Security fundamentals are the foundation of everything you will learn for the Cisco SCOR exam. They provide the language and logic that security professionals use to describe, analyse, and solve problems every day. Mastering these concepts is essential because the entire exam, from network security to cloud security, is built upon them.
Jump to a section
A simple way to picture Security Fundamentals and Concepts
A house's security system is a layered defence designed to protect valuable assets from a range of threats while balancing convenience, cost, and trust.
Consider your home. The core security principles map directly to IT. Confidentiality means the contents of your bedroom safe are seen only by you. Integrity means the letter in your mailbox has not been tampered with. Availability means you can unlock your front door when you return home.
Now, consider the people involved. You trust your family members with keys (authentication and authorisation). A risk assessment identifies that leaving a window open overnight creates a vulnerability. The threat is a burglar exploiting that open window to steal your laptop. Risk is the combination of the likelihood of a burglary and the potential loss.
Your security system provides AAA (Authentication, Authorisation, and Accounting). Authentication is proving you are who you claim to be by scanning your fingerprint. Authorisation determines that your fingerprint grants you access to the garage but not to the master bedroom safe. Accounting logs every time the door was unlocked, by whom, and at what time.
Finally, your 'policy' is the set of rules you set for the house: lock all doors at 10 PM, disarm the alarm by entering a code, and never share the alarm code with strangers. This analogy is specific because every element from a home security system has a direct counterpart in IT security, making the abstract concepts of CIA, AAA, trust, risk, threat, and vulnerability tangible.
Security fundamentals are the core principles and vocabulary used to protect computer networks, devices, and data. Think of them as the grammar of security language. You cannot build a secure network without understanding these building blocks.
The most important model is the CIA Triad. This is a security model that guides how organisations protect their information. CIA stands for Confidentiality, Integrity, and Availability. They are three separate goals that must be balanced. Confidentiality means ensuring that data is accessible only to authorised people. In practice, this is achieved using encryption, which scrambles data so it is unreadable without the correct key, and access controls, which limit who can view files. For example, a bank keeps your account balance confidential by encrypting it and requiring a password to see it. Integrity means ensuring data has not been altered in an unauthorised way. Hashing algorithms are used to create a unique digital fingerprint of data. If you download a software update, the website provides a hash value. After download, you recalculate the hash. If the values match, the file has integrity. If they differ, it has been tampered with. Availability means systems and data are accessible when authorised users need them. This is protected by redundancy (having backup servers), disaster recovery plans, and defending against denial-of-service attacks. For example, a hospital's patient database must be available 24/7, so they have backup power generators and duplicate servers.
Next is AAA, which stands for Authentication, Authorisation, and Accounting. This framework controls who can access a network, what they can do once inside, and what actions they performed. Authentication is the process of proving identity. Common methods are passwords, biometrics (fingerprint or facial recognition), and multi-factor authentication (MFA) which uses two or more different methods, such as a password and a code sent to your phone. Authorisation occurs after authentication. It determines what an authenticated user is allowed to do. For example, a junior employee may be authorised to view customer names but not their credit card numbers. Accounting, also called auditing, tracks what a user does. It logs every login, file accessed, and command executed. This is critical for investigating security incidents and ensuring accountability.
Trust is a foundational concept in security, but it has a specific meaning. Traditionally, networks assumed that everything inside the corporate network was 'trusted' and everything outside was 'untrusted'. This model is called the perimeter-based security model and is now considered flawed because threats can originate from inside or bypass the perimeter. Modern security uses a 'Zero Trust' model, which assumes no user, device, or network is trusted by default, even if they are inside the corporate firewall. Every access request must be verified. Trust is therefore a conditional, continuously verified state, not a permanent status.
Risk, threat, and vulnerability are three related but distinct concepts that professionals often confuse. A vulnerability is a weakness or gap in a security system. It could be a software bug, a missing security patch, a misconfigured firewall, or an unlocked server room door. A threat is any potential danger that could exploit a vulnerability. Threats can be hackers, malware, natural disasters, or even disgruntled employees. The threat is the actor or event that could cause harm. Risk is the potential for loss or damage when a threat exploits a vulnerability. Risk is calculated by considering two factors: the likelihood of the threat exploiting the vulnerability and the impact (the amount of damage) if it does. Security professionals perform risk assessments to identify, analyse, and prioritise risks and then decide how to manage them (by avoiding, reducing, transferring, or accepting the risk).
All of these concepts are interrelated. For example, a company might identify a vulnerability: its web server software is outdated. The threat is that a hacker could exploit this vulnerability to steal customer data. The risk is high because the data is sensitive (high impact) and the software is publicly accessible (high likelihood). The company implements a patch to reduce the risk, maintaining the integrity and confidentiality of the data. They use AAA to control who can apply the patch. This shows how security fundamentals are not abstract ideas but practical tools used daily.
Identify Assets
The first step in any security activity is to identify what you are protecting. This includes data (customer records, intellectual property), hardware (servers, routers), software (applications, databases), and people (employees). Knowing what you have is essential before you can assess risk or apply security controls.
Analyse Vulnerabilities and Threats
For each asset, you determine what vulnerabilities exist (weaknesses like outdated software or weak passwords) and what threats could exploit them (hackers, malware, natural disasters). This step helps you understand the specific dangers facing each asset.
Calculate and Prioritise Risk
You assess risk by considering the likelihood of a threat exploiting a vulnerability and the potential impact on the business. High-impact, high-likelihood risks are prioritised first. This step uses the vulnerability and threat information to create a ranked list of risks that need attention.
Implement Security Controls (CIA and AAA)
Based on prioritised risks, you select and deploy controls. For example, you might enforce MFA for Authentication, restrict access with Authorisation rules, enable logging for Accounting, encrypt data for Confidentiality, use hashing for Integrity, and add backup servers for Availability. Each control directly addresses a specific CIA or AAA requirement.
Monitor and Audit Continuously
Security is not a one-time activity. You must continuously monitor logs, review access patterns, and perform periodic risk reassessments. Accounting logs help detect suspicious behaviour, and continuous verification supports a Zero Trust model. This step ensures that controls remain effective and adapt to new threats.
Review and Update Policies
The organisation's security policy must be reviewed regularly to reflect changes in technology, regulations, and threats. This includes updating definitions of acceptable risk, refining trust models, and ensuring that all employees are trained on current security practices.
An IT security professional uses these fundamental concepts constantly, often without even consciously naming them. Consider a realistic scenario where you are a security analyst at a medium-sized company called 'GreenLeaf Retail' that sells clothing online and in physical stores. Your boss asks you to improve the company's security posture after a recent industry report showed increased attacks on retailers.
Step 1: You start by conducting a risk assessment. You gather information about the company's assets: customer database, payment processing system, employee email, inventory management, and the wireless network in stores. For each asset, you identify potential threats (hackers, malware, power outages) and vulnerabilities (outdated software, weak passwords on store routers, lack of encryption on customer data). You then calculate risk by estimating the likelihood of each threat exploiting each vulnerability and the potential business impact. For example, a breach of the payment system would have critical impact due to regulatory fines and customer distrust. You document all of this in a risk register.
Step 2: Based on the risk assessment, you prioritise risks. The highest risk is the customer database because it contains credit card numbers and is accessed by many employees. You decide to improve its Confidentiality by implementing stronger encryption and restricting access using AAA. You configure the database so that only specific IT staff are Authorised to run queries, and you enforce multi-factor Authentication for their accounts. You enable Accounting logs to record every query and who ran it.
Step 3: You address Integrity. You set up file integrity monitoring on the web server that hosts the online store. This tool calculates hashes of critical system files and alerts you if any file changes unexpectedly, which could indicate a hacker has modified the website to steal customer data. You also implement version control for all configuration changes so you can revert any unauthorised alteration.
Step 4: You improve Availability. You deploy a second web server in a different geographical region to act as a backup in case one data centre fails. You also configure rate limiting on the firewall to mitigate a potential DoS (Denial of Service) attack that could take the website offline.
Step 5: You develop a Zero Trust policy for the company. Instead of trusting all devices on the company network, you require every employee's laptop to be authenticated and scanned for antivirus compliance before it can access any internal resource. Even the CEO's device must prove it is healthy.
Throughout this process, you are constantly using the terms: assessing risk, identifying vulnerabilities, guarding against threats, applying AAA, balancing the CIA Triad, and redefining trust. It is not theoretical; it is how you decide which firewall rule to write, which patch to deploy, or which employee to grant access to. The exam will expect you to apply these terms in similar realistic scenarios.
The 350-701 exam tests your understanding of security fundamentals in two primary ways: definition-based questions and scenario-based questions. You must know the precise definitions and be able to apply them to a situation described in a paragraph.
For definition-based questions, the examiners love to test whether you can distinguish between closely related terms. Expect multiple-choice questions where four options look very similar, and the trick is that only one matches the exact definition of the term in the question stem.
Key traps and patterns to watch for:
The exam will present a scenario and ask: 'This is an example of a vulnerability, threat, or risk?' The trap is that beginners confuse vulnerability with threat. Remember: a vulnerability is the weakness (an unpatched server), a threat is the actor (a hacker scanning for unpatched servers), and risk is the potential damage (the server being compromised).
The CIA Triad questions often involve picking which element is most impacted in a given scenario. For example, if a hard drive fails and data is lost, Availability is affected. If someone deletes a log file to hide their tracks, Integrity is affected (the logs can no longer be trusted). If a hacker publishes customer credit card numbers, Confidentiality is breached.
AAA questions often focus on the order: Authentication must happen before Authorisation. A common trap question says 'A user is allowed to access the network. This is an example of AAA's _______ component.' The answer could be Authorisation if the question describes what they are allowed to do, not how they proved identity.
Trust: The exam may ask about the difference between traditional perimeter-based security and Zero Trust. The key point: Zero Trust does not mean 'no trust' — it means 'never trust, always verify'. The exam wants you to know that trust is not binary in Zero Trust; it is based on continuous verification.
Specific definitions you must memorise word-for-word:
Confidentiality: Preventing unauthorised disclosure of information.
Integrity: Ensuring data has not been modified in an unauthorised manner.
Availability: Ensuring systems and data are accessible when needed.
Authentication: Verifying the identity of a user or device.
Authorisation: Determining what an authenticated entity is allowed to do.
Accounting: Recording and auditing actions performed.
Vulnerability: A weakness in a system that can be exploited.
Threat: Any potential danger that could exploit a vulnerability.
Risk: The potential for loss or damage when a threat exploits a vulnerability.
Practice by reading scenario questions and identifying each element. The exam will twist the wording, so knowing the core meaning is more reliable than memorising phrases. Also, note that the exam often uses 'AAA' without spelling it out; you must know it stands for Authentication, Authorisation, and Accounting.
The CIA Triad consists of three distinct goals: Confidentiality (preventing unauthorised viewing), Integrity (preventing unauthorised alteration), and Availability (ensuring access when needed).
AAA stands for Authentication (proving identity), Authorisation (granting permissions based on identity), and Accounting (logging actions for accountability).
A vulnerability is a weakness, a threat is a potential danger that could exploit that weakness, and risk is the potential damage calculated from the combination of threat likelihood and impact.
In the Zero Trust model, no user or device is automatically trusted, even if they are inside the corporate network, and every access request must be continuously verified.
Encryption is the primary method to ensure Confidentiality, hashing ensures Integrity, and redundancy ensures Availability.
Risk assessment involves identifying assets, threats, and vulnerabilities, then analysing and prioritising risks to decide how to treat them: avoid, reduce, transfer, or accept.
These come up on the exam all the time. Here's how to tell them apart.
Vulnerability
A weakness or gap in security (e.g., outdated software).
Exists regardless of whether anyone tries to exploit it.
Can be fixed with patches or configuration changes.
Threat
A potential danger that could exploit a vulnerability (e.g., a hacker).
Exists independently of the vulnerability.
Cannot be eliminated, only defended against.
Confidentiality
Ensuring data is not seen by unauthorised parties.
Primary goal is privacy; enforced via encryption and access controls.
Breached if data is leaked or read by a hacker.
Integrity
Ensuring data has not been altered without authorisation.
Primary goal is accuracy; enforced via hashing and version control.
Breached if data is changed or deleted by a hacker.
Authentication
Step that occurs first: verifying identity.
Answers: 'Who are you?'
Examples: password, fingerprint, smart card.
Authorisation
Step that occurs after authentication: granting permissions.
Answers: 'What are you allowed to do?'
Examples: read, write, execute, delete.
Traditional Security Model
Everything inside the network is trusted by default.
Trust is based on location (inside vs. outside).
Vulnerable to internal threats and lateral movement.
Zero Trust Model
No user or device is trusted by default, even inside.
Trust is based on continuous verification of identity and device health.
Defends against internal and external threats equally.
Risk
Combination of likelihood and impact of a threat exploiting a vulnerability.
A calculation used to prioritise security efforts.
Can be low, medium, or high depending on both factors.
Impact
Only one component of risk: the amount of damage if a threat succeeds.
Measured in cost, reputation, or operational loss.
High impact does not necessarily mean high risk if likelihood is very low.
Accounting (AAA)
Specifically refers to logging user actions after authentication and authorisation.
Focuses on accountability: who did what and when.
Part of the AAA framework, tightly coupled with access control.
Monitoring
Broader term that includes real-time observation of systems and networks.
Focuses on detection: unusual patterns, anomalies, threats.
Encompasses Accounting but also includes alerts, traffic analysis, and behavioural analytics.
Mistake
Confidentiality and Integrity mean the same thing because both involve keeping data safe.
Correct
Confidentiality is about who can access data (privacy), whereas Integrity is about whether data has been altered (accuracy). A hacker can break confidentiality by reading data without changing it, and can break integrity by altering data without reading it.
Beginners see both concepts as 'keeping data safe' without distinguishing between the specific goals of privacy versus accuracy. It requires careful reading of definitions to separate the two.
Mistake
A strong password system fulfils all three legs of the AAA model (Authentication, Authorisation, and Accounting).
Correct
A password only handles Authentication (proving identity). Authorisation requires separate rules about what that identity can do, and Accounting requires logging their actions. A password alone does not grant or restrict permissions or create an audit trail.
People naturally associate AAA with 'logging in', so they assume a login system covers everything. They do not realise Authorisation and Accounting are distinct processes that require additional configuration.
Mistake
Risk is the same as a threat, just a fancier term.
Correct
Risk is the calculation of potential loss based on both threat likelihood and impact. A threat is the actor or event (e.g., a hacker), whereas risk is 'how bad could it be if the hacker succeeds, and how likely is it?'. There is a high risk even with a low threat if the impact is catastrophic.
In everyday language we say 'there is a risk of storms', conflating the hazard with the risk. The exam demands a strict separation.
Mistake
If a system is fully patched and has no known vulnerabilities, it is completely secure.
Correct
Security is never absolute. There are always unknown vulnerabilities (zero-day exploits), misconfigurations, or human errors. Additionally, vulnerabilities exist in processes and people, not just software. Being fully patched reduces risk but does not eliminate it.
Beginners want a binary 'secure or insecure' view. The concept of risk management, where security is about reducing risk to an acceptable level, feels uncomfortable and less definitive.
Mistake
Trust in security means you believe someone is honest, like trusting a friend with a secret.
Correct
In IT security, trust is a technical concept about access control. It means 'this user or device has been verified to meet certain security policies.' It is not about moral character. A trusted user can still make mistakes or be compromised.
The emotional meaning of 'trust' is so strong that beginners apply it to security, leading them to think trust is based on personal relationships rather than technical verification.
Mistake
The CIA Triad only applies to data stored on servers, not to data in transit or data being processed.
Correct
The CIA Triad applies to data in all states: at rest (stored on a hard drive), in transit (travelling over a network), and in use (being processed in memory). Each state has different protection methods, but all three goals apply.
Beginners often think about data only when it is stored in a database. They forget that data is vulnerable when it is being sent over Wi-Fi or being used by an application.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Yes, the CIA Triad is the foundational model for all security, including cloud security. Cloud providers still aim to keep your data confidential, ensure it is not tampered with, and keep systems available. The methods used (encryption, access controls, redundancy) may differ, but the goals remain the same.
A threat is something that could cause harm, like a hacker or a storm. Risk is the chance that the harm will actually happen, combined with how bad it would be. You cannot eliminate a threat, but you can reduce the risk by addressing vulnerabilities or decreasing the potential impact.
AAA is a framework for controlling access to resources, while CIA Triad defines the desired security outcomes. AAA helps achieve Confidentiality by limiting who can see data, helps Integrity by controlling who can modify data, and helps Availability by ensuring that only authorised users can access systems, preventing denial of service by unauthorised users.
Yes, you must know the exact definitions, especially for CIA, AAA, vulnerability, threat, and risk. The exam will present multiple-choice options that are very similar, and only the precise definition will be correct. Practice paraphrasing them in your own words but be able to recognise the textbook version.
Zero Trust is a security model that assumes no user or device is inherently trusted, even inside the corporate network. Every request is verified based on identity, device health, and context. It is important because the exam tests your understanding of traditional versus modern security models.
Yes. Availability and Integrity are separate goals. A system that is always online (high availability) could still have been hacked and had its data modified without authorisation (low integrity). For example, a public website that loads quickly but displays incorrect information because hackers changed the content.
You've finished Security Fundamentals and Concepts. Continue through the 350-701 study guide to build a complete picture of the exam.
Done with this chapter?