Security Fundamentals

Week of 2026-09-15 · Download .docx

Objectives

Explain authentication types and the principle of least privilege.
Describe cryptographic concepts including symmetric vs. asymmetric encryption, hashing, and PKI.
Identify network security controls including firewalls, IDS/IPS, SIEM, and VLANs.
Recognize common threats including phishing, malware, social engineering, and zero-day exploits.

Key terms

MFA: Multi-Factor Authentication — requires two or more distinct factor categories to authenticate.
Least privilege: Security principle: grant users only the minimum permissions needed for their job.
Symmetric encryption: Same secret key used for both encrypting and decrypting data (e.g., AES-256).
Asymmetric encryption: Public/private key pair: public encrypts, private decrypts (e.g., RSA).
SHA-256: Secure Hash Algorithm 256 — produces a fixed 256-bit one-way digest of any input.
TLS: Transport Layer Security — encrypts data in transit between browser and server (HTTPS).
Digital signature: Hash of a message encrypted with the sender's private key; proves authenticity and integrity.
PKI: Public Key Infrastructure — system of CAs, certificates, and policies governing digital trust.
Phishing: Deceptive email or message that tricks users into revealing credentials or installing malware.
Worm: Self-replicating malware that spreads across networks without any user action.
DDoS: Distributed Denial of Service — floods a target using a botnet to exhaust its resources.
Zero-day: Vulnerability actively exploited before a vendor patch has been released.
Stateful firewall: Tracks connection state; automatically permits return traffic for established sessions.
SIEM: Security Information and Event Management — aggregates and correlates logs from multiple sources.
VLAN: Virtual LAN — logical Layer 2 segmentation of a switch into separate broadcast domains.

The concept

Security is the practice of protecting the confidentiality, integrity, and availability (CIA) of information and systems. It is implemented in overlapping layers — no single control is sufficient.

Authentication verifies identity using one or more factors: something you know (password, PIN), something you have (smart card, OTP token), or something you are (fingerprint, face scan). Multi-factor authentication (MFA) requires at least two different categories. Lockout policies limit brute-force attempts. The principle of least privilege limits the damage from any single compromised account by ensuring users have no more access than their role requires.

Cryptography protects data confidentiality and integrity. Symmetric encryption (AES-256) uses one shared key — fast, but the key distribution problem means both parties need the same secret. Asymmetric encryption (RSA) uses mathematically linked key pairs: you encrypt a message with the recipient's public key; only their private key can decrypt it. TLS uses asymmetric encryption to negotiate a session key, then switches to symmetric encryption for bulk data transfer — getting the benefits of both.

Hashing produces a fixed-length digest from any input. SHA-256 generates a 256-bit digest; even a one-bit change in the input produces a completely different hash. Hashes are one-way: you cannot recover the original data from a hash. Digital signatures combine hashing and asymmetric cryptography: the sender hashes the message and encrypts the hash with their private key. Anyone with the sender's public key can verify the signature, confirming who signed it and that the message was not altered.

Network security controls operate in layers. Firewalls permit or deny traffic based on IP address, port, and protocol. Stateful firewalls track connection state, automatically allowing return traffic for sessions the internal host initiated. IPS (Intrusion Prevention System) is deployed inline and can block malicious traffic in real time; IDS only alerts. A SIEM correlates log data from firewalls, servers, and endpoints to detect patterns that suggest an attack in progress. VLANs segment a switched network into isolated broadcast domains, reducing lateral movement if an attacker compromises a device.

Threat awareness is critical. Phishing is the most common initial-access technique — a deceptive email tricks users into clicking a link or opening a malicious attachment. Worms self-replicate across networks without user interaction. A zero-day is actively exploited before a patch exists. Social engineering manipulates people rather than technology. The MITRE ATT&CK framework catalogs real-world adversary tactics and techniques, giving defenders a common language for describing attacks.

Worked examples

Example 1: A user receives an email appearing to be from IT asking them to click a link and reset their password. The link goes to a convincing fake login page. Before typing credentials, the user checks the URL — it is 'corp-it-support.net' not 'corp.com'. They report it to the security team who confirm it is a phishing attack. This is why employees are trained to verify URLs and use MFA so a stolen password alone is insufficient.

Example 2: An organization needs to segment its guest Wi-Fi from its internal corporate network. The network admin creates two VLANs on the same physical switch: VLAN 10 for corporate devices and VLAN 20 for guests. Devices in VLAN 20 can only reach the internet; they cannot reach any VLAN 10 devices because the Layer 3 ACL on the router blocks inter-VLAN traffic between them.

Common mistakes

Using the same password for multiple accounts — a single breach exposes all of them.
Confusing MFA with two passwords — both must be from different factor categories (know/have/are).
Thinking SHA-256 is an encryption algorithm — it is a one-way hash; encrypted data can be decrypted, hashes cannot be reversed.
Assuming IDS and IPS are the same — IPS is inline and can block; IDS is passive and only alerts.
Treating VLANs as a complete security boundary — inter-VLAN traffic must be controlled by ACLs at the Layer 3 device.

Self-check

Try each one before you look. A miss here costs nothing and tells you exactly what to reread.

1. Which encryption standard uses the same key for both encryption and decryption?

2. What is the primary function of TLS?

3. A zero-day vulnerability is:

4. Which device blocks malicious traffic inline rather than only alerting?

5. The principle of least privilege means:

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top