CIA, Security Controls, Defense-in-Depth, and Data Law

2.1.F.1Concept

The CIA Triad

Nearly every security control that exists is protecting at least one of three principles:

Confidentiality
Only authorized individuals, systems, or processes can access data.
Lacking this: vulnerable to data theft or destruction
Integrity
Data are accurate and trustworthy.
Lacking this: vulnerable to data manipulation
Availability
Data and services are accessible to authorized users when needed.
Lacking this: may experience unexpected downtime
2.1.F.2–3Control

Classifying Security Controls

Security controls can be classified two completely different ways at once — by type (where the control operates) and by function (what the control does). The same control gets both labels.

By typeExamples
PhysicalLocks, fences, cameras, bollards, security guards
TechnicalFirewalls, anti-malware software, encryption
ManagerialPassword policies, access reviews, incident response plans
By functionExamples
PreventativeLocks, encryption — stop an attack before it starts
DetectiveIDS, cameras, SIEM systems — identify attacks as they happen
CorrectivePatching, IPS, repairs — restore a system after an incident
🗂️ Control Classifier — pick an example
2.1.GConcept

Defense-in-Depth: Why One Control Is Never Enough

A defense-in-depth strategy layers multiple types of security controls together. It matters for two reasons: different threats are best addressed by different controls, and when one layer fails or gets bypassed, another layer may still hold — limiting the damage instead of leaving a single point of failure.

🛡️ Defense-in-Depth — click each layer
Training, awareness, and Codes of Conduct — the layer that stops social engineering from working in the first place.
💡Notice that these six layers map almost exactly onto this entire course so far: Human (Codes of Conduct, social engineering awareness), Physical, Network (firewalls), Device (anti-malware, patching), Application, and Data (encryption). You've been building defense-in-depth one unit at a time without necessarily calling it that.
5.2.AConcept

Classifying Data — and the Laws Behind It

Organizations apply security based partly on what kind of data they're protecting. Three categories carry specific legal weight:

🏷️ Data Classification — click each type
Personally Identifiable Information
Examples: Name, address, SSN, date of birth, biometric data
Governed by: Privacy Act of 1974 + COPPA (children under 13)
⚠️Keep these four laws straight — this is a genuine exam trap: HIPAA protects health data (PHI). COPPA protects children under 13. PCI-DSS protects payment card data. The Privacy Act of 1974 protects federal agency records. Four different laws, four different data types — mixing any of them up costs points.

Data classification also depends on its state: data at rest (stored on a drive), in transit (being sent between devices), or in use (actively being processed) — each state calls for a different mix of protections, since data being actively used has to be unencrypted to be usable at all.

ExampleGuided Example — Classifying a Real Scenario

A pediatric clinic's app stores each patient's name, date of birth, and treatment history, and processes credit card payments for appointments.

Step 1Identify the PII
Name and date of birth are PII — governed here by both the Privacy Act of 1974 and, since patients are children, COPPA.
← Back to Activity 2.1.1Next: Activity 2.1.2 →Passive Analysis.