CIA, Security Controls, Defense-in-Depth, and Data Law
2.1.F.1Concept
The CIA Triad
Nearly every security control that exists is protecting at least one of three principles:
Confidentiality
Only authorized individuals, systems, or processes can access data.
Lacking this: vulnerable to data theft or destruction
Integrity
Data are accurate and trustworthy.
Lacking this: vulnerable to data manipulation
Availability
Data and services are accessible to authorized users when needed.
Lacking this: may experience unexpected downtime
2.1.F.2–3Control
Classifying Security Controls
Security controls can be classified two completely different ways at once — by type (where the control operates) and by function (what the control does). The same control gets both labels.
Locks, encryption — stop an attack before it starts
Detective
IDS, cameras, SIEM systems — identify attacks as they happen
Corrective
Patching, IPS, repairs — restore a system after an incident
🗂️ Control Classifier — pick an example
2.1.GConcept
Defense-in-Depth: Why One Control Is Never Enough
A defense-in-depth strategy layers multiple types of security controls together. It matters for two reasons: different threats are best addressed by different controls, and when one layer fails or gets bypassed, another layer may still hold — limiting the damage instead of leaving a single point of failure.
🛡️ Defense-in-Depth — click each layer
Training, awareness, and Codes of Conduct — the layer that stops social engineering from working in the first place.
💡Notice that these six layers map almost exactly onto this entire course so far: Human (Codes of Conduct, social engineering awareness), Physical, Network (firewalls), Device (anti-malware, patching), Application, and Data (encryption). You've been building defense-in-depth one unit at a time without necessarily calling it that.
5.2.AConcept
Classifying Data — and the Laws Behind It
Organizations apply security based partly on what kind of data they're protecting. Three categories carry specific legal weight:
🏷️ Data Classification — click each type
Personally Identifiable Information
Examples: Name, address, SSN, date of birth, biometric data
Governed by: Privacy Act of 1974 + COPPA (children under 13)
⚠️Keep these four laws straight — this is a genuine exam trap: HIPAA protects health data (PHI). COPPA protects children under 13. PCI-DSS protects payment card data. The Privacy Act of 1974 protects federal agency records. Four different laws, four different data types — mixing any of them up costs points.
Data classification also depends on its state: data at rest (stored on a drive), in transit (being sent between devices), or in use (actively being processed) — each state calls for a different mix of protections, since data being actively used has to be unencrypted to be usable at all.
ExampleGuided Example — Classifying a Real Scenario
A pediatric clinic's app stores each patient's name, date of birth, and treatment history, and processes credit card payments for appointments.
Step 1 — Identify the PII
Name and date of birth are PII — governed here by both the Privacy Act of 1974 and, since patients are children, COPPA.