Study Guide: Chapter 1 — Security Foundations and the CIA Triad

The CIA triad is the foundational framework that organizes every enterprise security control, policy, and investment decision. The three pillars — Confidentiality, Integrity, and Availability — map directly to concrete technical mechanisms that network engineers and security practitioners implement every day.

Think of the CIA triad like the structural legs of a stool. Remove any one leg and the stool topples. Regulatory frameworks including HIPAA, ISO 27001, and the NIST Cybersecurity Framework map their requirements directly onto CIA triad controls.

Pre-Reading Check — CIA Triad

1. A hospital's EHR system uses TLS 1.3 for all connections and restricts nursing staff to read-only chart access. Which CIA pillar do these controls primarily enforce?

Availability Integrity Confidentiality Non-repudiation

2. An attacker flips a single bit in a firmware image before it is distributed. Which mechanism would reliably detect this before installation?

CRC-32 checksum SHA-256 cryptographic hash comparison TLS 1.3 session encryption RBAC policy enforcement

3. A financial services firm deploys anycast routing across five cloud regions and absorbs a Tbps-scale DDoS with zero user-visible downtime. Which availability mechanism is most directly responsible?

Active-passive failover with warm standby RAID storage redundancy Distributed scrubbing via anycast routing WAF rate limiting at the application layer

4. Under a Zero Trust policy, what determines whether a user inside the corporate LAN is granted access to a sensitive resource?

Their physical location on the network The VLAN they are assigned to Identity, device posture, and resource sensitivity — verified per request Whether they passed the initial MFA challenge at login

5. Ransomware encrypts all organizational files and demands payment for the decryption key. Which CIA pillar does this attack primarily violate?

Confidentiality — the attacker reads the data Integrity — the attacker modifies the data Availability — authorized users cannot access the data Non-repudiation — the attacker denies the attack

Confidentiality Controls

Confidentiality guarantees data is accessible only to authorized parties. A breach exposes data — it does not destroy it. Examples: leaked credentials, stolen intellectual property, exposed patient records.

Encryption: TLS establishes a shared session key via asymmetric cryptography, then encrypts bulk data with a symmetric cipher. A packet capture reveals only ciphertext.

Access control: RBAC assigns permissions to roles rather than individuals. MFA adds a second verification factor so a stolen password alone cannot grant access. Zero Trust removes implicit trust from network position — every request is verified per identity, device posture, and resource sensitivity.

Data classification determines which controls apply to each dataset:

Classification	Description	Example Controls
Public	No sensitivity; freely shareable	No restrictions
Internal	Routine business data	RBAC, standard authentication
Confidential	Sensitive business or customer data	MFA, encryption at rest and in transit
Restricted	Regulated or highest-sensitivity data	MFA, encryption, DLP, audit logging

Key Points — Confidentiality

TLS 1.3 protects data in transit; AES-256 protects data at rest — both are needed for full coverage
RBAC assigns privileges to roles, not individuals — minimizes blast radius of compromised accounts
Zero Trust treats every access request as untrusted regardless of network location
Data classification drives control selection: Restricted data requires MFA + encryption + DLP + audit logging
No single mechanism is sufficient — defense in depth requires encryption, access control, and classification working together

flowchart TD DC["Data Classification\n(Public / Internal / Confidential / Restricted)"] DC --> AC["Access Control Layer"] AC --> RBAC["Role-Based Access Control\n(RBAC)"] AC --> MFA["Multi-Factor Authentication\n(MFA)"] AC --> ZT["Zero Trust Policy\n(verify every request)"] DC --> ENC["Encryption Layer"] ENC --> TLS["TLS 1.3\n(data in transit)"] ENC --> REST["AES-256\n(data at rest)"] DC --> DLP["Data Loss Prevention\n(DLP monitoring)"] style DC fill:#1a2a4a,stroke:#58a6ff,color:#e6edf3 style AC fill:#1a2a4a,stroke:#58a6ff,color:#e6edf3 style ENC fill:#1a2a4a,stroke:#58a6ff,color:#e6edf3 style DLP fill:#1a2a4a,stroke:#58a6ff,color:#e6edf3

Integrity Mechanisms

Integrity assures data has not been altered, corrupted, or tampered with — in transit or at rest. A breach corrupts data, often invisibly: a modified config file, tampered firmware, or altered financial record.

Cryptographic hashing (SHA-256): deterministic, collision-resistant. Any single-bit change produces a completely different digest. SHA-256 and SHA-3 are appropriate for security; CRC-32 detects transmission errors only and can be forged.

Digital signatures combine hashing with asymmetric crypto for integrity and non-repudiation: the sender encrypts a SHA-256 hash with their private key; the recipient decrypts with the sender's public key and recomputes the hash — matching hashes confirm authenticity and integrity.

Version control: Every Git commit is identified by a hash of its contents and parent commits. Any historical tampering invalidates all subsequent commit hashes.

sequenceDiagram participant S as Sender participant R as Recipient S->>S: 1. Compute SHA-256 hash of message S->>S: 2. Encrypt hash with Sender's Private Key → Signature S->>R: 3. Transmit: Message + Signature R->>R: 4. Decrypt Signature with Sender's Public Key → Hash_A R->>R: 5. Independently compute SHA-256 of received message → Hash_B alt Hash_A == Hash_B R->>R: ✓ Message is intact; sender identity verified else Hash_A ≠ Hash_B R->>R: ✗ Integrity or authenticity failure — reject message end

Key Points — Integrity

SHA-256 is collision-resistant and cryptographically secure; CRC-32 is not — never use CRC for security verification
Digital signatures provide both integrity and non-repudiation (the sender cannot deny authorship)
Git commit hashes create a tamper-evident chain — modifying any commit invalidates all descendant commits
Integrity controls detect unauthorized modification; they do not prevent it — complementary access controls are needed
NIST NSRL publishes SHA-256 hashes of known-good software for forensic comparison

Availability Strategies

Availability guarantees authorized users can access systems and data when needed. 75% of organizations reported ransomware exposure in 2024 — ransomware is explicitly an availability attack.

Redundancy eliminates single points of failure: redundant power, dual uplinks, RAID arrays, geographically distributed data centers.

Failover: Active-passive keeps a standby warm but idle; active-active distributes load across live nodes. RTO (maximum tolerable downtime) and RPO (maximum tolerable data loss) drive these architectural choices.

Attack Type	Mechanism	Mitigation
Volumetric (UDP flood)	Overwhelm bandwidth	Upstream scrubbing centers, anycast routing
Protocol (SYN flood)	Exhaust connection state tables	SYN cookies, rate limiting
Application layer (HTTP flood)	Exhaust application resources	WAF rate limiting, CAPTCHA, behavioral analysis

Key Points — Availability

RTO = maximum tolerable downtime; RPO = maximum tolerable data loss — these metrics drive failover architecture decisions
Active-active failover provides higher availability than active-passive but requires more infrastructure
Anycast routing distributes DDoS attack traffic across multiple PoPs, preventing any single site from being overwhelmed
Ransomware is an availability attack — tested backup and recovery is the primary mitigation
Cloud scrubbing services (Cloudflare, Akamai, AWS Shield) absorb attacks at the edge before reaching target infrastructure

Post-Reading Check — CIA Triad

1. A hospital's EHR system uses TLS 1.3 for all connections and restricts nursing staff to read-only chart access. Which CIA pillar do these controls primarily enforce?

Availability Integrity Confidentiality Non-repudiation

2. An attacker flips a single bit in a firmware image before it is distributed. Which mechanism would reliably detect this before installation?

CRC-32 checksum SHA-256 cryptographic hash comparison TLS 1.3 session encryption RBAC policy enforcement

Active-passive failover with warm standby RAID storage redundancy Distributed scrubbing via anycast routing WAF rate limiting at the application layer

4. Under a Zero Trust policy, what determines whether a user inside the corporate LAN is granted access to a sensitive resource?

Their physical location on the network The VLAN they are assigned to Identity, device posture, and resource sensitivity — verified per request Whether they passed the initial MFA challenge at login

5. Ransomware encrypts all organizational files and demands payment for the decryption key. Which CIA pillar does this attack primarily violate?

Section 2: Security Deployment Architectures

Pre-Reading Check — Deployment Architectures

6. A device with outdated antimalware signatures attempts to join the production network. Which control places it in a remediation VLAN instead?

Next-Generation Firewall (NGFW) Network Access Control (NAC) Intrusion Prevention System (IPS) Web Application Firewall (WAF)

7. A fileless malware attack executes entirely in memory and never writes a binary to disk. Which endpoint control is best positioned to detect it?

Legacy signature-based antimalware NGFW with TLS decryption EDR with behavioral process monitoring WAF with application-layer inspection

8. An organization runs hundreds of ephemeral cloud workloads that spin up and down within minutes. What is the primary advantage of agentless security for these workloads?

Deeper OS-level visibility including process trees Immediate block and isolate response capability Auto-scales without requiring agent installation on each instance Detects fileless malware executing in memory

9. RASP (Runtime Application Self-Protection) is most effective in which scenario?

Blocking known-signature attacks at the network perimeter Enforcing device posture before network admission Detecting and blocking zero-day attacks from inside the application process Scanning container images for known CVEs before deployment

10. The majority of cloud security breaches are caused by what?

Zero-day exploits in cloud provider infrastructure Misconfiguration of cloud resources (S3 permissions, security groups, IAM) Unpatched OS vulnerabilities on cloud instances Insider threats from cloud provider employees

Network Security: IDS/IPS, Firewalls, and NAC

Firewalls: Stateful firewalls track TCP connection state, enforce rules on IP/port/protocol. NGFWs add Layer 7 application inspection, user identity integration, and TLS decryption for encrypted traffic inspection.

IDS vs IPS: IDS passively alerts; IPS is inline and can drop, reset, or redirect malicious traffic. IPS uses signature-based detection (known attacks) and anomaly-based detection (statistical deviations). Inline placement introduces latency — factor into network design.

NAC enforces posture requirements (current AV signatures, OS patches, compliant firewall settings) before permitting network access. Non-compliant devices are quarantined to a remediation VLAN.

Endpoint Security: EDR, Host Firewalls, and Antimalware

Legacy antimalware uses signature-based detection: known-malicious file hashes or byte sequences. Effective against known malware; fails against novel threats, obfuscated variants, and fileless malware.

Modern antimalware incorporates behavioral detection, ML classifiers, and cloud reputation lookups — asking "does this process behave like malware?" rather than "does this file match a known-bad signature?"

EDR records process trees, network connections, file events, and registry changes, streaming telemetry to a central platform. Analysts can reconstruct attack timelines, identify lateral movement, and remotely isolate endpoints without physical access.

Host-based firewalls (Windows Defender Firewall, iptables/nftables) enforce per-process network policies — providing a final defense layer even when the network perimeter is compromised.

Application Security: WAF, API Gateways, and RASP

WAF inspects HTTP request/response content for attack patterns: SQL injection, XSS, path traversal, protocol violations. Operates in signature mode (known patterns) or behavioral mode (deviation from normal traffic profile).

API gateways centralize authentication, rate limiting, input validation, and logging for API traffic — enforcing these as a single auditable policy layer rather than in each microservice individually.

RASP embeds security monitoring in the application runtime — intercepting database queries, shell executions, and file operations from inside the process. Particularly effective against zero-day vulnerabilities where no WAF signature exists.

Key Points — Deployment Architectures

IDS alerts passively; IPS is inline and can block — IPS placement introduces latency and must be designed for
NAC enforces endpoint posture at network admission; non-compliant devices go to remediation VLAN, not production
Fileless malware never writes to disk — signature-based AV cannot detect it; behavioral EDR can
RASP operates inside the application process — it can block zero-days that bypass WAF signatures
CSPM addresses the leading cause of cloud breaches: misconfiguration, not exploitation

Post-Reading Check — Deployment Architectures

6. A device with outdated antimalware signatures attempts to join the production network. Which control places it in a remediation VLAN instead?

Next-Generation Firewall (NGFW) Network Access Control (NAC) Intrusion Prevention System (IPS) Web Application Firewall (WAF)

7. A fileless malware attack executes entirely in memory and never writes a binary to disk. Which endpoint control is best positioned to detect it?

Legacy signature-based antimalware NGFW with TLS decryption EDR with behavioral process monitoring WAF with application-layer inspection

8. An organization runs hundreds of ephemeral cloud workloads that spin up and down within minutes. What is the primary advantage of agentless security for these workloads?

9. RASP (Runtime Application Self-Protection) is most effective in which scenario?

10. The majority of cloud security breaches are caused by what?

Section 3: SIEM, SOAR, and Log Management

Security controls generate enormous volumes of telemetry. Without a centralized system to collect, correlate, and act on this data, defenders are overwhelmed by volume and miss signals buried in the noise. The SOC toolchain — SIEM, SOAR, and log management — transforms raw telemetry into actionable intelligence and automated response.

Pre-Reading Check — SIEM, SOAR, and Log Management

11. A SIEM detects 500 failed logins against the same account in 60 seconds. Which SIEM capability produced this alert?

Log normalization TLS decryption Correlation rule execution SOAR playbook trigger

12. Compared to a static threshold rule, what is the key advantage of sliding window anomaly detection?

It processes events faster with lower latency It adapts to normal variation, catching low-and-slow attacks that stay below fixed thresholds It requires no historical baseline to operate It eliminates the need for log normalization

13. A SOAR playbook automatically quarantines phishing emails, submits attachments to a sandbox, and identifies all affected users — all within seconds of the SIEM alert. What is the primary SOC benefit this demonstrates?

Improved log retention compliance Speed and consistency of response vs. manual analyst execution Reduction in log storage costs Elimination of false positive alerts

SIEM Architecture and Correlation Rules

A SIEM ingests log and event data from heterogeneous sources, normalizes it into a common schema (source IP, destination IP, port, action, timestamp), and applies correlation rules that identify attack patterns across all data sources uniformly.

Example correlation rule:

IF authentication_failure.count > 500
   AND authentication_failure.target_account = SAME
   AND authentication_failure.time_window < 60s
THEN generate_alert(severity=HIGH, type="Brute Force Attack")

Rules can also correlate across sources: a port scan from the IDS followed within 5 minutes by a new outbound connection from that server is a potential compromise sequence neither event alone would flag.

Sliding window anomaly detection computes a statistical baseline over a rolling time window and alerts when the current value deviates significantly. A global retailer's holiday traffic would trigger constant false positives with static thresholds — sliding window adapts to normal variation and catches low-and-slow attacks that stay below fixed limits.

SOAR Playbooks and Automated Response

SOAR receives alerts from the SIEM and executes automated response playbooks. SIEM provides detection and visibility; SOAR provides speed and consistency. The five-stage pipeline:

Stage	Actor	Action
1. Intake	SIEM	Forwards normalized alert to SOAR
2. Triage/Enrichment	SOAR	Adds context: threat intel lookups, asset ownership, user history
3. Decision	SOAR logic	Branching: auto-close low risk, escalate medium, automate high risk
4. Response	SOAR playbook	Isolate endpoint, block IP, disable account, create ticket
5. Closure	SOAR + analyst	Generate report, tune rules, close case

SOAR governance is critical: playbooks without change control, testing, and rollback procedures create fragile automation that can amplify incidents. Best practice requires version control for playbooks, staging environments, peer review, and defined rollback procedures.

Dimension	SIEM	SOAR
Primary function	Detection and visibility	Orchestration and response
Core strength	Log correlation, alerting	Playbook execution, speed
SOC role	Foundation layer	Automation layer built on SIEM
Maturity requirement	Entry-level SOC	Requires mature SIEM first

Centralized Log Management and Retention

Log management is the infrastructure layer that makes SIEM and SOAR possible. Key decisions:

Retention: PCI-DSS requires 12 months (3 accessible); HIPAA requires 6 years. Longer retention supports forensic investigation of breaches not discovered immediately.
Integrity protection: Write-once storage, cryptographic log signing, and immutable cloud object storage (S3 Object Lock, Azure Immutable Blob) protect logs from attacker tampering post-compromise.
Indexing: Elasticsearch, Splunk, and OpenSearch enable sub-second queries across billions of events for incident investigation.
Coverage gaps: Unmonitored cloud services, legacy systems, and network segments without flow data are blind spots attackers will exploit.

Key Points — SIEM, SOAR, and Log Management

SIEM normalization is what makes cross-source correlation possible — a Cisco ASA and a Palo Alto NGFW format events differently but SIEM maps both to a common schema
Sliding window detection adapts to normal traffic variation; static thresholds do not — critical for environments with predictable peak periods
SOAR playbooks execute in seconds; a human analyst would take minutes — speed is the primary advantage for high-severity incidents
A misconfigured SOAR playbook can cause more damage than the incident it was meant to contain — governance and testing are non-negotiable
Log integrity protection (write-once, immutable storage) is as important as log collection — tampered logs are useless for forensics

Post-Reading Check — SIEM, SOAR, and Log Management

11. A SIEM detects 500 failed logins against the same account in 60 seconds. Which SIEM capability produced this alert?

Log normalization TLS decryption Correlation rule execution SOAR playbook trigger

12. Compared to a static threshold rule, what is the key advantage of sliding window anomaly detection?

Improved log retention compliance Speed and consistency of response vs. manual analyst execution Reduction in log storage costs Elimination of false positive alerts

Section 4: Core Security Terminology

Pre-Reading Check — Core Security Terminology

14. A threat hunter forms the hypothesis: "APT groups targeting financial services commonly establish persistence via scheduled tasks" and queries EDR telemetry to test it. What distinguishes this activity from alert-driven incident response?

It uses automated playbooks rather than manual analysis It is proactive and hypothesis-driven, searching for activity not detected by automated controls It relies on known IoC feeds rather than behavioral analysis It is performed by SOAR rather than human analysts

15. In the STRIDE threat model, "Tampering" maps to which CIA triad violation?

Confidentiality Availability Integrity Non-repudiation

Threat Intelligence, Hunting, and Modeling

Threat intelligence (TI) is processed, contextualized information about adversary capabilities, infrastructure, motivations, and tactics. Raw indicators (IP addresses, domains, file hashes) are Indicators of Compromise (IoCs). Tactical TI describes MITRE ATT&CK TTPs; strategic TI describes the threat landscape for an industry or region. Operationalizing TI means ingesting IoC feeds into SIEM and EDR so detections fire when known-bad indicators appear.

Threat hunting is the proactive, hypothesis-driven search for adversary activity not detected by automated controls. A hunter forms a hypothesis, then actively queries endpoint telemetry, logs, and network captures to test it. Requires rich telemetry (EDR, full packet capture, DNS logs) and familiarity with MITRE ATT&CK.

Threat modeling identifies potential threats during system design. The STRIDE model maps to CIA violations:

Tampering → Integrity violation
Denial of Service → Availability violation
Information Disclosure → Confidentiality violation
Spoofing → Authentication failure
Repudiation → Non-repudiation failure
Elevation of Privilege → Authorization failure

Malware Analysis and Reverse Engineering

Static analysis examines the binary without executing it: strings, imported functions, file headers, hash comparison. Fast but misses packed/encrypted code and environment-dependent behavior.

Dynamic analysis executes malware in a controlled sandbox and observes behavior: network connections, files created, registry modifications, processes spawned. Captures behavior static analysis misses.

Reverse engineering uses disassemblers (IDA Pro, Ghidra) and debuggers to reconstruct compiled binary logic — necessary for custom C2 protocols, encryption implementations, and sandbox evasion techniques.

Criteria	Agent-Based	Agentless
Deployment	Installed on each endpoint	No installation; uses APIs/network scanning
Visibility	Deep: OS-level, process, fileless malware	Broader: configuration, network posture
Response	Immediate: block, isolate, enforce	Near-real-time; limited direct control
Performance impact	Consumes device resources	Minimal to none
Scalability	Harder for dynamic/IoT/legacy	Auto-scales; suited for cloud/ephemeral
Ideal use case	High-risk endpoints, fileless threat detection	Cloud workloads, IoT, legacy systems

Run Book Automation and DevSecOps

Run book automation (RBA) codifies operational procedures into structured, machine-executable workflows. SOAR playbooks are the security implementation of RBA. Value: consistency (same procedure every time, regardless of which analyst is on shift) and speed (seconds vs. minutes/hours).

DevSecOps integrates security into every stage of the software development lifecycle:

SAST: Analyzes source code for vulnerabilities before compilation or deployment
SCA: Scans third-party library dependencies for known CVEs
Container image scanning: Checks images for vulnerabilities before registry push or production deployment
IaC scanning: Validates Terraform, CloudFormation, and Kubernetes manifests for misconfigurations before apply
Secret scanning: Detects API keys and credentials accidentally committed to source code repositories

Key Points — Core Security Terminology

Threat intelligence is only operationally useful when ingested into SIEM/EDR — IoC feeds that are not acted upon provide no protection
Threat hunting is proactive and hypothesis-driven; it finds threats that automated controls missed by design
STRIDE maps each threat category to a CIA triad violation — Tampering=Integrity, DoS=Availability, Info Disclosure=Confidentiality
Dynamic analysis is required for packed/encrypted malware that static analysis cannot disassemble; sandbox evasion may require full reverse engineering
DevSecOps shifts security left — SAST, SCA, and secret scanning catch vulnerabilities before code reaches production, dramatically reducing remediation cost

Post-Reading Check — Core Security Terminology