Lesson 1: Exam Notice, CIA Triad, AAA and Privacy

Course Notice: Read This First

ISC2 and CC are registered marks of ISC2, Inc. This course is independent. It is not affiliated with, endorsed or approved by ISC2, and it is not official training. The CC exam outline belongs to ISC2. You can download it free from ISC2's website, and this course does not reproduce it.

The current exam format:

• Length: 2 hours
• Items: 100-125, delivered by Computerized Adaptive Testing (CAT)
• Passing score: 700 out of 1000

This course cannot promise that you will pass.

Do this now: Download the current CC exam outline from isc2.org and keep it open. Tick off each topic as this course covers it.

Step 1: Learn the CIA Triad

The CIA triad is the base of security. Every security incident damages at least one of its three properties.

1. Confidentiality: only authorized people can see the information.
   • Example: An HR assistant emails the payroll spreadsheet to the wrong external address. Nothing was changed or deleted, but outsiders can now see salaries. That is a confidentiality breach.
   • Protected by: encryption, access permissions, a clean-desk policy.
2. Integrity: information stays accurate and complete, and only authorized people can change it.
   • Example: An attacker opens a supplier's invoice PDF and swaps in their own bank account number before Accounts Payable pays it. The data still exists and can still be reached, but it is wrong.
   • Protected by: hashing, change controls, approval workflows.
3. Availability: authorized people can reach systems and data when they need them.
   • Example: Ransomware encrypts the file server, and the warehouse cannot print shipping labels for two days.
   • Protected by: backups, redundancy, patching.

Do this: For any scenario, ask three questions. Who saw it? Was it changed? Can we still use it? Whichever answer went wrong tells you which property was hit.

Watch out: Ransomware often hits more than one property. If the attackers also steal and leak the files, confidentiality is harmed as well. The exam usually asks for the primary impact, which is the one the scenario stresses.

Step 2: Separate Authentication, Authorization and Accounting (AAA)

AAA controls how people use systems. It always runs in this order:

1. Identification: the user states who they are, for example by typing a username. This is a claim, not proof.
2. Authentication: the user proves the claim with a password, a security token or a fingerprint.
3. Authorization: the system decides what this proven user may do. For example, a sales rep can read the customer list but cannot open payroll.
4. Accounting: the system records what the user did, for example "jsmith exported 4,000 customer records at 23:14."

Office building analogy:

• Showing your badge at reception = authentication
• Your badge opening floor 3 but not the server room = authorization
• The door system logging every swipe = accounting

Do this: When a question describes a control, ask whether it proves identity, grants or limits rights, or records activity. Those three answers map to the three As.

Step 3: Understand Non-Repudiation

Non-repudiation means a person cannot believably deny an action they took, such as sending a message, approving a payment or signing a contract.

It rests on two tools:

1. Digital signatures. The sender signs with a private key that only they hold. Anyone can check the signature with the matching public key. A valid signature proves:

   • who sent the data (origin)
   • that the data was not changed (integrity)
   • that the signer cannot deny signing it (non-repudiation)

   A digital signature does not provide confidentiality, because it does not hide the content.

2. Logs (accounting). Logs that are tied to individual accounts and protected from tampering show who did what and when.

Example: A manager says, "I never approved that EUR 50,000 transfer." The approval carries her digital signature, and the audit log shows her authenticated session. She cannot credibly deny it.

Watch out: Shared accounts destroy non-repudiation. If five people use the "admin" login, the log cannot show which one acted.

Step 4: Tell Privacy Apart from Confidentiality

The two overlap, but they are not the same.

• Confidentiality is a security property. It keeps any sensitive information (trade secrets, source code, personal data) away from unauthorized eyes.
• Privacy is about individuals' rights over their personal data: what is collected, why, how it is used, who it is shared with and how long it is kept.

A company can keep data perfectly confidential and still breach privacy. Example: A retailer stores customer purchase histories securely, then uses them for a purpose customers were never told about. Nothing leaked, so confidentiality held, but privacy was violated.

Personal data, or personally identifiable information (PII), is any information that can identify a person directly or indirectly. Protect:

• names, home addresses, personal email addresses and phone numbers
• national ID or social security numbers, and passport numbers
• dates and places of birth
• biometric data such as fingerprints and face scans
• financial, medical, educational and employment records linked to a person

Do this: Before you share or reuse a dataset, ask two questions: "Does this identify a person?" and "Were they told we would use it this way?"

Where AI Fits In

• Confidentiality and privacy: Staff who paste customer records into a public AI chatbot may be exposing PII outside the organization.
• Integrity: AI training data or AI-generated output can be tampered with or simply be wrong, so check results before you act on them.
• Authentication: Attackers use AI-generated voice or video to impersonate executives. This is one reason why a familiar voice alone is weak proof of identity.

What the Exam Asks About This

• Scenario questions that ask which CIA property was primarily affected
• Placing identification, authentication, authorization and accounting in the right order, or naming the step a control performs
• Recognizing that digital signatures plus logs give non-repudiation, and that shared accounts undermine it
• Telling privacy (individual rights over personal data) apart from confidentiality (restricting access), and spotting what counts as PII

Key Takeaways

• Confidentiality = who can see it; Integrity = is it correct and unaltered; Availability = can we use it when needed.
• AAA order: authenticate (prove) → authorize (permit) → account (record). Identification (the claim) comes first.
• Non-repudiation = the person cannot deny the action. Digital signatures and tamper-protected, per-user logs provide it.
• Privacy covers how personal data is collected and used. Confidentiality covers who can access any sensitive data.
• PII is any data that identifies a person directly or indirectly.