Cybersecurity isn't about a single magic bullet. It's about building layers of defense, known as security controls. Think of it like securing a house. You don't just lock the front door; you also have window locks, a security camera, and maybe a dog. Each control serves a different purpose.

We can categorize these controls in a few ways. One way is by their function: how they act against a threat.

• Preventive: These controls stop an incident from happening in the first place. A firewall that blocks malicious traffic is a classic example. It’s the strong lock on your front door.
• Detective: These controls identify that an incident is happening or has already occurred. A security camera or an intrusion detection system that sends an alert are detective controls. They let you know someone is trying to break in.
• Corrective: These controls are used after an incident to limit the damage. Restoring data from a backup after a ransomware attack is a corrective action. It's about fixing the broken window.

Another way to think about controls is by their nature: what they are made of.

Some controls fit into multiple categories, and there are a few other functional types worth knowing:

• Deterrent: Discourages an attacker. A "Beware of Dog" sign is a deterrent control.
• Compensating: A backup control used when a primary one fails. If a server's main power goes out, a backup generator is a compensating control.
• Directive: Mandates certain behavior. A policy stating that all employees must log off their computers when they leave is a directive.

At the heart of information security are three core principles. They form a model called the CIA triad, which helps guide security policies. The goal is to balance these three crucial aspects.

Think of confidentiality as a sealed envelope. Only the person it's addressed to should be able to open it and read the letter inside. If someone else gets a peek, confidentiality is breached.

Integrity means the data hasn't been changed or tampered with. It's making sure the letter in the envelope is the exact same one the sender wrote, with no words added or removed.

Availability is simple: can you get to the information when you need it? If the post office loses your letter, or your email server is down, the information is not available.

How do we ensure only the right people can access the right information? We use a framework often called AAA, which stands for Authentication, Authorization, and Accounting. It's a fundamental concept for controlling access.

1. Authentication: This is the process of proving you are who you say you are. When you log in with a password, use your fingerprint, or tap a key card, you are authenticating yourself. It’s the first step: presenting your credentials.

2. Authorization: Once you're authenticated, authorization determines what you're allowed to do. Just because you're an employee doesn't mean you can access the company's financial records. Your key card might open the front door, but not the CEO's office. Authorization is about permissions.

3. Accounting: Also known as auditing, this is the process of tracking what a user does. It logs activities like what files were accessed, what changes were made, and when the user logged in and out. This creates a trail that's useful for security analysis and troubleshooting.

For a long time, network security followed a "castle-and-moat" approach. The idea was to build a strong perimeter (the moat) to keep threats out. Once you were inside the network (the castle), you were generally trusted.

That model doesn't work well anymore. People work from anywhere, and data lives in the cloud. The modern approach is called Zero Trust. The philosophy is simple: never trust, always verify.

Imagine a high-security building where your keycard doesn't just open the front door. You need to swipe it to get into the lobby, to use the elevator, to enter your specific floor, and even to access the supply closet. Every single step requires verification. That's the core idea of Zero Trust.

Cryptography is the practice of using math to secure communication. It's the engine behind many of the security controls we've discussed. Here are a few key cryptographic tools and concepts.

• Encryption: The process of converting readable data into a scrambled, unreadable format called ciphertext. Only someone with the correct key can decrypt it back into its original form. This is the cornerstone of confidentiality.

• Public Key Infrastructure (PKI): This is the framework of hardware, software, and policies that manages digital certificates and public-key encryption. It's what allows you to trust that a website is legitimate (the little padlock in your browser) and to communicate securely with people you've never met.

• Hashing: A process that takes an input (like a file or a password) and returns a unique, fixed-size string of text. If even one character of the input changes, the hash will change completely. This is great for verifying data integrity, but you can't reverse it to get the original input.

• Digital Signatures: These use public-key cryptography to verify the authenticity and integrity of a digital message. It proves who sent the message and that the message hasn't been altered.

• Obfuscation: This means making something, like source code, difficult for humans to understand. It's meant to hide the logic or intellectual property. Unlike encryption, it isn't mathematically impossible to reverse; it just makes it much harder.

• Blockchain: A decentralized, distributed, and often public digital ledger. Its security comes from being immutable—once a transaction is recorded, it's extremely difficult to change. This is achieved by linking blocks of data together using cryptography.

Ready to check your understanding? Let's see what you've learned about these foundational security concepts.

These concepts are the building blocks for creating a strong security posture. By understanding the different types of controls and the principles that guide them, you can start to think more critically about how to protect information.