L1. CIA Triad, AAA & Security Frameworks
Course outlineLesson 1 of 20
Every Security+ question traces back to three foundational models: the CIA Triad, the AAA framework, and the major security governance frameworks. Master these and you have the mental model for the entire exam.
The CIA Triad
The CIA Triad is the core model for information security. Every security control you will encounter on the exam exists to protect one or more of these three properties. Confidentiality ensures that information is accessible only to those authorized to access it. Controls include encryption, access control lists, and need-to-know policies. Integrity ensures that information is accurate and has not been tampered with. Controls include hashing, digital signatures, file integrity monitoring, and write protection. Availability ensures that systems and data are accessible to authorized users when needed. Controls include redundancy, backups, failover clustering, and DDoS mitigation. Non-repudiation is often tested alongside CIA: it ensures a sender cannot deny having sent a message. Digital signatures provide non-repudiation.
AAA Framework
AAA stands for Authentication, Authorization, and Accounting. Authentication answers: who are you? It verifies identity via passwords, tokens, biometrics, or certificates. Authorization answers: what can you do? Once authenticated, the system checks what resources and actions the identity is permitted to access. Accounting answers: what did you do? Audit logs, session records, and SIEM events capture activity for forensic analysis and compliance.
Security Frameworks
| Framework | Type | Key Use |
|---|---|---|
| NIST CSF | Voluntary | Risk-based: Identify, Protect, Detect, Respond, Recover |
| ISO 27001 | Certifiable standard | Information Security Management System (ISMS) |
| CIS Controls | Prescriptive | 18 prioritized safeguards for cyber defense |
| COBIT | IT governance | Aligns IT with business objectives |
- ✓CIA: Confidentiality = who can see it, Integrity = is it unmodified, Availability = can authorized users reach it
- ✓Non-repudiation (via digital signatures) ensures a sender cannot deny having performed an action
- ✓AAA: Authentication proves identity, Authorization determines permitted actions, Accounting logs activity
- ✓NIST CSF 5 functions: Identify, Protect, Detect, Respond, Recover
- ✓ISO 27001 is certifiable (ISMS standard); NIST CSF is voluntary; CIS Controls are prescriptive operational safeguards
1. A company encrypts all customer records so only authorized staff can read them. Which CIA property does this primarily protect?
2. Which component of the AAA framework records what actions an authenticated user performed during a session?
3. An organization wants to obtain a formal, third-party certification for its information security management practices. Which framework should it pursue?
Recommended: Pluralsight
Turn your CompTIA Security+ concepts into passing marks: Pluralsight adds structured study plans, practice exams, and hands-on scenario labs.