Study Guide
Non-Repudiation
Evidence of who did what, why that is a different question from integrity, and how confidentiality, integrity, availability and non-repudiation all apply to one water-treatment plant.
Lesson 1.7 Cybersecurity Foundations
Something has gone wrong, and someone says: “That was not me.” This lesson is about what it takes to settle that argument, and why the CIA triad of confidentiality, integrity and availability cannot settle it on its own.
Stage: Think
“It was not me”
You order a laptop online. The shop says it was delivered on Tuesday. You say it never arrived.
Think it through
What could the shop show you that would make it hard for you to keep saying the parcel never arrived?
- Hint 1: What does a courier usually do when handing over a valuable parcel?
- Hint 2: Think about who, when and where.
Show what happens
A record of who received the parcel, when and where: a signature, a time, perhaps a photograph at the door. The more of that there is, and the harder it is to fake, the less believable a denial becomes.
Think it through
Show the answer
Answer: B. No: it shows who took it and when, nothing more.
The signature answers one question, who received it and when. Whether the contents were changed on the way is a different question, which the signature does not answer.
Stage: Explain
The idea
To repudiate something is to deny it: “I never sent that”, “I did not approve that payment”, “that was not me”.
Non-repudiation means there is evidence that an action or communication took place, and of who performed it, strong enough that the person cannot credibly deny it afterwards.
The signed-for delivery is the everyday version. The courier records who signed, where and when, and those records are the evidence that the parcel arrived. And, as you found, the signature does not stop the parcel being opened or damaged on the way. It answers a different question, about who did what.
Three points are worth fixing early:
- Non-repudiation is about evidence and accountability. It is not about secrecy, and it is not about prevention.
- It works in both directions. It makes it hard for someone to deny an action they took, and it protects someone from being blamed for an action they did not take.
- The word credibly matters. Good evidence makes a denial hard to believe. It is not a magic proof, and Limits of the evidence explains what weakens it.
Check your understanding
Show the answer
Answer: C. Records of who acted can show it was not her.
It works in both directions: the same records that stop someone denying an action protect someone who did not take it.
Stage: Predict
A fourth property outside the triad
Think it through
Show the answer
Answer: A. Who approved it, and whether they can deny it.
All three CIA objectives are intact, and the most important question is still open: who approved the payment? That question needs a property of its own.
The CIA triad has three members: confidentiality, integrity and availability. Non-repudiation is not one of them. It is an additional security property that is often taught next to the triad, which is why the two are easy to run together.
The four are often discussed together as information-security properties. Listing four properties is fine. Calling all four “the CIA triad” is not: a triad has three parts.
| Property | Part of the CIA triad? | The question it asks |
|---|---|---|
| Confidentiality | Yes | Who may see this? |
| Integrity | Yes | Has it been changed without authorisation? |
| Availability | Yes | Can authorised people use it when they need to? |
| Non-repudiation | No: an additional property | Who did this, and can they credibly deny it? |
The fourth question is needed because the first three describe the state of the information, while non-repudiation describes the trail of actions. In the payments system from the opening question, what the organisation needs is to show who approved the payment, and that is a non-repudiation question.
Stage: Predict
How non-repudiation is provided
No single product provides non-repudiation. It comes from mechanisms that tie an action to one identity and keep a trustworthy record of it. Which ones are used depends on the situation.
- Digital signatures. A digital signature is produced with a private key that only the signer should hold, and anyone can check it with the matching public key. Because only that private key could have produced it, a valid signature is evidence that the key’s holder signed exactly that content.
- Certificates. A certificate is an electronic document, issued by an organisation that others trust, linking a public key to a named person, system or organisation. It answers “whose key is this?”, which a signature on its own cannot.
- Timestamps. A trustworthy record of when something was signed or done, so that the order of events can be established later.
- Audit records. Entries in an audit log recording which account did what and when: who signed in, who changed a setting, who approved a request.
Show the answer
Answer: B. Any of the three, and each can deny it.
The log names a login, not a person, so all three can deny it. Every mechanism listed depends on something simpler, described next.
All four depend on something simpler: each person must act as themselves. If five engineers share one “admin” account, the log shows that “admin” changed a setting, and any of the five can deny it. Individual accounts, and sound authentication, are what make the evidence point at one person.
- A unique identity. One account or key for each person or system, never shared.
- Proof that the identity was really used. Authentication at the time, or a signature that only the holder’s key could produce.
- A record of the action. What was done, to what, and when.
- A record the person cannot quietly alter. If the person being recorded can edit or delete the log, the log proves very little.
Stage: Predict
Integrity and non-repudiation
Think it through
Show the answer
Answer: C. No: nothing changed; the dispute is about who signed.
The content is intact, so whether it changed is not in doubt. The dispute is about who signed, which is a non-repudiation question. One mechanism, the digital signature, supports both kinds of question.
These two are the pair most often confused, because one mechanism, the digital signature, supports both. They ask different questions. A useful way to keep them apart is the question each asks: integrity asks “Has the data changed?”, and non-repudiation asks “Who performed the action, and can they credibly deny it?”
Comparison table: scroll horizontally on narrow screens.
| Aspect | Integrity | Non-repudiation |
|---|---|---|
| The question | Has the data changed? | Who performed the action, and can they credibly deny it? |
| What it is about | The state of the data. | The link between an action and the person or system that performed it. |
| What a failure looks like | A record has been altered without authorisation, or nobody can tell whether it has. | An action happened, and nobody can show who did it, or the person responsible can plausibly deny it. |
| Typical mechanisms | Restricting who may edit, validation, comparison with a trusted copy, digital signatures. | Digital signatures, certificates, timestamps, audit records. |
A fictional supplier sends a digitally signed contract to a customer.
- The customer checks the signature, and it is valid. Two separate conclusions follow. Integrity: the contract has not been altered since it was signed, because any change would make the check fail. Non-repudiation: the signature was made with the supplier’s private key, which is evidence that the supplier signed it.
- Suppose one figure is changed on the way. The signature check now fails. That is the integrity side doing its job: the change is revealed. It was not prevented. The altered file still exists and still arrived.
- Suppose instead that nothing is changed, and the supplier later says “we never agreed to that”. There is no integrity problem at all: the contract is exactly as it was signed. The dispute is about who signed it. The valid signature, the certificate naming the supplier and the timestamp are the evidence. That is the non-repudiation side.
- The two can fail separately. A document can be perfectly intact with no evidence of who wrote it. A signed document can be tampered with, and the signature then shows that it was.
One consequence follows directly: non-repudiation does not prevent modification. Neither a signature nor a log stops anyone changing data. A signature lets a change be detected, and a log lets an action be attributed. Stopping the change in the first place is the job of other controls, such as restricting who may edit.
Stage: Experiment
Four properties at a water-treatment plant
Consider a water-treatment plant. It is a useful example because it is not only an information system. Computers there read sensors and control pumps and chemical dosing, so a security failure can become a physical one.
Think it through
Before you look at the diagram: for each of the four properties, name one thing at a water-treatment plant that it would protect.
- Hint 1: Confidentiality: what would help an attacker if they saw it?
- Hint 2: Integrity: what must operators be able to trust?
- Hint 3: Non-repudiation: after a setting changes, what would you need to know?
Show what happens
Compare your four with the diagram below. Notice how the integrity and availability failures there are physical as well as informational.
Three of the properties form the CIA triad; non-repudiation is an additional property. Each asks a different question about the same plant.
The system
Water-treatment plant
- Sensors
- Pumps and chemical dosing
- Monitoring screens
- Control systems
- Operators and engineers
CIA triad
Confidentiality
Who may see it?
Keep private:
- Plant diagrams
- Administrator credentials
- Chemical-setting information
- Security procedures
If it fails: someone who should not have them learns how the plant is laid out, how to sign in or how it is defended.
CIA triad
Integrity
Can it be trusted?
Keep accurate:
- Sensor readings
- Control settings, such as chemical dosing
If it fails: dosing is altered or readings are falsified, which could cause physical harm while the screens look normal.
CIA triad
Availability
Can it be used when needed?
Keep working:
- Monitoring systems
- Control systems
If it fails: operators cannot see what the plant is doing, or cannot control it.
Additional property · not part of the CIA triad
Non-repudiation
Who did it, and can they deny it?
Evidence comes from:
- Authenticated actions
- Audit logs
- Digital records of changes and approvals
If it fails: a setting was changed, and nobody can show who changed it or who approved it.
The plant is a generic example, not a real site.
Read the diagram one property at a time, asking its question about the plant.
- Confidentiality is about information that would help an attacker: how the plant is laid out, how to sign in, what the chemical settings are and how the plant is defended.
- Integrity is about whether operators can trust what they see and what the plant is set to do. A falsified reading is dangerous precisely because everything looks normal.
- Availability is about being able to watch and control the process at all.
- Non-repudiation is about being able to answer, afterwards, who changed a setting and who approved it. It also protects staff: an engineer who did not make a change can show that they did not.
Systems that monitor and control physical processes are called operational technology (OT). In OT environments, integrity and availability can be especially important, because an altered setting or a lost control system can affect a physical process and public safety, not only data.
That is a statement about priorities in this kind of environment, not a rule that confidentiality stops mattering. Stolen credentials or plant diagrams are often how an attack on integrity or availability begins. People, Processes & Technology introduces the difference between information systems and OT.
Stage: Predict
Limits of the evidence
Think it through
Show the answer
Answer: B. Yes: the log shows the account was used, not who used it.
The evidence shows an account or key was used. If someone else had the password, the real holder can truthfully deny the action. That is one of four common weaknesses.
Non-repudiation is only as strong as the evidence behind it. Four things commonly weaken that evidence.
- Shared accounts. The record points at a group of people, not one.
- Stolen passwords or keys. The evidence shows that an account or key was used. It does not show whose hands were on the keyboard. A person whose password was stolen can truthfully deny the action, which is one reason strong authentication and well-protected private keys matter.
- Records that can be edited, or that are not kept. A log that the people it records can change, or that is deleted after a few days, may not be there when it is needed.
- Clocks that disagree. If systems record different times, the order of events is hard to establish.
So the careful wording is that non-repudiation provides evidence that makes a denial not credible. It does not make a denial impossible.
In everyday IT work, non-repudiation is the reason behind several familiar rules: do not share accounts, do not sign in as someone else “just to get it done”, keep administrative actions logged, and do not let administrators delete their own logs. Each rule keeps the link between an action and one person intact.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: Who could change what the log says about them?
Show the answer
Answer: B. Weak: the person it records could have altered it.
A log that the person being recorded can edit or delete proves very little about that person. The log needs protecting from the people it records.
Apply it
- Hint 1: What happens to the signature check when a signed file is changed?
Show the answer
Answer: C. Partly: a change would be detected, not prevented.
A signature lets a change be detected, and identifies the signer. Preventing changes needs other controls, such as restricting who may edit.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: It is an additional security property and is not part of the CIA triad.
The CIA triad has exactly three members, confidentiality, integrity and availability, and non-repudiation is an additional security property. The four are often discussed together as information-security properties, which is why they are easy to run together, but discussing four properties does not make a triad of four, and using digital signatures does not change the triad’s membership. Non-repudiation is not another name for integrity either: integrity asks whether data has changed, while non-repudiation concerns who performed an action.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · Non-Repudiation (Supplementary Study Guide explanation)
Show answer
Answer: Integrity: has the data changed? Non-repudiation: who did it, and can they deny it?
The two are separated by the question each asks. Integrity asks whether the data has changed. Non-repudiation asks who performed the action, and whether they can credibly deny it. Swapping the two questions is the commonest mistake. Asking who changed the data is already a non-repudiation question, not an integrity one, and whether a change was authorised is a question about permissions. Non-repudiation does not ask how a change can be prevented either: it provides evidence afterwards and does not itself prevent modification.
Revision sources: Non-Repudiation (Supplementary Study Guide explanation)
Show answer
Answer: Evidence linking the signing of that order to the supplier’s key, so the denial is not credible
With a digital signature, non-repudiation provides evidence linking the signing action to the signer’s key. A valid signature on the order is therefore evidence that the supplier signed it, which makes the later denial hard to believe. The signature also has limits: it does not keep the order secret, and it does not stop anyone altering the order. An alteration would make the signature check fail, so the change would be revealed, not prevented.
Revision sources: Non-Repudiation (Supplementary Study Guide explanation)
Show answer
Answer: False
False. Non-repudiation provides evidence of who performed an action and does not itself prevent modification. A digital signature lets a change be detected, because the signature check fails, and a log lets an action be attributed to an account. Stopping the change from happening in the first place needs other controls, such as restricting who is allowed to edit. Detecting, attributing and preventing are three different jobs.
Revision sources: Non-Repudiation (Supplementary Study Guide explanation)
Show answer
Answer: The log names an account that five people use, so any of them can deny it.
Audit records are among the mechanisms that can provide non-repudiation, but the evidence depends on each person acting as themselves, and shared accounts weaken it, because the record points at a group and not at one person. The log records the account name, but five people use that account, so it does not show which engineer acted, and each can plausibly deny it. A password on the shared account does not help, because all five know it. The changed setting may also be an integrity matter, but who made the change is the non-repudiation question, and that is what a shared account leaves open.
Revision sources: Non-Repudiation (Supplementary Study Guide explanation)
Show answer
Answer: Non-repudiation
In a water-treatment environment, non-repudiation lies in authenticated actions, audit logs and digital records, which can provide evidence of who changed settings or approved actions. Being able to show afterwards, with reliable evidence, who made and approved a change is that property. The altered setting is also an integrity concern, because integrity asks whether data has changed, but the question asked here is who did it. Confidentiality and availability concern who may see information and whether systems can be used, not who performed an action.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · Non-Repudiation (Supplementary Study Guide explanation)
Show answer
Answer: Digital signatures; Audit records; A trusted timestamp attached to a signed or logged action
Digital signatures, certificates, timestamps and audit records are mechanisms that can provide non-repudiation, depending on context. A signature or an audit record helps to tie an action to an identity. A trusted timestamp attached to that signed or logged action records when it happened; a timestamp on its own does not show who acted. A firewall rule and a locked door are controls that restrict what can be reached or entered. They may stop an action, but they do not produce evidence of who performed one, which is what non-repudiation is about.
Revision sources: Non-Repudiation (Supplementary Study Guide explanation)
Study and revision
Practise through the Security Principles & Controls topic. Questions cover whether non-repudiation belongs to the CIA triad, telling an integrity question from a non-repudiation one, what a valid digital signature does and does not show, why shared accounts weaken the evidence, and the water-treatment example; three flashcards recall the definition, whether it belongs to the triad, and the two questions. Items that use this lesson’s supplementary explanation say so. Most are learning-only. The questions that have been verified against CompTIA Security+ SY0-701 objective 1.2 are also in the Security+ practice track; that does not mean the lesson covers the whole of an objective, and the lesson does not establish practical experience.
Stage: Consolidate
What to remember
- Non-repudiation is evidence of who did what, strong enough that a denial is not credible. It protects the wrongly blamed as well.
- It is not part of the CIA triad: it is an additional property, asking about the trail of actions.
- Integrity asks whether data changed; non-repudiation asks who acted. One signature can support both.
- It depends on individual identities: shared accounts make every record point at a group.
- It does not prevent changes, and stolen credentials or editable logs weaken it.
Key terms
- Non-repudiation
Evidence that an action or communication took place and of who performed it, strong enough that the person cannot credibly deny it.
- Digital signature
A value produced with a private key that only the signer should hold, which anyone can check with the matching public key to confirm who signed some content and that it has not changed since.
- Audit log
A record of which account did what and when on a system, such as sign-ins, changes and approvals.
Common misunderstandings
The triad has three parts: confidentiality, integrity and availability. Non-repudiation is an additional security property that is often discussed alongside them.
It provides evidence of who acted. Detecting a change is an integrity matter, and preventing one needs controls such as restricting who may edit.
One mechanism supports two properties. Integrity asks whether the content changed; non-repudiation asks who signed it and whether they can deny it. Either can be in doubt while the other is not.
Only when accounts are individual, authentication is sound and the log is protected from the people it records. Otherwise the entry shows which account was used, not who used it.
Further reading
Lesson sources and acknowledgements
Sources and scope
- Covered in Session 7 (see the Session 7 Learning Log): confidentiality, integrity, availability and non-repudiation discussed together as information-security properties; and a water-treatment setting used to discuss them.
- Accuracy qualification: non-repudiation is not part of the CIA triad. This lesson says so explicitly because the four properties were presented together. Non-repudiation does not itself prevent modification.
- Supplementary explanation: the definition of non-repudiation, the list of mechanisms, the two questions that separate integrity from non-repudiation, the signed-for delivery comparison, how each mechanism contributes, the four conditions for evidence, the comparison table, the signed-contract example, the items mapped to each property in the diagram with its questions and failure lines, the OT context, the limits of the evidence, the practical note and the misunderstandings. These were developed afterwards and are my explanations, not the tutor’s words. The diagram is original.
- Fictional example: the supplier contract is invented. The water-treatment plant is a generic example, not a real site.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the parcel opening questions, every question asked in the lesson with its feedback and hints, the engineer, payments-system, medicines-cabinet, consent-form, stolen-password, editable-log and invoice examples and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. I have not created digital signatures, configured audit logging or worked on a control system as part of this lesson.
A record of which account did what and when on a system, such as sign-ins, changes and approvals.
Establishing or verifying a claimed identity, for example when a user signs in.
The security objective of keeping systems, services and information accessible to authorised users when required.
Three fundamental information security objectives: confidentiality, integrity and availability.
The security objective of restricting information to authorised people, systems or processes.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
A document, signed by a certificate authority, that binds a public key to the identity of its subject. The standard format is X.509.
A value produced with a private key that only the signer should hold, which anyone can check with the matching public key to confirm who signed some content and that it has not changed since.
The security objective of keeping information accurate and complete by protecting it from unauthorised or improper modification.
Evidence that an action or communication took place and of who performed it, strong enough that the person cannot credibly deny it.
Systems that monitor or control physical equipment and processes, such as in manufacturing, transport or utilities.
The half of a key pair that its owner keeps secret. It decrypts data sent to the owner and creates the owner’s signatures.
The half of a key pair that can be given to anyone. It encrypts data for the key’s owner and verifies the owner’s signatures.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.