Core principles: CIA, AAA, least privilege and Zero Trust
This unit covers the ideas the rest of the course builds on: what security protects, the kinds of controls that protect it, how changes are kept safe, and the cryptography and certificates that secure hardware, applications and network services. On the V8 exam (SY0-801) this domain is 16% of the questions.
Version note: V7 (SY0-701) uses the same domain name and weights it at 12%. V7 also puts physical security, deception technology and gap analysis in this domain. V8 moves deception technology to Security operations and gap analysis to audits, and it tests physical security through threat vectors and attacks. Everything in this lesson is on both versions.
Every security decision protects at least one of three properties, known as the CIA triad.
| Property | What it means | Example threat | Example controls |
|---|---|---|---|
| Confidentiality | Only authorized people and systems can read the data. | An attacker copies a customer database. | Encryption, access control, MFA |
| Integrity | Data and systems are changed only by authorized parties, and unauthorized changes can be detected. | Someone alters a payment amount in transit. | Hashing, digital signatures, file integrity monitoring |
| Availability | Systems and data work when people need them. | A DDoS attack takes the patient portal offline. | Redundancy, backups, DDoS protection, patching |
Non-repudiation adds one more idea: proof that a specific person or system took an action, strong enough that they cannot credibly deny it. A digital signature gives non-repudiation because only the holder of the private key could have produced it. A shared team password does not, because anyone who knows it could have acted.
AAA describes how access works. Authentication proves an identity, for example a password plus a code from an authenticator app. Authorization decides what that identity may do, for example read-only access to one department's folder. Accounting records what was done, for example a log entry for every patient chart opened. Identification, such as typing a username or tapping a badge, comes first: it is the claim that authentication then proves. Devices and services authenticate too, often with certificates.
Defense in depth means layering controls so that one failure does not expose everything. A stolen laptop, for example, still faces full-disk encryption, a sign-in that needs MFA, a user account without local admin rights, remote wipe through device management, and monitoring that flags unusual sign-ins.
Least privilege means each user, service account and device gets only the access its job needs, for only as long as it needs it. It limits the damage a stolen account or a mistake can do, and it is the idea behind role-based access, temporary admin rights and network segmentation.
Zero Trust drops the old assumption that anything inside the company network can be trusted. Every request is authenticated and authorized using identity, device health and context, and trust is checked again throughout the session. Being on the office Wi-Fi earns nothing by itself.
| Zero Trust part | Plane | Role |
|---|---|---|
| Policy engine | Control | Decides whether to grant access, using policy plus signals such as identity, device posture and threat intelligence. |
| Policy administrator | Control | Carries out the decision: starts or ends the session and issues the token or credential. |
| Policy enforcement point (PEP) | Data | The gate in the traffic path that allows, monitors or ends the connection. |
| Subject or system | Data | The user, device or application asking for access. |
| Implicit trust zone | Data | The area behind the PEP where traffic is trusted. Zero Trust keeps it as small as possible. |
Three more Zero Trust terms appear in the objectives. Adaptive identity adjusts the checks to the risk, for example asking for MFA again when a sign-in comes from a new country. Threat scope reduction limits how much any one identity can reach. Policy-driven access control means access follows written policy rather than network location.
The control plane decides; the data plane carries the traffic and enforces the decision.
Many questions hinge on which CIA property is at risk. Encryption protects confidentiality, hashing protects integrity, and redundancy and backups protect availability. Ransomware that locks files is first an availability problem; if the attackers also copied the files, it is a confidentiality problem too.
Word bank
All definitions →- AAA
- Authentication (prove identity), authorization (grant permissions) and accounting (record activity).
- CIA triad
- Confidentiality, integrity and availability: the three properties security protects.
- Defense in depth
- Layered controls, so one failure does not expose the whole system.
- Least privilege
- Only the access a job needs, for only as long as it is needed.
- Non-repudiation
- Proof that a specific party performed an action, so they cannot credibly deny it.
- Policy enforcement point
- The Zero Trust component in the traffic path that allows or blocks a connection.
- Zero Trust
- No implicit trust from network location; every request is verified using identity, device and context.
Knowledge check
A clinic's file server is encrypted by ransomware and staff cannot open patient records. Which property is most directly affected?
Which of these gives non-repudiation for an email?
In a Zero Trust design, which component sits in the traffic path and allows, monitors or ends the connection?