Every security decision comes back to a handful of principles. Master these and the rest of cyber security makes sense.
The CIA Triad
The three goals every security control ultimately serves.
Tap or hover a part to learn more.
Keep data secret.
Ensures information is only accessible to those authorised to see it. Achieved with encryption, access controls and data classification. A data breach is a loss of confidentiality.
Check your understanding
1. A DDoS attack that knocks a website offline primarily violates which principle?
2. Encrypting a laptop's hard drive primarily protects which principle?
Keep learning
The core ideas
- The CIA triad — Confidentiality (only authorised access), Integrity (data is accurate and untampered) and Availability (systems are up when needed). Every control supports at least one.
- Defence in depth — layer independent controls so no single failure is fatal, covered in Security Architecture.
- Least privilege — grant only the access needed, no more; the heart of Identity & Access Management.
Zero Trust
Never trust, always verify — the modern security model.
Tap or hover a part to learn more.
Trust the internal network.
Traditional security trusted anything inside the perimeter — once you were on the network, you were assumed safe. Breaches then spread freely (lateral movement).
Check your understanding
1. What is the core principle of zero trust?
2. Which idea best supports 'assume breach'?
Zero trust replaces "trust the internal network" with "never trust, always verify" — every request is authenticated, authorised and inspected, regardless of where it comes from. This underpins modern Security+ thinking.