- Confidentiality: Ensuring only authorized access to data.
- Integrity: Preventing unauthorized modification of data.
- Availability: Systems and data should remain accessible when needed.
Key concepts:
- Threat vs Vulnerability vs Risk.
- Attack Surface: The total number of entry points into a system.
- Defense in Depth: Multiple security layers to protect assets.