Information security keeps digital information safe from threats, just as a lock keeps your house safe from intruders. For the CC exam, you must understand the four core principles that security professionals use every day to protect data. These principles are not just theory — they guide every decision about passwords, encryption, backups, and access controls.
Jump to a section
A simple way to picture Introduction to Security Principles
A front door is the primary barrier between your private home and the outside world. It keeps your possessions secure, controls who enters, and ensures you can access your own space when needed. The lock on the door handles confidentiality by preventing unauthorised people from seeing what is inside. The door itself, with its hinges and solid construction, maintains integrity because it keeps your belongings in their original state, protecting them from being damaged or stolen. Availability means the door will open for you when you have the correct key, but it will not jam shut or break, blocking your own access. Non-repudiation is like the door having a logs or a camera that records exactly who entered with which key, so you cannot deny that you used your key to come in last night. If the lock has a broken spring, the door fails confidentiality. If someone forces the door open and breaks it, integrity is lost. If the key breaks in the lock, availability is gone. If the security camera footage is erased, non-repudiation is lost. This simple daily scenario maps perfectly to the four pillars of information security that the CC exam will test.
The four fundamental concepts of information security are confidentiality, integrity, availability, and non-repudiation. They form the foundation of every security policy, every firewall rule, and every incident response plan. Let us break them down one by one.
Confidentiality means ensuring that only authorised people can see sensitive information. If you send a private message to a friend, you expect it to be read only by them. In computing, confidentiality is achieved through encryption, which scrambles data so that it is unreadable without the correct decryption key. Strong passwords and access controls (like permissions on a shared drive) also enforce confidentiality. A breach of confidentiality happens when a hacker steals credit card numbers from a database.
Integrity ensures that information has not been tampered with or altered in an unauthorised way. When you download a file from the internet, you want to be sure it is exactly what the creator intended, not a version infected with malware. Hashing is a common technique used to verify integrity. A hash is like a digital fingerprint of the data; if even one letter changes, the hash changes completely. Version control systems and file permissions also protect integrity. If someone modifies a financial record to steal money, integrity is broken.
Availability means that information and systems are accessible when needed by authorised users. If a website is down during a sale, or a hospital cannot access patient records, availability has failed. Denial-of-service (DoS) attacks are designed specifically to disrupt availability by overwhelming a system with traffic. Redundancy — having backup servers or power supplies — supports availability because if one component fails, another takes over.
Non-repudiation is the ability to prove that a particular action or event actually occurred. It prevents someone from denying that they performed an action, such as sending an email or approving a transaction. Digital signatures, which combine hashing and encryption, provide non-repudiation. For example, if you digitally sign a contract, you cannot later claim that you did not agree to it. Audit logs also support non-repudiation by recording who accessed what and when.
These four concepts together are often called the CIA triad plus non-repudiation. Security professionals use them as a checklist when designing systems. You might hear a security expert say, 'We need to improve confidentiality on this server by encrypting the data, but we also must ensure availability by having a backup plan.' Balancing these principles is a daily challenge.
Real-world examples include:
A bank's online portal: confidentiality protects your account balance, integrity ensures deposits are recorded correctly, availability means you can log on whenever you need, and non-repudiation logs every transfer you make.
An email system: confidentiality prevents eavesdroppers reading your messages, integrity stops someone altering the content before delivery, availability ensures you can send and receive emails, and non-repudiation proves an email was sent and received.
A hospital's patient records: confidentiality protects medical history, integrity ensures drug dosages are not altered, availability means doctors can access records during an emergency, and non-repudiation tracks who accessed each record.
The CC exam will ask you to identify which principle is violated in a given scenario. For example, if a hacker steals a password file, that is a breach of confidentiality. If an attacker changes the amount in a transaction, that is an integrity failure. If a server crashes during a critical operation, that is an availability issue. If a user claims they never sent a message that they did send, that is a non-repudiation problem.
To remember them, think of the CIA acronym plus N. Confidentiality is 'keep it secret'. Integrity is 'keep it accurate'. Availability is 'keep it accessible'. Non-repudiation is 'keep it provable'. You must be able to distinguish between them because the exam will present scenarios and ask which is most affected.
Identify the Assets
Determine what information, systems, or hardware needs protection. For example, a customer database, an email server, or a payroll file. This is the first step because you cannot protect what you do not know exists.
Classify the Sensitivity
Label each asset by its sensitivity level: public, internal, confidential, or restricted. This classification determines how much protection is needed. For instance, confidential data requires encryption (confidentiality) and access controls, while public data does not.
Apply Confidentiality Controls
Implement measures to prevent unauthorised access. This includes encryption, strong passwords, and access control lists (ACLs). If the asset is a patient record, you encrypt it so that only authorised doctors can read it.
Apply Integrity Controls
Set up mechanisms to detect and prevent unauthorised changes. Use hashing to verify data has not been altered, and enable audit logs to track modifications. For a financial database, this means logging every transaction and checking hashes daily.
Ensure Availability and Non-Repudiation
Create backups and redundancy plans to guarantee availability. Deploy digital signatures and audit trails to achieve non-repudiation. For an online store, you would have a backup server ready if the main one fails, and you would digitally sign all orders to prove customers placed them.
Imagine you work as a junior IT support specialist at a mid-sized company called GreenLeaf Services. Your manager asks you to help protect the company's client database after a recent scare where a competitor accessed sensitive pricing information. Here is what you would actually do using the CIA triad and non-repudiation.
First, you audit who has access to the database right now. You find that every employee, including interns, can read the full pricing list. This is a confidentiality failure because unauthorised people can see sensitive data. You create a new access control list (ACL) that restricts read access to only the sales team and management. You also enable encryption on the database so that even if the file is stolen, it cannot be read without the key.
Next, you check integrity. You discover that someone manually edited a pricing record last week and the change was not logged. To fix this, you implement a change control policy: every update to the database must be approved and logged. You also set up database auditing, which records who changed what and when. You configure automated alerts for any unauthorised modifications.
For availability, you realise the database is stored on a single server with no backup. If the server crashes, the entire company would lose access to client information. You set up a daily automated backup to a separate cloud server. You also test a disaster recovery plan: a step-by-step procedure to restore the database within four hours.
Finally, you address non-repudiation. The company needs proof that sales quotes were sent to clients. You implement a digital signature tool for all outgoing contracts. When a salesperson sends a quote, they sign it digitally. The system logs the time, the sender's identity, and the exact content. If a client later claims they never received a quoted price, the company has irrefutable proof that the quote was sent and signed.
You then create a report for your manager summarising the changes:
Implemented role-based access control (RBAC) to enforce confidentiality.
Enabled hashing and audit logs to protect integrity.
Configured automated backups and a disaster recovery plan to ensure availability.
Deployed digital signatures for all client communications to provide non-repudiation.
This is a realistic day in the life of a security-conscious IT professional. You constantly balance these four principles. If you make the database too secure (e.g., requiring three passwords), you might hurt availability because users cannot log in quickly. If you focus only on availability (e.g., giving everyone full access), you sacrifice confidentiality. The skill is finding the right trade-off for the specific situation.
The CC exam will test your knowledge of the CIA triad plus non-repudiation in several question formats. The most common questions are scenario-based: they describe a situation and ask which principle is most clearly violated. You must be able to pick the correct one from the four options.
Key topics you must memorise:
The definition of each principle (confidentiality, integrity, availability, non-repudiation).
The difference between integrity and non-repudiation (integrity is about data being unchanged; non-repudiation is about proving an action occurred).
Examples of attacks that target each principle.
How controls like encryption, hashing, backups, and digital signatures map to principles.
Common traps the exam sets:
They might describe a data breach (e.g., someone stealing a database) and some students mistakenly choose 'integrity' because the data was taken, but the primary violation is confidentiality because information was exposed to an unauthorised person.
They might describe a system crash and students confuse it with a loss of integrity. Remember: a crash means the data is not accessible, so it is an availability issue.
They might describe a user denying they sent an email, and students pick 'integrity' because the email content might have been altered. But the core problem is non-repudiation — you cannot prove who sent it.
They might present a scenario where data is corrupted (e.g., a ransom-ware attack encrypts files and changes them). That violates integrity because the original data was modified without authorisation.
Question patterns you will see:
'Which of the following is a violation of confidentiality?' (Options: deleting a file, stealing a password file, corrupting a database, server downtime.) Correct answer: stealing a password file.
'What does a digital signature provide?' (Options: confidentiality, integrity, availability, non-repudiation.) Correct answer: non-repudiation.
'A company's website goes down during a peak shopping day. Which principle is most affected?' (Options: confidentiality, integrity, availability, non-repudiation.) Correct answer: availability.
You should also be ready to match security controls to principles. For example:
Encryption maps to confidentiality.
Hashing maps to integrity.
Backups and redundancy maps to availability.
Digital signatures and audit logs map to non-repudiation.
The exam will not ask you to spell out the definitions from memory. You must apply them. Practise by reading short security incident summaries online and identifying which principle was violated. The more you do this, the faster you will recognise the pattern.
Finally, be aware that the exam sometimes combines two principles in one scenario. For instance, a ransom-ware attack both encrypts data (making it unavailable) and threatens to delete it (which would violate integrity if the deletion happened). In such cases, the exam typically asks for the most directly affected principle. Focus on the immediate action: did the attacker steal data? (confidentiality) Did they modify data? (integrity) Did they prevent access? (availability) Did they make an action deniable? (non-repudiation).
Confidentiality ensures that sensitive information is only accessible to authorised individuals, protected by encryption and access controls.
Integrity guarantees that data has not been tampered with; hashing and version control are common integrity mechanisms.
Availability means systems and data are accessible to authorised users when needed, supported by backups and redundancy.
Non-repudiation provides proof that a specific action occurred, typically achieved through digital signatures and audit logs.
A data breach primarily violates confidentiality, not integrity, because the data is exposed but not necessarily altered.
The CIA triad plus non-repudiation form the foundation of every security policy and are tested heavily in scenario-based CC exam questions.
Digital signatures provide non-repudiation, not confidentiality; they prove who sent a message but do not keep it secret.
A denial-of-service attack targets availability by overwhelming a system so legitimate users cannot access it.
These come up on the exam all the time. Here's how to tell them apart.
Confidentiality
Ensures data is not seen by unauthorised people
Protected by encryption and access controls
Breach example: hacker steals a password file
Integrity
Ensures data is not altered by unauthorised people
Protected by hashing and change logs
Breach example: attacker modifies a bank transaction
Integrity
Focuses on the state of data (unchanged)
Verifies data has not been tampered with
Achieved through hashing and checksums
Non-Repudiation
Focuses on proof of an action (who did what)
Verifies the identity of the person who performed an action
Achieved through digital signatures and audit logs
Availability
Ensures authorised users can access data when needed
Threatened by denial-of-service attacks and hardware failures
Supported by backups and failover systems
Confidentiality
Ensures unauthorised users cannot access data
Threatened by hacking, phishing, and weak passwords
Supported by encryption and access controls
Mistake
Confidentiality and integrity are the same thing.
Correct
Confidentiality is about keeping data secret from unauthorised people. Integrity is about ensuring data is not altered or corrupted. A data breach (confidentiality failure) does not necessarily change the data (integrity failure).
Beginners often lump them together because both are about 'protecting' data, but they address different threats: spying (confidentiality) versus tampering (integrity).
Mistake
Non-repudiation is just another word for authentication.
Correct
Authentication verifies who you are at the moment of login. Non-repudiation provides proof that a specific action (like sending a message) was performed by a specific person, which persists and can be verified later. Authentication alone does not prevent a user from denying an action.
The terms sound similar and both deal with identity, so students confuse the timestamped record of an action with the initial identity check.
Mistake
Availability means the data is always accessible to everyone.
Correct
Availability means data and systems are accessible to authorised users when needed. Unauthorised users should not have access. Overly broad access (making data available to everyone) actually harms confidentiality, not aids availability.
Beginners hear 'available' and think 'open to all', but in security, availability is about reliable access for the right people, not the public.
Mistake
Integrity is only about the data not being deleted.
Correct
Integrity is about data being accurate and unchanged from its original state. Deletion is one type of integrity violation, but so is unauthorised modification, corruption, or insertion of false data. A file that has been altered by 1% still has lost integrity.
Deletion is a dramatic and easy-to-imagine violation, so students neglect subtler forms like data manipulation, which are common in fraud.
Mistake
Non-repudiation is only needed in legal situations.
Correct
Non-repudiation is used in everyday business operations: confirming that a purchase order was submitted, an email was received, or a record was accessed. It is essential for audit compliance, customer dispute resolution, and internal accountability, not just court cases.
The term sounds formal and legalistic, so beginners assume it only matters when lawyers are involved, but it is a practical security control used daily.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
The CIA triad stands for confidentiality, integrity, and availability. These three principles form the foundation of information security, guiding how data is protected from unauthorised access, tampering, and downtime.
Integrity ensures data has not been altered without authorisation. Non-repudiation proves that an action (like sending a message) was performed by a specific person. Integrity is about the data's state; non-repudiation is about accountability for actions.
Encryption primarily protects confidentiality by making data unreadable to unauthorised parties. It can also support integrity when combined with hashing, but its core purpose is keeping secrets secret.
A denial-of-service (DoS) attack is a classic availability attack. It floods a server with traffic so that legitimate users cannot access the website or service.
No, a digital signature provides non-repudiation and integrity, not confidentiality. It proves who signed the data and that the data was not changed, but it does not encrypt the content.
Ask yourself: was data stolen or exposed? (confidentiality) Was data modified? (integrity) Is the system unavailable? (availability) Is there a dispute over who performed an action? (non-repudiation). Choose the most directly affected principle.
You've finished Introduction to Security Principles. Continue through the CC study guide to build a complete picture of the exam.
Done with this chapter?