1.2 The CIA Triad, Non-Repudiation, and the AAA Framework

🎯 Key CompTIA Security+ Exam Takeaways

• Confidentiality ensures information is inaccessible to unauthorized entities via encryption, access controls, and data classification.
• Integrity guarantees data remains unaltered in transit and storage using cryptographic hashes and message digests.
• Availability ensures systems, networks, and applications remain operational and accessible to authorized users via redundancy and fault tolerance.
• Non-repudiation provides indisputable cryptographic proof of message origin and author identity using asymmetric digital signatures.
• AAA separates identity verification (Authentication), resource permission enforcement (Authorization), and audit logging (Accounting).

Every cybersecurity strategy anchors around the CIA triad: Confidentiality, Integrity, and Availability. Confidentiality prevents unauthorized disclosure through mechanisms like AES-256 encryption, access control lists, and data masking. Integrity preserves the accuracy and trustworthiness of information, verified via cryptographic hashing (SHA-256) where any bit alteration produces a radically different hash output.

Availability ensures authorized users have timely, reliable access to critical business resources. High availability (HA) is engineered through hardware redundancy (RAID, redundant power supplies, active-active server clusters), network resilience (BGP multi-homing, load balancing), and comprehensive disaster recovery facilities.

Beyond the CIA triad, non-repudiation is a critical legal and cryptographic requirement. Non-repudiation prevents an individual from denying the authenticity of a digital signature or transmission. It requires asymmetric cryptography: the sender hashes the message and encrypts the digest with their private key. Anyone possessing the sender's public key can verify the signature, proving beyond dispute that only the private key owner could have authored the message.

The AAA framework underpins identity governance. Authentication proves identity using passwords, biometrics, or hardware tokens. Authorization determines specific resource permissions and access boundaries based on least privilege. Accounting logs every user action, session duration, and command string into central audit trails for compliance and forensic investigation.

⚠️ Common Pearson VUE Exam Traps

• Believing symmetric encryption provides non-repudiation; because both sender and receiver share the identical key, neither can prove which party created the message.
• Conflating Authentication with Authorization; authentication verifies WHO you are, while authorization dictates WHAT you are permitted to do.