Security Fundamentals

Security isn't one skill - it's a handful of recurring ideas, applied over and over to every system you touch. This lesson covers the three that come up constantly for the rest of this track.

The CIA triad

• Confidentiality - only the people (and services) who should see data can see it.
• Integrity - data can't be silently changed by someone who shouldn't be able to change it.
• Availability - the system is actually up and usable when legitimate users need it.

Every security control you'll ever reach for exists to protect one of these three. A firewall rule protects confidentiality and integrity by blocking unauthorized access; a backup protects availability by surviving a disaster.

Attack surface

Your attack surface is everything an attacker could possibly target: every open port, every exposed API endpoint, every dependency, every person with access. Reducing it is almost always cheaper and more effective than defending every inch of a sprawling surface - a port that isn't open at all can't be exploited, full stop.

Defense in depth

No single control is perfect, so security is built in layers: a firewall, and authentication, and least-privilege permissions, and encrypted data at rest. If an attacker gets past one layer, the next one is still there. This is exactly why the earlier IAM lesson's "least privilege" principle matters so much - it's one layer in a stack, not the whole stack.

Try it

Private keys are a perfect example of all three ideas at once - lock one down, and you're protecting confidentiality (nobody else can use it), integrity (nobody can swap it), and ultimately availability (you still have working access):

chmod 600 id_rsa

When you're ready, hit Mark complete and move to the next lesson.