The foundation of information security rests on several core principles that every practitioner must understand. The CIA triad—Confidentiality, Integrity, and Availability—defines the three properties that security controls aim to protect. Confidentiality ensures that data is accessible only to authorized parties, integrity ensures that data has not been altered, and availability ensures that systems remain accessible when needed. AAA (Authentication, Authorization, and Accounting) extends this model by adding accountability and access control: authentication verifies identity, authorization determines permitted actions, and accounting tracks what users actually do. Non-repudiation strengthens accountability by ensuring a party cannot deny having performed an action, typically through digital signatures or audit logs. An alternative model, the Parkerian hexad, expands the CIA triad with three additional attributes: possession, authenticity, and utility.
Beyond these models, several guiding principles shape how security controls are applied. Defense in depth uses multiple overlapping security layers so that no single failure causes compromise. The principle of least privilege grants users only the minimum access needed for their job, while need-to-know further restricts access to information required for a specific task, even if the user holds broader clearance. Separation of duties splits critical tasks among multiple people so that no single individual can commit fraud undetected. Together these principles reduce risk by limiting both opportunity and impact.
Risk management requires a precise vocabulary. A threat is a potential cause of harm, a vulnerability is a weakness that can be exploited, and risk is the product of the likelihood that a threat exploits a vulnerability and the resulting impact. A zero-day vulnerability is particularly dangerous because it is unknown to the vendor and has no patch available, leaving attackers free to exploit it. Vulnerabilities are cataloged through programs like CVE (Common Vulnerabilities and Exposures), which assigns unique identifiers, and scored using CVSS (Common Vulnerability Scoring System) on a scale from 0.0 to 10.0 reflecting base severity. Organizations track these in a risk register, an inventory of identified risks along with their likelihood, impact, owners, and mitigation status. When risk cannot be reduced, it can be transferred—for example, through cyber insurance or outsourcing—or formally accepted when the cost of control exceeds the potential loss.
To prioritize defenses, security teams use threat modeling, a structured process for identifying, classifying, and prioritizing threats. The popular STRIDE framework categorizes threats into Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Two closely related concepts are the attack surface and the attack vector. The attack surface is the total sum of all points where an unauthorized user could enter or extract data, while the attack vector is the specific path or method used to actually gain access. Reducing the attack surface—through techniques like the principle of least functionality—limits the paths attackers can exploit in the first place.