2.2. Fundamental Security Concepts

💡 First Principle: This section covers the conceptual foundations every security architecture rests on. Without the CIA Triad as a goal, you don't know what "secure" means. Without AAA, you can't control access. Without Zero Trust, your architecture has blind spots. These aren't abstract theories — they're the decision frameworks that determine which controls you deploy and where.

What happens when organizations skip fundamentals? They protect the wrong things, grant access to the wrong people, and leave gaps they don't know exist. A company that focuses only on confidentiality might encrypt everything but have no backup strategy — one ransomware attack and availability collapses. Another company with strong authentication but no accounting has no audit trail when a breach occurs.

Consider every technical control through this lens: which CIA property does it protect? Which AAA function does it serve? Which Zero Trust principle does it enforce? If you can answer instinctively, the exam becomes much easier.

Think of these fundamentals as the load-bearing walls of everything else in this guide — every later phase leans on the CIA triad, AAA, and Zero Trust in some form.

⚠️ Exam Trap: Non-repudiation requires asymmetric cryptography specifically — symmetric encryption can't provide it, since both parties share the same key.