How confidentiality, integrity, availability, AAA, non-repudiation, least privilege, and zero-trust architecture guide security design.
| Principle | Purpose |
|---|---|
| Confidentiality | Limit information access to authorized people and systems |
| Integrity | Keep data and system state accurate and protected from unauthorized change |
| Availability | Keep systems and data reachable when needed |
| Authentication | Verify an identity |
| Authorization | Determine allowed actions |
| Accounting | Record access and actions |
| Non-repudiation | Provide evidence that an entity performed an action and cannot credibly deny it |
Zero trust is an architectural approach, not a single product. It emphasizes explicit verification, least privilege, assumption of breach, and continuous evaluation of identity, device, context, and resource policy.
1Identity and device signals → policy decision → narrowly scoped resource access → logging and ongoing evaluation
Network location alone is not sufficient justification for broad access. Apply segmentation, strong identity controls, device and context checks where appropriate, and monitoring that can identify anomalous use. Deception assets such as honeypots and honeytokens can add high-signal detection but do not replace preventive controls.