Fundamentals of Computer Security

Fundamentals of Computer Security

Welcome to this comprehensive course on the core concepts of computer security. Designed for beginners and intermediate learners, this module explores the CIA Triad, common threats, and key defensive techniques. By the end of the lesson, you will understand essential terminology, recognize typical attack vectors, and know how to apply basic security controls.

1. The CIA Triad: The Pillars of Information Security

The CIA Triad is the foundational model that defines three primary goals for protecting information assets:

• Confidentiality – Ensuring that data is accessible only to authorized individuals.
• Integrity – Maintaining the accuracy and trustworthiness of data throughout its lifecycle.
• Availability – Guaranteeing that information and services are reachable when needed.

These three elements work together; a weakness in any one can compromise the entire security posture.

2. Implementing Confidentiality

Confidentiality is often achieved through cryptographic techniques that render data unreadable to unauthorized parties. The most common method is encryption, which transforms plaintext into ciphertext using an algorithm and a secret key.

• Data‑at‑rest encryption protects files stored on disks or cloud storage.
• Data‑in‑transit encryption (e.g., TLS/SSL) secures communications over networks.
• Key management practices, such as rotating keys and using hardware security modules (HSMs), are critical for maintaining confidentiality.

Other controls—like access control lists (ACLs) and role‑based access control (RBAC)—support confidentiality but do not replace encryption.

3. Ensuring Data Integrity with Hashing and Digital Signatures

Integrity guarantees that information remains unchanged from its original state. Two powerful tools are:

• Hashing: A one‑way function (e.g., SHA‑256) that produces a fixed‑size digest. Any alteration to the input data results in a different hash, making tampering detectable.
• Digital Signatures: Combining a hash with a private key creates a signature that can be verified with the corresponding public key. This proves both integrity and authenticity of the data.

When a company uses these mechanisms during transmission, it protects the accuracy and completeness of the data—addressing the integrity component of the CIA Triad.

4. Availability and Distributed Denial‑of‑Service (DDoS) Attacks

Availability focuses on keeping services operational. A DDoS attack overwhelms a target with massive traffic, rendering it inaccessible to legitimate users. Because the primary impact is service disruption, DDoS attacks directly threaten the Availability pillar.

Common mitigation strategies include:

• Traffic scrubbing services that filter malicious packets.
• Rate limiting and connection throttling.
• Redundant infrastructure and load‑balancing across multiple data centers.

5. Malware Propagation: Viruses vs. Worms

Understanding how malicious code spreads helps in designing effective defenses.

• Viruses attach themselves to legitimate files or programs. They require user interaction—such as opening an infected file—to execute and replicate.
• Worms are self‑propagating; they spread automatically across networks without needing user action.

Recognizing this distinction is vital for configuring endpoint protection and network monitoring tools.

6. Vulnerabilities, Threats, and Risks

In risk management terminology:

• A Threat is a potential cause of an unwanted incident (e.g., a hacker).
• A Vulnerability is a weakness that can be exploited (e.g., a weak password).
• An Asset is anything of value to the organization (e.g., databases, intellectual property).
• Risk is the probability that a threat will exploit a vulnerability, causing impact.

Thus, a weak password that facilitates brute‑force attacks is classified as a vulnerability.

7. Application‑Layer Attacks: SQL Injection

SQL injection occurs when an attacker inserts malicious SQL statements into an input field—often a login form—to manipulate the backend database. This technique exemplifies a attack method targeting application logic.

Key defenses include:

• Parameterized queries and prepared statements.
• Input validation and sanitization.
• Least‑privilege database accounts.

8. Protocol‑Level DDoS Attacks: The TCP Handshake Exploit

One common protocol‑level DDoS technique is the SYN flood. Attackers send a large number of incomplete TCP connection requests (SYN packets) but never complete the handshake. The target system allocates resources for each half‑open connection, eventually exhausting its capacity and denying legitimate traffic.

This is classified as a protocol attack, distinct from application‑layer or volume‑based attacks.

9. Summary and Best Practices

To reinforce the concepts covered:

• Always align security controls with the CIA Triad: encrypt for confidentiality, hash/sign for integrity, and design redundancy for availability.
• Identify and remediate vulnerabilities before they become exploitable threats.
• Implement layered defenses—network firewalls, intrusion detection/prevention systems, and secure coding practices—to mitigate malware, DDoS, and injection attacks.
• Regularly test your environment with vulnerability scans and penetration tests to uncover hidden weaknesses.

By integrating these principles into daily operations, organizations can build a resilient security posture that protects critical information assets.