Skip to main content

Module 4: Security fundamentals

Estimated time: 4-5 hours (including the lab) · Prerequisites: M1-M3

You now know how computers and networks work. This module adds the security lens: what we're protecting, who we're protecting it from, and the small set of principles that almost every control, framework and job interview question traces back to. This is also where you learn to speak the language: using "threat", "vulnerability" and "risk" precisely is table stakes in GRC and a quiet credibility signal in a SOC.

Supports Security+ SY0-701 domains: 1.0 General Security Concepts and 2.0 Threats, Vulnerabilities, and Mitigations.

What you'll get from this module​

  • Apply the CIA triad to real Australian incidents.
  • Name the main threat actor types and what motivates each.
  • Use vulnerability, threat and risk precisely, not interchangeably.
  • Sketch the attack lifecycle and know what MITRE ATT&CK is.
  • Explain hashing, symmetric and asymmetric encryption without maths.
  • Explain defence in depth, least privilege and the AAA model.

1. The CIA triad: what "security" actually means​

Every security goal reduces to protecting three properties of information:

PropertyQuestion it answersBroken looks like
ConfidentialityCan only authorised people see it?Data breach, leaked records
IntegrityIs it accurate and unaltered?Tampered records, modified transactions
AvailabilityIs it there when needed?Ransomware outage, DDoS, deleted backups

Australian incidents make these concrete:

  • Optus (2022): personal details of millions of customers, including identity documents, were accessed via an exposed system and some were published. A confidentiality failure at national scale, and a big driver of Australia's tougher breach penalties.
  • Medibank (2022): attackers stole sensitive health-claims data and, when the ransom was refused, published it on the dark web. Confidentiality broken, with extortion layered on top, a now-standard criminal playbook.
  • Ransomware outages (regular events for Australian logistics, health and retail organisations): data is encrypted in place and operations stop for days or weeks. Even with confidentiality intact, the availability loss alone can cost millions.

In a job interview, tying the triad to real incidents like these is exactly the kind of answer that lands.

2. Threat actors: who's on the other side​

"Hackers" isn't one group. Motivation predicts behaviour, and behaviour is what you'll detect:

ActorMotivationTypical behaviour
CybercriminalsMoneyPhishing, scams, credential theft, fraud, high volume, opportunistic
Ransomware gangsMoney (organised)Break in, steal data, encrypt systems, extort, increasingly run like businesses, with "affiliates"
Nation-state actorsEspionage, strategic advantagePatient, well-resourced, stealthy; target government, defence, critical infrastructure, research
HacktivistsIdeology, attentionWebsite defacement, DDoS, leaks timed for publicity
InsidersGrievance, money, or plain errorMisuse of legitimate access, hard to detect because nothing is "broken into"

Two takeaways: most of what a SOC sees is financially motivated crime, not spies; and insiders (including the merely careless) are why identity and access controls (M6) matter as much as firewalls.

3. Vulnerability, threat, risk: say them precisely​

This vocabulary is the foundation of GRC work, and mixing the terms up is the fastest way to sound untrained:

  • Vulnerability: a weakness. An unpatched server, a weak password, an untrained user. A property of your systems.
  • Threat: someone or something that could exploit a weakness. A ransomware gang, a phishing campaign, even a flood in the server room. Exists whether or not you're weak.
  • Risk: the potential for loss when a threat meets a vulnerability, weighed by likelihood and impact. The thing organisations actually manage.

Burglary version: the unlocked window is the vulnerability, the burglar working your suburb is the threat, and the risk is losing your valuables, which you reduce by locking the window (fixing the vulnerability), even though the burglar (threat) still exists. Risk can be reduced, transferred (insurance), accepted or avoided, but rarely eliminated. That framing is the day job in GRC, and it returns with the Essential Eight in M5 and risk registers in M10.

4. The attack lifecycle​

Real intrusions are campaigns, not single events. A simplified lifecycle:

  1. Reconnaissance: research the target: staff on LinkedIn, exposed services (attack surface, M2), leaked credentials.
  2. Initial access: get a foothold: a phishing email, a stolen password, an unpatched internet-facing system.
  3. Persistence & escalation: make the access survive reboots and grow it: create accounts, install backdoors, escalate from user to admin (M3's privilege escalation).
  4. Action on objectives: do the thing: steal data, encrypt for ransom, spy quietly.

The attack lifecycle (the numbered list above carries the same detail). The further right an attack gets before you stop it, the more it costs.

Why defenders care: each stage is a chance to detect and stop the attack, and stopping it early is vastly cheaper. A phishing email blocked at stage 2 is a non-event; the same actor discovered at stage 4 is a national news story.

The industry's shared, detailed map of these behaviours is MITRE ATT&CK (attack.mitre.org), a free catalogue of attacker tactics and techniques used to label detections in SOCs and structure assessments in GRC. You don't need to memorise it; you need to recognise it. Browse the matrix once now so it's familiar when M8 uses it in earnest.

5. Cryptography basics (no maths, promise)​

Four ideas cover most of what an analyst needs:

Symmetric encryption: one shared key locks and unlocks. Fast, used for bulk data (files, disks, most of a TLS session). Weakness: both sides must somehow share the key secretly first.

Asymmetric encryption: a mathematically linked key pair: what the public key locks, only the private key unlocks. Publish the public key freely; guard the private key. This solves the key-sharing problem and enables digital signatures (proving who sent something). Slower, so it's used to set things up rather than move bulk data.

Hashing: not encryption at all. A hash function takes any input and produces a fixed-length fingerprint (e.g. SHA-256's 64 hex characters, M1's hex again). Three properties matter: the same input always gives the same hash; you can't run it backwards; and changing even one character changes the hash completely (the avalanche effect, you'll see it in the lab). Uses: verifying files haven't been tampered with, identifying malware samples, and storing passwords: systems store the hash, never the password, and add a salt (random value per user) so identical passwords don't produce identical hashes and precomputed cracking tables are useless.

TLS in one paragraph: the protocol behind HTTPS (M2) combines all of the above: the server proves identity with a certificate (a digital signature from a trusted authority), asymmetric crypto lets both sides agree on a session key, and fast symmetric encryption protects the actual traffic, with hashes guarding integrity. Asymmetric for trust, symmetric for speed, that division of labour is everywhere.

6. Defence in depth & least privilege​

Two principles that explain the shape of almost every security programme:

  • Defence in depth: never rely on one control. Layer them, so a failure in one is caught by the next: email filtering and user training and MFA and endpoint detection and network segmentation (M2) and backups. Castles had moats and walls and keeps for the same reason.
  • Least privilege: from M1, now as organisational policy: every user, process and system gets the minimum access needed, reviewed regularly. It limits blast radius (a compromised marketing account can't touch payroll) and shrinks the insider problem from section 2.

When you meet the Essential Eight in M5, notice that it's these two principles turned into a concrete checklist.

7. The AAA model: the bridge to M6​

Access control decomposes into three questions, asked in order:

  1. Authentication: who are you? Prove identity: password, MFA, biometrics.
  2. Authorisation: what are you allowed to do? Apply permissions (M3's rwx, group memberships, roles), least privilege operationalised.
  3. Accounting: what did you do? Record it: the logs from M3, feeding the SOC in M8.

Notice the trio maps to the course itself: M6 covers identity (authentication and authorisation) and M8 covers monitoring (accounting). AAA is the skeleton; the coming modules add the muscle.

📺 Curated resources (free)​

  • Professor Messer: CompTIA Security+ (SY0-701) course: the free video course aligned to the exact cert this course targets: professormesser.com SY0-701 course. From this module on, it's your parallel track. Start with the General Security Concepts section.
  • MITRE ATT&CK (attack.mitre.org), browse the Enterprise matrix and click into one technique to see the format.
  • Australian Cyber Security Centre (cyber.gov.au), see the Threats section for plain-English profiles of ransomware, phishing and data breaches in the Australian context. M5 is built around this site.

🧪 Lab 4: See the avalanche effect​

Hashing, on your own machine, in ten minutes. As always: your own files, your own computer.

  1. Make a small text file.

    • Linux/macOS (or your M1 VM): echo "cyber launchpad" > test.txt
    • Windows PowerShell: Set-Content test.txt "cyber launchpad"

  2. Hash it with SHA-256.

    • Linux: sha256sum test.txt
    • macOS: shasum -a 256 test.txt
    • Windows: Get-FileHash test.txt (SHA-256 is the default)

    Note the first 8 or so characters of the hash.

  3. Change exactly one character: edit the file so it reads cyber Launchpad (one capital letter). Hash it again.

  4. Compare. The two hashes share essentially nothing, one character flipped roughly half the bits. That's the avalanche effect, and it's why a hash mismatch on a downloaded file or a forensic image means "something changed" with near certainty.

  5. (Optional) Prove determinism. Change the file back to the original text, hash again. The original hash returns exactly. Same input, same fingerprint, every time, on every machine.

Lab success = you produced two SHA-256 hashes differing by one input character and observed them sharing no resemblance.

Self-check​

Answer before you reveal. The attempt is what makes it stick. Your score and card ratings are saved on this device only.

Scored self-check

Check your understanding

Commit to an answer before you check: the attempt is what makes it stick. Your first answer to each question is the one scored; practising again afterwards doesn't change it. Saved on this device only.

Question 1 of 8Ransomware encrypts a hospital’s booking system so staff can’t use it. Which CIA property is broken?

Question 2 of 8An attacker quietly alters transaction records inside a bank’s database. Which CIA property is broken?

Question 3 of 8An unpatched VPN server is exposed to the internet, and a ransomware gang is actively scanning for that exact flaw. In risk language, what is the unpatched server?

Question 4 of 8A SOC sees thousands of phishing emails hunting online-banking credentials across many companies at once. Which threat actor type is most likely behind it?

Question 5 of 8Customer identity documents are posted online after a breach. Which CIA property failed?

Question 6 of 8A web app must store user passwords safely. What’s best practice?

Question 7 of 8A compromised marketing account turns out to be unable to touch payroll data. Which principle limited the blast radius?

Question 8 of 8The logs that answer “what did you do?” belong to which part of the AAA model?

These are the terms that must become automatic: interviewers and the Security+ exam assume them. Rate yourself honestly and the cards come back on a spaced schedule.

Flashcards · spaced repetition

Drill the key terms

Say your answer out loud (or in your head) before revealing. Recall is the workout. "Knew it" pushes a card's next review further out; "Review again" brings it back today.

Card 1 of 21

Prompt

Confidentiality

Next module​

➡️ M5: Australian cyber context: the ACSC, the Essential Eight, the Privacy Act, and the frameworks Australian employers actually name in job ads.