What Are Security Fundamentals? | Learn IT Fundamentals with Teacher Pochi

Key points

Security fundamentals is an umbrella term for the ideas and mechanisms that keep systems and information safe.
Broadly, it breaks down into three pillars: "confirming and permitting who someone is" (authentication and authorization), "weaknesses in the system" (vulnerabilities), and "the well-known serious risks out there" (the OWASP Top 10).
Neglect these and you risk serious harm to both users and the company, including data breaches and unauthorized access.

🔑 Verify and control people Authentication (verifying identity) Authorization (deciding permissions)

🕳️ Weaknesses in the system Vulnerability basics

📋 Well-known serious risks OWASP Top 10

Teacher Pochi is online like this every day, too

🔑 Logging in 💳 Paying online 📰 Reading the news

Authentication & AuthorizationAfter I log in with my password, why can I see some screens but not others? Vulnerability BasicsThe news keeps mentioning "unauthorized access" — where do attackers actually get in? OWASP Top 10Has someone already put together a list of the most common attack patterns out there?

Why security matters

Systems handle users' personal information and companies' critical data. Neglect security and this information becomes a target for malicious third parties, leading to incidents no one wanted.

Data breachesPersonal or confidential information leaks outside the organization, leading to compensation claims and a loss of trust.

Financial damageDirect losses occur through fraudulent transfers or ransomware demands.

Service outagesAn attack takes the system down, and the business itself can no longer operate.

Once an incident happens, recovery takes far more than a technical fix — explaining the situation to customers and rebuilding trust both take a long time. That's exactly why the "basics" matter before an incident ever occurs.

The three pillars of security (CIA)

Information security organizes what needs protecting into three properties: confidentiality, integrity, and availability. Taking the first letter of each, this is sometimes called the "CIA triad."

🔒 Confidentiality Only authorized people can see it

✅ Integrity Can't be tampered with

⚡ Availability Usable whenever needed

Teacher Pochi's hintThink of a bank vault. It's locked so only authorized people can see inside (confidentiality), its contents can't be altered without permission (integrity), and it can be opened properly whenever it's needed (availability). Only when all three are in place can you call it "safe."

The bridge between authentication and authorization

Confirming "who someone is" is called authentication, and deciding "what that person is allowed to do" is called authorization. The two are often discussed together, and access to a system proceeds in this order.

User
requests access

Authentication

Identity check
(who they are)

Authorization

Permission check
(what they can do)

Mixing these two up will keep you from correctly understanding a system's design or the root cause of a bug. See the dedicated "Authentication & Authorization" topic for more detail.

What is a vulnerability?

A vulnerability is a "weak point" lurking in a system. It arises from gaps in design, implementation, or configuration, and when exploited it can lead to unauthorized access or data breaches.

Teacher Pochi's hintIt's like an unlocked window. You might not immediately notice the window (the weak point), but a burglar (the attacker) will look for it and get in. See the dedicated "Vulnerability Basics" topic for more detail.

Where attackers take aim

Attackers go after the places in a system most likely to be weak. The typical targets break down as follows.

⌨️ Input forms SQL injection XSS

🔑 Login & authentication Reused passwords Easily guessed passwords

📡 Communication channels Eavesdropping Impersonation

How this connects to the OWASP Top 10

The "OWASP Top 10" organizes the serious risks found again and again worldwide into a single list. OWASP, a nonprofit organization, updates it every few years, and it acts as a kind of "map" for web application security work.

Rather than learning about individual vulnerabilities one by one through trial and error, knowing the OWASP Top 10 as a big picture first makes it much easier to see where to focus your efforts. See the dedicated "OWASP Top 10 Overview" topic for more detail.

A mindset worth keeping on the job

Security is never made perfect with just one measure. The basic idea is "defense in depth" — layering protection across the entry point, the interior, and detection.

Entry defenses
(authentication, encrypted transport)

Internal defenses
(authorization, least privilege)

Detection & response
(monitoring, logging)

Teacher Pochi's hintIt's like the defenses of a castle. There's a moat, a wall, a gatekeeper, and a watchtower in case all that is still breached. Safety comes not from defending one spot but from layering multiple defenses on top of each other.

Summary

Security fundamentals become much easier to grasp as a whole once you view them through three lenses: "mechanisms that verify and control people" (authentication & authorization), "weaknesses in the system" (vulnerabilities), and "a catalog of well-known serious risks" (the OWASP Top 10).

Each of these is covered in more depth in the topics below.