The CIA Triad is the foundation of information security, consisting of three core principles:

• Confidentiality: Ensuring information is accessible only to authorized individuals. This prevents unauthorized disclosure of sensitive data through encryption, access controls, and proper authentication.

• Integrity: Maintaining the accuracy and completeness of data throughout its lifecycle. This ensures data hasn't been tampered with or corrupted, using techniques like checksums, digital signatures, and version controls.

• Availability: Ensuring systems and data are accessible when needed by authorized users. This involves preventing denial-of-service attacks, maintaining redundancy, and having disaster recovery plans.

These principles guide security decisions and help organizations prioritize protection measures. For example, a banking system needs high confidentiality for account data, integrity for transaction records, and availability for customer access.

AAA represents three distinct security processes:

Authentication ("Who are you?"): Verifies the identity of a user or system. Common methods include passwords, biometrics, smart cards, or multi-factor authentication. The system confirms you are who you claim to be.

Authorization ("What can you do?"): Determines what resources or actions an authenticated user is permitted to access. This is based on roles, permissions, and access control lists. Even after proving identity, users only get access to what they're authorized for.

Accounting/Auditing ("What did you do?"): Tracks and logs user activities for monitoring, billing, or forensic purposes. This creates an audit trail of who accessed what resources and when.

Example: When logging into a corporate network, you authenticate with username/password, get authorized access to specific files based on your role, and your activities are logged for security monitoring.

The principle of least privilege states that users, applications, and systems should only have the minimum level of access necessary to perform their intended functions. This reduces the attack surface and limits potential damage from compromised accounts.

Implementation strategies:

• Role-based access control (RBAC): Assign permissions based on job functions
• Just-in-time access: Temporary elevation of privileges when needed
• Regular access reviews: Periodic audits to remove unnecessary permissions
• Separation of duties: Split critical functions across multiple people
• Default deny policies: Start with no access and explicitly grant what's needed

Example: A database administrator might have read-write access to development databases but only read access to production databases, with write access granted temporarily through an approval process when maintenance is required.

Multi-factor authentication requires two or more different types of credentials to verify identity, significantly improving security over single-factor authentication.

Three authentication factors:

1. Something you know: Passwords, PINs, security questions
2. Something you have: Smart cards, tokens, mobile phones, hardware keys
3. Something you are: Biometrics (fingerprints, retina scans, voice recognition)

Common MFA implementations:

• SMS/Email codes: Time-sensitive codes sent to registered devices
• Authenticator apps: TOTP (Time-based One-Time Password) generators like Google Authenticator
• Hardware tokens: Physical devices generating codes or using cryptographic keys
• Biometric + password: Fingerprint readers combined with traditional passwords
• Push notifications: Mobile app confirmations

MFA dramatically reduces successful attacks even when passwords are compromised, as attackers would need access to multiple authentication factors.

Firewalls are network security devices that monitor and control incoming and outgoing network traffic based on predetermined security rules. They act as barriers between trusted internal networks and untrusted external networks.

Types of firewalls:

Packet filtering firewalls: Examine individual packets and allow/deny based on source/destination IP, ports, and protocols. Fast but limited in functionality.

Stateful inspection firewalls: Track connection states and make decisions based on traffic context. They remember established connections and allow related return traffic.

Application layer firewalls (Proxy firewalls): Operate at the application layer, inspecting the actual content of communications. Can block specific applications or content types.

Next-generation firewalls (NGFW): Combine traditional firewall capabilities with additional features like intrusion prevention, application awareness, and deep packet inspection.

Web application firewalls (WAF): Specifically designed to protect web applications from attacks like SQL injection and cross-site scripting.

Firewalls use rule sets to determine actions (allow, deny, log) and are typically configured with a default-deny policy for maximum security.

A Virtual Private Network (VPN) creates a secure, encrypted connection over a public network (typically the internet), allowing users to access private networks remotely as if they were directly connected.

Security mechanisms:

Encryption: VPNs encrypt all data transmitted through the tunnel, making it unreadable to interceptors. Common protocols include AES-256 encryption.

Tunneling: Creates a secure "tunnel" through the public internet, encapsulating private network traffic within encrypted packets.

Authentication: Verifies user and device identity before establishing connections, often using certificates, pre-shared keys, or multi-factor authentication.

Data integrity: Ensures transmitted data hasn't been tampered with during transit using cryptographic hashes.

Common VPN types:

• Site-to-site VPN: Connects entire networks (branch offices to headquarters)
• Remote access VPN: Allows individual users to connect to corporate networks
• Client-to-site VPN: Personal VPN services for privacy and bypassing geo-restrictions

Protocols: IPSec, SSL/TLS, PPTP, L2TP, WireGuard, each offering different security levels and performance characteristics.