Security Principles · Topic 1 of 4
Cybersecurity Concepts
The CIA triad, authentication, authorization and accounting, non-repudiation and privacy for the ISC2 CC exam, with examples from everyday systems and AI.
- 3 min
- Includes a diagram
- Confidentiality is secrecy, integrity is accuracy, availability is access when needed.
- Identification claims, authentication proves, authorization permits, accounting records.
- MFA means different factor types.
What it is
Every security control exists to protect a few basic properties of information and systems. CC expects you to recognize them in a short scenario: which property was harmed, or which one a control protects.
How it works
The CIA triad
| Property | Meaning | Harmed when | Protected by |
|---|---|---|---|
| Confidentiality | Only authorized people can see information | Data is disclosed or stolen | Encryption, access control, classification |
| Integrity | Information is accurate and not changed without authorization | Data is altered, by an attacker or by mistake | Hashing, digital signatures, change control |
| Availability | Systems and data are usable when needed | A system is down or data is unreachable | Backups, redundancy, protection from denial of service |
AI examples: secretly altering a model's training data so it makes wrong decisions harms integrity (often called data or model poisoning). A competitor copying a proprietary model by querying it thousands of times harms confidentiality.
Authentication, authorization and accounting (AAA)
| Step | Question it answers | Example |
|---|---|---|
| Identification | Who do you claim to be? | Typing a username |
| Authentication | Can you prove it? | Password, token, fingerprint |
| Authorization | What may you do? | Read access to one folder |
| Accounting | What did you do? | Logs of each action |
Authentication factors are something you know (password), something you have (token or phone) and something you are (fingerprint). Multifactor authentication combines two or more different types. Two passwords are still one factor type.
Accounting makes people and systems accountable. If an AI assistant takes an action and nobody can tell which user prompted it, accountability is missing.
Non-repudiation
Non-repudiation means someone cannot later deny an action they took, such as sending a message or approving a payment. Digital signatures and trustworthy logs provide it.
Privacy
Privacy is the right of individuals to control how their personal information is collected, used and shared. It depends on confidentiality but adds rules: collect only what is needed, use it only for the stated purpose, and respect consent. Using customer data collected for one purpose (booking appointments) for another (training a sales model) needs a valid basis such as consent.
How the exam asks about this
- "An attacker changes records in a database." Integrity.
- "A website is flooded with traffic and becomes unreachable." Availability.
- "A user later denies sending a signed email." Non-repudiation prevents this.
What to remember for the exam
- Confidentiality is secrecy, integrity is accuracy, availability is access when needed.
- Identification claims, authentication proves, authorization permits, accounting records.
- MFA means different factor types.
- Non-repudiation stops someone denying an action.
- Privacy concerns personal data and its permitted use.
Encryption protects confidentiality. It does not prove that data was not changed; hashing and signatures do that.
Common mistakes
Confusing authentication with authorization.
Calling a password plus a security question MFA. Both are something you know.
Treating privacy as just confidentiality. Privacy also covers purpose and consent.
Check yourself
Which CIA property is harmed when training data is secretly altered?
Integrity.
What does accounting provide in AAA?
A record of actions so they can be traced to a user or system.
Which control supports non-repudiation?
A digital signature.
Topic 1 of 4 in Security Principles
Test yourself on Security Principles
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.