Domain 1 · Objective reference 1.1 · Chapter 1 of 19
Security properties, identity and privacy
About 6 minutes · ISC2 CC outline effective 1 September 2026
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: CIA describes outcomes; AAA describes access decisions.
Explore the anchors
Limit unauthorized reading.
Concept matching activity
Match this task or description to its concept:
Prevent improper alteration.
Choose a concept before checking the explanation.
Access-decision sandbox
Try to edit a fictional record as a reader. Then change one condition and evaluate again. This simplified policy requires authentication, object scope and action permission; real policies have more conditions.
Change the request, then evaluate it.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- What each property protects
- Authentication, authorization and accounting
- Distinguish a property from a control
What each property protects
Confidentiality limits disclosure to authorized parties. Integrity protects information and processing from improper change. Availability makes an agreed service usable by authorized people when needed. These properties can fail independently: a public timetable can remain available while displaying altered times, and a perfectly encrypted archive can be unavailable because its only key was lost. Begin by naming the property and the affected business activity, then choose a control that addresses that failure.
Authenticity concerns whether an entity or message is what it claims to be. Non-repudiation concerns evidence that supports attributing an action so it cannot simply be denied. A digital signature can support that evidence when keys, identity binding, timestamps and validation are trustworthy. It does not prove that the signer understood a document or that every statement in it is true.
Authentication, authorization and accounting
Authentication evaluates an identity claim. Authorization decides whether that identity may perform a specific action on a resource. Accounting records attributable activity for review. A successful login does not authorize every record, and an activity log does not prevent a forbidden action unless another control enforces the rule.
Privacy concerns appropriate processing of information about people, including purpose, collection, use, sharing and retention. Encryption alone does not make unnecessary collection appropriate. An organization can protect a dataset from outsiders while still using it for an unauthorized purpose. For an automated assistant, give its service identity only necessary access and retain accountable records of important actions without indiscriminately logging private prompts or secrets.
Distinguish a property from a control
A property is an outcome to protect; a control is a mechanism intended to support it. Encryption can support confidentiality. An access rule may support both confidentiality and integrity by limiting reads and edits. A backup supports restoration, but an unprotected backup can create a confidentiality problem of its own. Always name the asset and action before classifying the effect.
For AI training data, unauthorized disclosure affects confidentiality, poisoning affects integrity and loss of required data or compute can affect availability. An AI-generated action should still be attributable to the service identity and approved workflow. These examples apply existing security properties; they do not create a separate exemption from normal access and data-handling requirements.
| Concept | Question to ask | Example control |
|---|---|---|
| Confidentiality | Who may see it? | Approved read permissions |
| Integrity | Who may change it, and how is change detected? | Edit authorization and trusted verification |
| Availability | Can authorized work continue? | Redundancy and tested recovery |
| Authentication | Who is making the claim? | Verified account and authenticator |
| Authorization | May this identity perform this action? | Resource-level permission check |
| Accounting | What attributable action occurred? | Protected activity record |
Worked example
A clinic restricts patient records to care staff, checks the integrity of prescription changes and provides a downtime procedure. These address different properties. If every authenticated employee can edit prescriptions, stronger login alone does not fix the missing permission decision.
Check your understanding
An encrypted payroll file is readable only by its owner, but nobody can open it after the key is lost. Which property failed, and what preparation was missing?
Show explanation
Availability failed. Key recovery and continuity arrangements need to be designed and tested alongside encryption. Confidentiality may still hold; that does not make the service usable.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.