The CIA Triad#

All security aims to protect three properties:

flowchart TD
    C["Confidentiality<br/>(only authorized access)"]
    I["Integrity<br/>(data not tampered with)"]
    A["Availability<br/>(accessible when needed)"]

Encryption#

Symmetric Encryption#

Same key encrypts and decrypts — fast, used for bulk data:

Asymmetric Encryption#

Key pair (public + private) — slower, used for key exchange and signatures:

How TLS Uses Both#

sequenceDiagram
    participant C as Client
    participant S as Server
    
    Note over C,S: Asymmetric (slow) — exchange keys
    C->>S: Hello + supported ciphers
    S->>C: Certificate (public key)
    C->>S: Encrypted session key (using server's public key)
    
    Note over C,S: Symmetric (fast) — encrypt data
    C->>S: Data encrypted with session key (AES)
    S->>C: Response encrypted with session key (AES)

Hashing#

One-way function — can’t reverse the output back to input:

Never store passwords in plain text. Always hash with a salt (bcrypt/Argon2).

Common Vulnerabilities#

Defense in Depth#

Multiple layers of security — if one fails, others still protect:

Principle of Least Privilege#

Every user, process, and system should have only the minimum permissions needed:

Secrets Management#

Key Takeaways#

1. CIA triad — every security decision protects confidentiality, integrity, or availability
2. Encrypt everything — at rest (AES) and in transit (TLS)
3. Never store plain-text passwords — use bcrypt or Argon2
4. Least privilege — minimum permissions needed, nothing more
5. Defense in depth — multiple layers, not a single control
6. Secrets in a secrets manager — never in code or git
7. Patch regularly — most breaches exploit known vulnerabilities