Information Security Fundamentals

Explore the CIA triad—confidentiality, integrity, and availability—and how encryption and access controls protect data across storage, transit, and processing.

Explore key information security concepts beyond the CIA triad, including sensitivity, concealment, secrecy, privacy, isolation, and non-repudiation. Understand usability, accountability, accessibility, discretion, and criticality to strengthen policy and audits.

Learn how authentication proves who you are and authorization determines what you may access, illustrated by data center ID cards, PINs, and access controls.

Explore the basics of cryptography, including plaintext, encryption, ciphertext, and decryption. Learn symmetric and asymmetric keys, with public and private keys, and see Caesar cipher as a historical example.

Differentiate risk, threat, and vulnerability, and learn how threats and vulnerabilities drive cyber risk. Apply threat assessments, penetration testing, and vulnerability management to reduce risk and protect assets.

Security governance, defined by NIST, builds a framework to align information security with business objectives and laws while assigning responsibility across leadership and staff.

Explore the role of security policies as living, clear documents that govern access to information systems; distinguish policies from procedures and learn to monitor, enforce, and update them.

Conduct a security audit to review an organization’s IT infrastructure, policies, procedures, and compliance with privacy laws and regulations. Identify vulnerabilities and report remediation steps through a third party audit.

Engage in ongoing security risk management by identifying risks, evaluating them against data value and countermeasure costs, and implementing cost-effective plans to reduce risk and support the organization's mission.

Define data privacy as information privacy and describe the global landscape of sector-specific laws, noting no single comprehensive law. Stay up to date, ensure compliance, and adopt third-party certifications.

Integrate security into the software development life cycle, apply OWASP Top 10 guidance, and enforce secure design, secure coding, and post deployment maintenance.

Explore the fundamentals of hacking and common cyber threats, including motives like data theft and reputation damage, and learn about key attacks and the OWASP Top Ten.

Discover how phishing uses social engineering to steal credentials and deploy malware through fake emails and landing pages, including AD credentials and single sign-on in targeted and mass campaigns.

Understand how denial of service attacks disrupt legitimate activity through DoS and DDoS, using botnets to flood networks and exploit OS, software, or protocol flaws.

Identify viruses, worms, and malware by definitions and behaviors; learn how viruses attach to software, worms spread through networks, trojan horses steal information, and ransomware and spyware fit into malware.

Explore SQL injection, an input validation attack where injected SQL queries via user input can read, modify, or delete data, or execute administration tasks.