Security Fundamentals
The building blocks. If you skip these, everything else falls apart. Read this page, understand it, then come back when you forget something.
The CIA Triad
Three properties that security protects:
- Confidentiality - Only authorized people can read the data. Encryption, access controls, need-to-know. When confidentiality fails: data breach, leaked passwords, exposed customer records.
- Integrity - Data has not been tampered with. Hashes, digital signatures, file monitoring. When integrity fails: altered financial records, modified logs, injected code.
- Availability - Systems and data are accessible when needed. Redundancy, backups, DDoS protection. When availability fails: ransomware lockout, DDoS takedown, power failure.
Every security control maps back to at least one of these. Every attack violates at least one.
Beyond CIA
The triad is the minimum. More complete frameworks add:
- Authentication - Proving who you are (passwords, MFA, certificates, biometrics)
- Authorization - What you are allowed to do (permissions, roles, ACLs)
- Non-repudiation - You cannot deny you did it (digital signatures, audit logs)
- Accountability - Actions can be traced to a person or system (logging, attribution)
Attack Types
Malware
Software designed to cause harm. Major categories:
- Virus - Attaches to legitimate programs, spreads when the program runs
- Worm - Self-replicating, spreads across networks without user action
- Trojan - Disguised as legitimate software, does something malicious in the background
- Ransomware - Encrypts files and demands payment for the decryption key
- Rootkit - Hides itself deep in the operating system, hard to detect
- Spyware - Secretly monitors activity and exfiltrates data
- Adware - Forces unwanted ads, often bundled with free software
Social Engineering
Attacking the human, not the machine:
- Phishing - Mass emails pretending to be a trusted source. Cast a wide net.
- Spear phishing - Targeted phishing aimed at a specific person, using their name, role, or company details.
- Whaling - Phishing aimed at executives (CEOs, CFOs).
- Vishing - Voice phishing over the phone.
- Smishing - SMS phishing.
- Pretexting - Creating a fake scenario to get information ("I am from IT, I need your password to fix your account").
- Baiting - Leaving something tempting for the victim to find (USB drive in the parking lot).
- Tailgating - Following someone through a secure door.
Web Attacks
- SQL Injection - Injecting SQL commands through user input. App runs your query on the database.
- Cross-Site Scripting (XSS) - Injecting JavaScript that runs in other users' browsers. Steals cookies, redirects to malicious sites.
- Server-Side Request Forgery (SSRF) - Making the server fetch a URL you control. Can reach internal services that are not exposed externally.
- Cross-Site Request Forgery (CSRF) - Forcing a logged-in user's browser to perform an action on a site they did not intend.
- Insecure Direct Object Reference (IDOR) - Accessing resources by guessing IDs.
/user/1becomes/user/2and you see someone else's data. - File Upload - Uploading a web shell disguised as an image. Server executes it.
- Command Injection - Injecting OS commands through user input. App runs your command on the server.
Network Attacks
- Man-in-the-Middle (MitM) - Intercepting traffic between two parties. Can read, modify, or inject data.
- Denial of Service (DoS/DDoS) - Overwhelming a service with traffic so legitimate users cannot access it.
- DNS Spoofing - Redirecting DNS queries to a malicious IP.
- ARP Spoofing - Sending fake ARP messages to link your MAC to another IP on the local network.
- Port Scanning - Probing ports to find open services (nmap).
Authentication and Authorization
Authentication Factors
Something you know, something you have, something you are:
- Single factor - Just a password. Weak. If the password leaks, the account is compromised.
- Two factor (2FA) - Password plus something else (OTP, SMS, authenticator app, hardware key). Stronger. Attacker needs both.
- Multi-factor (MFA) - Two or more factors. The standard for sensitive systems.
Password Security
- Salting - Adding a unique random value to each password before hashing. Prevents rainbow table attacks. If two users have the same password, their hashes are different.
- Hashing algorithms - bcrypt, scrypt, Argon2 are designed to be slow (resist brute force). MD5 and SHA-1 are fast and broken for password storage.
- Password policies - Length beats complexity. A 16-character passphrase is stronger than an 8-character mix of symbols. NIST SP 800-63B recommends minimum 8 characters, no forced rotation, check against known-breached password lists.
Authorization Models
- DAC (Discretionary Access Control) - Owner decides who gets access. Linux file permissions are DAC.
- MAC (Mandatory Access Control) - System policy decides. SELinux, AppArmor.
- RBAC (Role-Based Access Control) - Access based on job role. User is assigned a role, role has permissions.
- ABAC (Attribute-Based Access Control) - Access based on attributes (time, location, device, risk score). More flexible than RBAC.
Cryptography Basics
Symmetric Encryption
Same key for encryption and decryption. Fast. Good for bulk data.
- AES - The standard. AES-128, AES-256. Used everywhere.
- DES - Old, broken. Do not use.
- 3DES - DES applied three times. Deprecated, being phased out.
- ChaCha20 - Alternative to AES, used in mobile and TLS.
Problem: key distribution. How do you share the key securely with the other party?
Asymmetric Encryption
Key pair: public key encrypts, private key decrypts. Solves key distribution.
- RSA - The classic. 2048-bit minimum. Used for TLS, SSH, PGP.
- ECC (Elliptic Curve) - Same security as RSA with much smaller keys. Faster, less bandwidth. Used in mobile, IoT.
- Diffie-Hellman - Key exchange protocol. Two parties derive a shared secret over an insecure channel without ever sending it.
Problem: slow. Used to exchange a symmetric key, then symmetric encryption does the bulk work.
Hashing
One-way function. You cannot reverse a hash to get the original input. Used for integrity verification and password storage.
- SHA-256 - Part of SHA-2 family. Standard for integrity.
- SHA-3 - Different structure from SHA-2. Less common but no known weaknesses.
- MD5 - Broken, collisions found. Do not use for security.
- SHA-1 - Broken for collisions. Deprecated.
- bcrypt/Argon2 - Designed specifically for password hashing. Slow on purpose.
Digital Signatures
Sign with private key, verify with public key. Proves the message came from you and was not tampered with. Used in TLS certificates, code signing, PGP email.
Networking Fundamentals
OSI Model
| Layer | Name | Examples |
|---|---|---|
| 7. Application | User-facing protocols | HTTP, DNS, SSH, FTP, SMTP |
| 6. Presentation | Data format, encryption | TLS, JPEG, ASCII |
| 5. Session | Manage sessions | Sockets, RPC |
| 4. Transport | Reliable delivery | TCP, UDP |
| 3. Network | Routing between networks | IP, ICMP |
| 2. Data Link | Frame delivery on local network | Ethernet, ARP, MAC addresses |
| 1. Physical | Electrical signals | Cables, radio, fiber |
In practice, most security work happens at layers 3-7. You rarely deal with physical or data link layer attacks unless you are doing physical pentesting or WiFi hacking.
TCP vs UDP
- TCP - Connection-oriented. Three-way handshake (SYN, SYN-ACK, ACK). Reliable, ordered, stateful. Used by HTTP, SSH, FTP, SMTP.
- UDP - Connectionless. Fire and forget. Fast, no overhead, no guarantee of delivery. Used by DNS, DHCP, TFTP, streaming.
Common Ports
| Protocol | Port | Transport | Use |
|---|---|---|---|
| HTTP | 80 | TCP | Web traffic |
| HTTPS | 443 | TCP | Encrypted web traffic |
| SSH | 22 | TCP | Remote shell |
| FTP | 21 | TCP | File transfer control |
| FTP-DATA | 20 | TCP | File transfer data |
| SMB | 445 | TCP | Windows file sharing |
| RDP | 3389 | TCP | Windows remote desktop |
| DNS | 53 | UDP/TCP | Name resolution |
| SMTP | 25 | TCP | Email sending |
| SMTPS | 465 | TCP | Encrypted email sending |
| POP3 | 110 | TCP | Email receiving |
| IMAP | 143 | TCP | Email receiving |
| MySQL | 3306 | TCP | MySQL database |
| PostgreSQL | 5432 | TCP | PostgreSQL database |
| Redis | 6379 | TCP | In-memory cache |
| WinRM | 5985/5986 | TCP | Windows remote management |
| SNMP | 161 | UDP | Network management |
| NTP | 123 | UDP | Time synchronization |
| LDAP | 389 | TCP | Directory services |
| LDAPS | 636 | TCP | Encrypted directory services |
| Kerberos | 88 | TCP | Windows authentication |
| NetBIOS | 137-139 | TCP/UDP | Legacy Windows name resolution |
Key Security Principles
Defense in Depth
Multiple layers of security. If one fails, the next catches it. Firewall + patching + MFA + logging + backups. No single control is perfect.
Least Privilege
Give users and systems the minimum access they need to do their job. Nothing more. A web server does not need root. A marketing intern does not need Domain Admin.
Zero Trust
"Never trust, always verify." Do not assume traffic inside the network is safe. Authenticate and authorize every request, regardless of source. The old "castle and moat" model assumed the perimeter was secure and everything inside was trusted. Zero trust rejects that assumption.
Separation of Duties
No single person should have enough authority to both initiate and approve a critical action. The person who writes the check should not be the person who signs it.
Fail Secure
When a system fails, it should fail in a secure state. Default deny, not default allow. If the firewall crashes, block all traffic, not allow all traffic.