Security Fundamentals · Topic 1 of 10
Key Security Concepts
Learn how threats, vulnerabilities, exploits and risk differ, the CIA triad, common attack types and the main mitigation techniques for a network.
- 5 min
- Exam objective 5.1
- A threat is a potential cause of harm. A vulnerability is a weakness. An exploit takes advantage of it.
- Risk combines the likelihood of harm and its impact.
- The CIA triad is confidentiality, integrity and availability.
What it is
Security work starts with a shared vocabulary of threats, vulnerabilities, exploits and risk.
People often use words like threat, vulnerability and attack as if they meant the same thing. They do not, and the differences matter in practice.
This topic defines the key terms, lists common kinds of attack, and introduces the main ways to reduce risk.
How it works
A threat uses an exploit against a vulnerability to harm an asset, and mitigation lowers the risk.
The core terms
| Term | Meaning | Example |
|---|---|---|
| Asset | Something of value that needs protecting | Customer database, a server, a login |
| Threat | Something that could cause harm | A criminal group, a malware campaign, a careless insider |
| Vulnerability | A weakness that could be used to cause harm | Unpatched software, a weak password, an open port |
| Exploit | A method or tool that takes advantage of a vulnerability | Code that abuses a flaw in a web server |
| Risk | The chance of harm, and how bad it would be | A public server with an unpatched flaw |
| Mitigation | An action that reduces the risk | Patching, filtering, training |
The relationship is easy to remember.
Risk is how likely harm is, multiplied by how much damage it would do. You usually cannot remove a threat, but you can remove vulnerabilities and weaken the exploit's chance of working.
A zero-day is a vulnerability that the vendor does not yet know about, so no fix exists.
The CIA triad
Security goals are often described as three properties.
- Confidentiality: only authorised people can read the data. Encryption and access control support it.
- Integrity: the data has not been changed by anyone who should not have changed it. Hashes and digital signatures support it.
- Availability: systems and data are there when needed. Redundancy and protection from denial of service support it.
Every attack harms at least one of the three.
To place an attack, ask which CIA property it breaks. Denial of service breaks availability, and a stolen password breaks confidentiality.
Common attacks
- Malware: harmful software. A virus attaches to files and needs a user to run it. A worm spreads by itself across the network. A trojan pretends to be useful software. Ransomware encrypts data and demands payment.
- Phishing: a fake message, often email, that tricks users into giving up credentials or running something harmful. Spear phishing is aimed at a specific person.
- Social engineering: manipulating people rather than machines, for example by phone or in person.
- Denial of service (DoS): flooding a system so that real users cannot reach it. When many machines do it together, it is a distributed DoS (DDoS).
- Man in the middle: an attacker secretly sits between two parties and can read or change their traffic.
- Spoofing: forging an address or identity, such as a fake source IP address or a false ARP reply.
- Password attacks: guessing passwords with a brute force (trying everything) or a dictionary (trying likely words) approach.
- Reconnaissance: gathering information, such as scanning for open ports, before an attack.
- Insider threat: harm from a person who already has legitimate access.
Mitigation techniques
Good defence uses several layers, an idea called defence in depth. If one control fails, others still protect the asset.
Common techniques are:
- Patching and updating software to remove known vulnerabilities.
- Hardening: turning off unneeded services and ports, and changing default settings.
- Least privilege: giving users and systems only the access they need.
- Firewalls and intrusion prevention to filter and inspect traffic.
- Segmentation: dividing the network into VLANs and zones so that a breach stays contained.
- Encryption for data in transit and at rest.
- Strong authentication, including multifactor authentication.
- Monitoring and logging, so attacks are noticed and investigated.
- Backups, to recover from ransomware or failure.
- User awareness and training, because people are often the weakest link.
No single control is enough. The aim is to lower risk to a level the organisation accepts, since risk can never be removed completely.
What to remember for the exam
Eight facts cover the vocabulary and the main attack types.
- A threat is a potential cause of harm. A vulnerability is a weakness. An exploit takes advantage of it.
- Risk combines the likelihood of harm and its impact.
- The CIA triad is confidentiality, integrity and availability.
- A worm spreads on its own. A virus needs a host file and a user action.
- Phishing and social engineering target people, not machines.
- DoS aims at availability. A man in the middle attack threatens confidentiality and integrity.
- Defence in depth uses layered controls.
- A zero-day has no vendor fix yet.
Threat and vulnerability are not synonyms. The threat is the danger, and the vulnerability is the weak spot it can use.
Common mistakes
Five habits cause most misunderstandings on this topic.
Using threat and vulnerability as synonyms. The threat is the danger. The vulnerability is the weak spot it can use.
Thinking security is only technical. People and process matter just as much as devices.
Relying on one control. A firewall alone does not stop phishing or a malicious insider.
Confusing a virus with a worm. The difference is how it spreads.
Believing risk can reach zero. The goal is to reduce it to an acceptable level.
Check yourself
Try these three prompts.
How do a threat, an exploit, a vulnerability and an asset relate in one example?
A threat (an attacker) uses an exploit (attack code) against a vulnerability (a weak spot) to harm an asset (valuable data).
Which part of the CIA triad does a denial of service attack harm, and which does a stolen password harm?
Denial of service breaks availability, and a stolen password breaks confidentiality.
In the defence in depth example from the Internet to a server, what are the three layers and what does each one do?
A firewall filters traffic, a switch provides segmentation, and the server is patched and hardened.
Topic 1 of 10 in Security Fundamentals
Test yourself on Security Fundamentals
The full Cisco CCNA 200-301 question bank has 1,206 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.