CIA, Non-repudiation, AAA, and Gap Analysis
Unit 1: Security Foundations. Lesson 2 of 54 in SecPlus Academy.
Every security control serves one of three goals, and every identity question comes back to three A's. Learn the words precisely; the exam uses them precisely.
The CIA triad
- Confidentiality: only authorized people see the data. Controls: encryption, access controls, data classification.
- Integrity: data is not changed without detection. Controls: hashing, digital signatures, change management, file integrity monitoring.
- Availability: systems stay reachable when needed. Controls: redundancy, backups, load balancing, DDoS protection.
A question that mentions "unauthorized disclosure" is about confidentiality; "tampered" or "altered" is integrity; "down" or "unreachable" is availability.
Non-repudiation
The sender cannot later deny sending. Achieved with digital signatures: only the holder of the private key could have signed, so the signature ties the message to that identity. Logs and audit trails support it for actions inside systems.
AAA
- Authentication proves an identity. People authenticate with passwords, tokens, and biometrics. Systems authenticate too: a device presents a certificate for 802.1X, a server presents a TLS certificate.
- Authorization decides what an authenticated identity may do. The models (mandatory, discretionary, role-based, attribute-based) have their own lesson.
- Accounting records what was done: logs, session records, audit trails.
The exam splits this into authenticating people, authenticating systems (devices and services proving who they are), and authorization models that decide what each may do.
Gap analysis
Compare where security is now against where it should be, usually against a framework, regulation, or the organization's own policy. The output is a list of gaps, each with an owner and a plan. It is the first step before a security program, an audit, or a compliance effort.
CIA, Non-repudiation, AAA, and Gap Analysis, explained slowly
Three goals, three A's, one comparison
Everything in security serves confidentiality, integrity, or availability. Everything about identity is authentication, authorization, or accounting. And every security program begins by comparing where you are to where you should be. This lesson is vocabulary, but the exam uses it in every domain, so get it exact.
CIA with the control that proves it
Goal Threat it defeats Controls that deliver it Confidentiality disclosure, snooping encryption, access control, classification, masking Integrity tampering, corruption hashing, digital signatures, change management, file integrity monitoring Availability outage, destruction redundancy, backups, load balancing, DDoS protection, UPS
Reading a question: the word "disclosed" or "read by" points to confidentiality; "altered," "modified," or "tampered" points to integrity; "unavailable," "down," or "destroyed" points to availability. Ransomware is interesting: it attacks availability (you cannot reach your files) and, if data is also stolen, confidentiality.
Non-repudiation
Repudiation is denial: "I never sent that order." Non-repudiation makes the denial impossible to sustain. A digital signature does it: the signature could only have been created with the sender's private key, so the sender cannot claim someone else sent it. Audit logs give a weaker form for actions inside systems. Note what a signature does not do: it does not hide the message. Confidentiality needs encryption on top.
AAA, in order
Authentication WHO are you? password, token, biometric; a device's certificate Authorization WHAT may you do? permissions, roles, policies Accounting WHAT did you do? logs, audit trails, session records
Authentication always comes first; you cannot authorize an identity you have not verified. And it applies to systems, not just people. A laptop proves itself to the network switch with a certificate through 802.1X. A website proves itself to your browser with a TLS certificate. When a question says "authenticating devices," think certificates.
Gap analysis
A gap analysis is a structured comparison:
- Pick the target: a framework, a regulation, a contract, or your own policy.
- Document the current state, control by control.
- Record each place where the current state falls short.
- Assign an owner and a plan to each gap, prioritized by risk.
It comes first, before spending, because it tells you where the spending matters. Questions describe "comparing current controls to a required standard" or "identifying what is missing before an audit."
How the exam asks it
- "Which principle ensures data has not been altered?" Integrity.
- "Which control provides non-repudiation?" Digital signatures.
- "Which AAA element records user actions?" Accounting.
- "What is performed to determine which requirements are not yet met?" Gap analysis.
What to memorize
- Confidentiality hides, integrity detects change, availability keeps it reachable.
- Signature gives integrity plus non-repudiation, never confidentiality.
- Authenticate, then authorize, then account.