): The monetary value of an asset
  • Exposure Factor (EF): Percentage of asset value lost in an incident (0-100%)
  • Single Loss Expectancy (SLE): Expected loss from one incident (AV × EF)
  • Annual Rate of Occurrence (ARO): Expected frequency of incident per year
  • Annual Loss Expectancy (ALE): Expected annual loss (SLE × ARO)
Example Calculation: A server worth $50,000 (AV) has a vulnerability. If exploited, it would cause 60% damage (EF). This threat occurs approximately twice per year (ARO).

SLE = $50,000 × 0.60 = $30,000
ALE = $30,000 × 2 = $60,000

You can justify spending up to $60,000/year on controls to mitigate this risk.

Impact Analysis

Understanding the potential consequences of a security incident is crucial for prioritizing resources and planning responses.

Types of Impact:

Financial Impact

  • Direct losses (stolen funds, ransomware payments)
  • Recovery costs (forensics, remediation)
  • Regulatory fines (GDPR, HIPAA violations)
  • Legal costs (lawsuits, settlements)

Operational Impact

  • System downtime and unavailability
  • Lost productivity
  • Service disruption to customers
  • Supply chain interruptions

Reputational Impact

  • Loss of customer trust
  • Negative media coverage
  • Brand damage
  • Competitive disadvantage

Strategic Impact

  • Loss of intellectual property
  • Competitive intelligence leaked
  • Strategic advantage to competitors
  • Market position erosion
Impact Timeframes: Consider both immediate impacts (system down right now) and long-term impacts (customer trust eroded over months). Some of the most serious consequences don't show up until weeks or months after an incident.
3

Authentication & Access Control

Verifying identity and controlling resource access

Authentication: Proving Who You Are

Authentication is the process of verifying the identity of a user, process, or device before allowing access to resources. It answers the question: "Are you who you claim to be?"

The Three Factors of Authentication

Authentication methods are categorized based on what type of credential they require:

Something You Know

  • Passwords and passphrases
  • PINs (Personal Identification Numbers)
  • Security questions
  • Pattern locks
Weakness: Can be forgotten, guessed, or stolen through phishing/keylogging.

Something You Have

  • Smart cards and access badges
  • Hardware tokens (YubiKey, RSA SecurID)
  • Mobile phone (for SMS or app-based codes)
  • Cryptographic certificates
Weakness: Can be lost, stolen, or duplicated.

Something You Are

  • Fingerprint recognition
  • Facial recognition
  • Iris or retina scans
  • Voice recognition
Weakness: Can't be changed if compromised, potential for false positives/negatives.

Multi-Factor Authentication (MFA)

Using two or more authentication factors from different categories significantly increases security. Even if one factor is compromised, the attacker still can't gain access without the other factor(s).

Why MFA Matters: Studies show MFA blocks 99.9% of automated attacks. Even simple SMS-based MFA is vastly better than passwords alone. App-based or hardware token MFA is even more secure.

Common MFA Implementations:

Method How It Works Security Level
SMS Codes One-time code sent via text message Low - vulnerable to SIM swapping, interception
Authenticator Apps TOTP codes generated on your device (Google Authenticator, Authy) Medium - better than SMS, offline capable
Hardware Tokens Physical device that generates codes or uses cryptographic keys (YubiKey, Titan) High - phishing resistant, requires physical possession
Biometric + PIN Fingerprint/face scan combined with device PIN Medium-High - convenient and reasonably secure
Push Notifications Approve login from trusted device (Duo, Microsoft Authenticator) Medium - vulnerable to MFA fatigue attacks

Password Policies

Modern password policies have evolved based on research showing what actually improves security versus what just frustrates users without adding protection.

Modern Best Practices (NIST Guidelines):

  • Length over Complexity: Minimum 8 characters (12+ recommended), but no maximum limit
  • No Forced Complexity: Don't require special characters if passwords are long enough
  • No Periodic Changes: Only require password changes when compromise is suspected
  • Check Against Breach Databases: Reject passwords that appear in known breach lists
  • Allow Passphrases: "correct horse battery staple" is stronger than "P@ssw0rd1"
  • Enable Password Managers: Don't block paste functionality - it encourages unique passwords
  • Implement Account Lockout: But with caution to avoid DoS attacks
The Passphrase Advantage: "ILove2EatPizzaOnFridays!" is 25 characters, easy to remember, and would take trillions of years to brute force. "P@s5w0rd" meets complexity requirements but could be cracked in seconds.

Access Control Models

Once authenticated, users need authorization - determining what resources they can access and what actions they can perform.

4

Cryptography Basics

The mathematics of securing information

Introduction to Cryptography

Cryptography is the practice and study of techniques for secure communication in the presence of adversaries. It provides the mathematical foundation for confidentiality, integrity, authentication, and non-repudiation.

Symmetric Encryption

Uses the same key for both encryption and decryption. Like a physical key that both locks and unlocks a door.

How It Works

  • Sender and receiver share a secret key
  • Plaintext + Key = Ciphertext (encryption)
  • Ciphertext + Same Key = Plaintext (decryption)
  • Very fast and efficient

Common Algorithms

  • AES (Advanced Encryption Standard) - most widely used
  • ChaCha20 - modern, fast alternative to AES
  • 3DES - legacy, being phased out
  • Blowfish/Twofish - older alternatives
The Key Distribution Problem: How do you securely share the secret key with someone you've never met? If you can securely share a key, why not just use that secure channel to share your message? This is the fundamental challenge of symmetric encryption.

Use Cases for Symmetric Encryption:

  • Full disk encryption (BitLocker, FileVault)
  • Database encryption
  • VPN tunnels (after key exchange)
  • File/folder encryption
  • Bulk data encryption (when keys are already shared)

Asymmetric Encryption

Uses a pair of mathematically related keys: a public key (shared openly) and a private key (kept secret). What one key encrypts, only the other can decrypt.

How It Works

  • Generate a key pair (public + private)
  • Share public key openly
  • Keep private key secret
  • Encrypt with public, decrypt with private (confidentiality)
  • Sign with private, verify with public (authentication)

Common Algorithms

  • RSA - most widely used, key sizes 2048-4096 bits
  • Elliptic Curve (ECC) - smaller keys, same security
  • Diffie-Hellman - key exchange protocol
  • ElGamal - alternative to RSA
Solving Key Distribution: Alice wants to send Bob a secret message. Bob generates a key pair and publishes his public key. Alice encrypts her message with Bob's public key. Only Bob's private key can decrypt it. No need to pre-share a secret!

Trade-offs:

Aspect Symmetric Asymmetric
Speed Very fast (1000x+ faster) Slow (computationally expensive)
Key Distribution Difficult - requires secure channel Easy - public keys can be shared openly
Key Size Small (128-256 bits) Large (2048-4096 bits for RSA)
Use Cases Bulk data encryption Key exchange, digital signatures, small messages
Hybrid Approach (Best of Both): Most real-world systems use both! Use asymmetric encryption to securely exchange a symmetric session key, then use that symmetric key for fast bulk encryption. This is how TLS/SSL works.

Hashing Algorithms

A hash function takes input data of any size and produces a fixed-size output (the hash or digest). It's a one-way function - you can't reverse it to get the original data.

Properties of Cryptographic Hashes:

  • Deterministic: Same input always produces same output
  • Fixed Output Size: SHA-256 always produces 256 bits, regardless of input size
  • One-Way: Computationally infeasible to reverse (find input from hash)
  • Collision Resistant: Extremely difficult to find two different inputs with same hash
  • Avalanche Effect: Tiny change in input drastically changes output

Common Hash Algorithms:

Algorithm Output Size Status
MD5 128 bits Broken - collisions found, don't use for security
SHA-1 160 bits Deprecated - collisions found in 2017
SHA-256 256 bits Secure - widely used, recommended
SHA-3 Various (224-512 bits) Secure - newest standard, different design than SHA-2
bcrypt/scrypt/Argon2 Various Secure - designed specifically for password hashing

Use Cases for Hashing:

  • Data Integrity: Verify files haven't been modified (checksums)
  • Password Storage: Store hash of password, not the password itself
  • Digital Signatures: Hash the message, sign the hash (faster than signing entire message)
  • Blockchain: Each block contains hash of previous block
  • File Deduplication: Identify duplicate files by comparing hashes
  • Message Authentication Codes (HMAC): Hash + secret key for integrity + authentication
Password Hashing: Never use fast hashes like SHA-256 for passwords! Attackers can compute billions of hashes per second. Use specialized algorithms like bcrypt, scrypt, or Argon2 that are intentionally slow and memory-hard.

Digital Certificates and PKI

Public Key Infrastructure (PKI) solves a critical problem: How do you know a public key actually belongs to who it claims to?

The Trust Problem:

Man-in-the-Middle Risk: Without verification, an attacker could intercept your connection and substitute their own public key. You'd encrypt messages with the attacker's key, thinking it's your intended recipient's key.

How PKI Works:

  • Certificate Authority (CA): Trusted third party that issues digital certificates
  • Digital Certificate: Document binding a public key to an identity (person, organization, website)
  • Certificate Signing: CA signs the certificate with their private key
  • Verification: Anyone can verify certificate authenticity using CA's public key
  • Chain of Trust: Root CAs certify intermediate CAs, which certify end entities

X.509 Certificate Contents:

  • Subject (who the certificate belongs to)
  • Public key
  • Issuer (which CA signed it)
  • Validity period (not before / not after dates)
  • Serial number
  • Digital signature (CA's signature on all the above)
Real-World Example - HTTPS: When you visit https://bank.com, your browser: (1) Receives the website's certificate, (2) Verifies it was signed by a trusted CA, (3) Checks it hasn't expired, (4) Confirms the domain matches, (5) Uses the public key from the certificate to establish encrypted communication.

Certificate Revocation:

What if a private key is compromised? The certificate needs to be revoked before expiration:

  • CRL (Certificate Revocation List): Published list of revoked certificates (slow, doesn't scale)
  • OCSP (Online Certificate Status Protocol): Real-time check if certificate is valid (better, but privacy concerns)
  • OCSP Stapling: Server provides OCSP response (best - fast and private)
5

Network Security

Protecting data in transit and defending network perimeters

Firewalls: The First Line of Defense

A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between trusted and untrusted networks.

Types of Firewalls:

Firewall Rule Best Practices:

  • Default Deny: Block everything by default, explicitly allow only what's needed
  • Least Privilege: Open only the minimum ports and protocols required
  • Order Matters: Rules processed top-to-bottom; most specific first, default deny last
  • Regular Review: Audit rules quarterly, remove outdated or redundant rules
  • Document Rules: Include comments explaining why each rule exists
  • Log and Monitor: Enable logging for denied traffic and suspicious patterns

Network Segmentation and Isolation

Dividing a network into smaller segments to limit the spread of attacks and contain breaches. "Don't put all your eggs in one basket."

Segmentation Strategies:

DMZ (Demilitarized Zone)

  • Buffer network between internet and internal network
  • Public-facing services (web, email, DNS)
  • If compromised, attacker still outside internal network
  • Dual firewall setup: external and internal

VLANs (Virtual LANs)

  • Logical network segmentation at Layer 2
  • Separate HR, Finance, Engineering, Guest networks
  • Traffic between VLANs must go through router/firewall
  • Cost-effective - no need for separate physical switches

Zero Trust Network

  • "Never trust, always verify"
  • Assume breach - verify every access attempt
  • Micro-segmentation - minimal trust zones
  • Identity-based access, regardless of network location
Why Segmentation Matters: In the Target breach (2013), attackers compromised an HVAC vendor's credentials. Because the network wasn't properly segmented, they moved laterally from the HVAC network to payment systems, stealing 40 million credit cards. Proper segmentation would have contained the breach.

Secure Network Protocols

Many legacy protocols transmit data in cleartext. Modern security requires encrypted alternatives.

Protocol Evolution:

Legacy (Insecure) Modern (Secure) What Changed
HTTP (port 80) HTTPS (port 443) TLS encryption, server authentication
FTP (ports 20, 21) SFTP (port 22) or FTPS SSH tunnel (SFTP) or TLS encryption (FTPS)
Telnet (port 23) SSH (port 22) Encrypted terminal sessions, key-based auth
SMTP (port 25) SMTP with STARTTLS (587) Opportunistic TLS encryption
SNMP v1/v2 SNMP v3 Authentication and encryption
POP3/IMAP (110, 143) POP3S/IMAPS (995, 993) TLS encryption for email retrieval

TLS/SSL: The Foundation of Secure Communications

Transport Layer Security (TLS) is the protocol that secures most internet communications. SSL is the deprecated predecessor.

TLS Handshake Process:

  1. Client Hello: Client sends supported cipher suites, TLS version
  2. Server Hello: Server chooses cipher suite, sends certificate
  3. Certificate Verification: Client validates server certificate
  4. Key Exchange: Client and server establish shared session key (using asymmetric crypto)
  5. Secure Communication: All subsequent traffic encrypted with session key (symmetric crypto)
Version Matters: TLS 1.0 and 1.1 are deprecated (vulnerable). TLS 1.2 is minimum acceptable. TLS 1.3 is current best practice (faster, more secure, removed weak cipher suites).

IPsec: Network Layer Security

IPsec operates at the Network Layer (Layer 3), securing IP packets themselves. Commonly used for VPNs and site-to-site connections.

IPsec Modes:

  • Transport Mode: Encrypts only the payload, not the IP header. Used for end-to-end communication.
  • Tunnel Mode: Encrypts entire IP packet, encapsulates in new packet. Used for VPNs.

IPsec Protocols:

  • AH (Authentication Header): Provides authentication and integrity, but not confidentiality
  • ESP (Encapsulating Security Payload): Provides authentication, integrity, and confidentiality (most common)
  • IKE (Internet Key Exchange): Protocol for negotiating and establishing IPsec connections
VPN Use Case: Remote employee connects to corporate network via IPsec VPN. All traffic is encrypted (confidentiality), authenticated (no impersonation), and integrity-protected (no tampering). From the employee's perspective, they're "inside" the corporate network.

Test Your Knowledge

Put your security fundamentals knowledge to the test with this comprehensive 15-question quiz. Each question covers key concepts from the module. You need 80% (12/15) to pass.

Course Home