Domain 1 · Security Principles · Lesson 1 of 5
Protect information with clear security principles
About 16 minutes · Introductory draft · Checked 2026-10-22
AI editorial review for introductory study; independent review and complete exam alignment remain pending. Read course scope and remaining gaps.
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
What you will learn
- Distinguish confidentiality, integrity and availability in a practical situation.
- Separate a threat, vulnerability and risk before choosing a control.
- Explain why privacy and trustworthy AI data need more than secrecy.
Start with the information and its purpose
Confidentiality limits disclosure to approved recipients. Integrity protects information from improper change. Availability means authorized users can obtain the service or information when needed. A public emergency notice can have low secrecy needs and very high integrity and availability needs. Choose protections around the information’s purpose rather than treating every file alike.
Privacy concerns appropriate collection, use and retention of personal information. Encrypting a customer list does not justify collecting unnecessary personal details. Identify the owner, intended users and permitted uses before selecting technology.
Describe the risk before buying a control
A threat is a possible cause of harm, such as a thief. A vulnerability is a weakness, such as an unlocked equipment room. Risk considers how an unwanted event could affect an objective, including its likelihood and impact. A useful statement links an asset, weakness, event and consequence: a stolen unencrypted laptop could expose customer records and interrupt support.
Controls can be administrative, technical or physical. Training, access restrictions and locked cabinets address different parts of that example. Preventive controls try to stop an event; detective controls reveal it; corrective controls help restore an acceptable condition. A control reduces some risks rather than proving that no risk remains.
Apply the same principles to AI
An AI assistant may expose confidential input, produce inaccurate output or become unavailable. Incorrect or maliciously altered training data can affect integrity. Use approved tools and approved data, check important output against evidence, and keep a named person responsible for consequential decisions. A fluent response is not proof of correctness.
Work within your assigned authority. If you find a weakness, preserve the minimum information needed to explain it and use the reporting process. Reading someone else’s private records to demonstrate curiosity is not professional conduct.
Work through a scenario
Fictional facts for learning. This exercise is not scored.
A clinic publishes appointment hours online. An unauthorized edit changes the opening time, while the site stays online. Which security property failed, and what evidence would help?
Compare your reasoning
Integrity failed because the published information was improperly changed. Compare the approved schedule with the page and its change log, preserve the relevant timestamps, report the issue and restore through the approved process. Availability alone would not show that the hours were correct.
Applied study · Added 2026-10-22
Choose controls for the actual security property
Continue beyond the introduction. Work through the evidence before opening the model answer.
See it · Try it · Recall it
Picture the topic
Remember this: CIA describes outcomes; AAA describes access decisions.
Explore the anchors
Limit unauthorized reading.
Concept matching activity
Match this task or description to its concept:
Prevent improper alteration.
Choose a concept before checking the explanation.
Access-decision sandbox
Try to edit a fictional record as a reader. Then change one condition and evaluate again. This simplified policy requires authentication, object scope and action permission; real policies have more conditions.
Change the request, then evaluate it.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
Visual recap for topic 1.1. Open its full syllabus chapter.
Separate identity, permission and evidence
Authentication establishes an identity claim; authorization decides what that identity may do; accounting records activity for later review. A successful sign-in does not establish permission to every record. Integrity means protection against improper change, while availability concerns authorized use when needed. A hash can help detect changes when compared with a trusted value; it does not encrypt the file, identify the editor or restore the original. Keep the reference hash and verification process protected. A digital signature can support origin and integrity checks, but its usefulness also depends on trustworthy keys and validation.
Use risk reasoning before selecting a control
Describe the asset, threat, weakness and consequence before assigning a priority. Distinguish preventive controls from detection and recovery: a door lock restricts entry, a visitor log supports investigation and a tested recovery process restores service. One measure can have more than one purpose. A control category such as physical or administrative describes how it operates, not whether it is effective. When records conflict, preserve the approved evidence, report the limitation and ask the responsible owner for a decision. Professional conduct requires using only authorized data and reporting findings accurately, including when the result is inconvenient.
Evidence case
Fictional facts for learning; no real organization or person is described.
- A clinic publishes appointment times online. A visitor can view the public page but should not edit it.
- The application signs in staff correctly, but any signed-in staff account can change every clinic schedule. A daily backup is available.
Your task
- Identify the failed security property and the missing authorization boundary.
- Explain what the backup can and cannot address.
Compare with the model answer
Integrity is at risk because the application allows changes outside an approved staff role. Authentication is already present; adding another sign-in check alone does not fix authorization. Restrict edits by role and clinic, log the changes and test both allowed and rejected requests. Backups support recovery after improper changes but do not prevent them. Use synthetic schedules in the test and keep a record of who approved the access rules.
This case has two original scenario questions in the expanded practice bank. Practice this course · Edition, coverage and remaining study
Remember
- Classify the business consequence, not just the technology.
- Combine controls and retain accountability for residual risk.
- Approved AI use still requires data protection and human judgment.
Orientation and further reading
Original examples and explanations. Background references do not establish complete exam coverage.