Security+ · Domain 1
General Security Concepts
About 12% of the exam
CIA and the properties around it
- Confidentiality
- only authorized eyes see data
- Integrity
- data unchanged and provably so
- Availability
- systems usable when needed
- Non-repudiation
- the signer cannot deny it
- Authentication
- prove the claimed identity
- Authorization
- what that identity may do
- Accounting
- record what was actually done
- Gap analysis
- current state versus target state
Ask which property the scenario damaged first: altered records are integrity, an outage is availability
Control categories
- Technical
- firewalls, encryption, access lists
- Managerial
- policy, risk assessment, planning
- Operational
- training, guards, incident handling
- Physical
- fences, locks, badges, cameras
Category says who or what implements the control; type says what the control does
Control types
- Preventive
- stops the act happening
- Deterrent
- discourages the attempt
- Detective
- finds it during or after
- Corrective
- repairs damage after the event
- Compensating
- stands in for a missing control
- Directive
- tells people what to do
One control can carry two types: a monitored camera both deters and detects
Zero trust vocabulary
- Policy engine
- decides grant, deny or revoke
- Policy administrator
- issues or cancels the session
- Policy enforcement point
- gateway applying the decision
- Control plane
- where the decision is made
- Data plane
- where the traffic actually flows
- Implicit trust zone
- area past the enforcement point
- Adaptive identity
- context changes the trust level
- Threat scope reduction
- smaller blast radius per subject
Never trust, always verify: a reconnect from a new network is re-evaluated even for the same user
Cryptographic building blocks
Symmetric
- One shared key both ways
- AES with 128, 192, 256 bit keys
- Fast, suits bulk data
- Key distribution is the hard part
- ChaCha20 where AES acceleration is absent
Asymmetric
- Public key encrypts, private key decrypts
- Private signs, public verifies
- RSA 2048 bits or larger
- ECC gives equal strength, smaller keys
- Diffie-Hellman agrees keys, never encrypts
Hashing and integrity
- One way, fixed length output
- SHA-256, SHA-384, SHA-512 in use
- MD5 and SHA-1 are broken
- Salt defeats precomputed rainbow tables
- HMAC adds a key to hashing
- Key stretching: bcrypt, scrypt, PBKDF2, Argon2
TLS is hybrid: asymmetric agrees the session key, symmetric moves the data, hashing proves it arrived intact
PKI and certificates
Who does what
- CA signs and vouches for subjects
- Registration authority verifies the requester
- CSR carries the subject public key
- Root of trust anchors the chain
- Intermediate CA keeps the root offline
Trust and revocation
- CRL is a downloaded revocation list
- OCSP asks about one certificate
- OCSP stapling: server presents the proof
- Self-signed certificates trigger browser warnings
- Wildcard covers one subdomain level
Where keys live
- Key escrow keeps a recoverable copy
- TPM: one chip per device
- HSM: tamper resistant, bulk key operations
- KMS manages cloud keys centrally
- Secure enclave isolates keys from software
Compromise the root and every certificate beneath it becomes untrustworthy, which is why the root stays offline
Obfuscation and data hiding
- Steganography
- payload hidden inside media
- Tokenization
- surrogate value, vault holds original
- Data masking
- shows only the last digits
- Encryption
- reversible with the key
- Hashing
- one way, not reversible
- Salting
- random value added before hashing
- Blockchain
- append only distributed ledger
- Digital signature
- hash signed with private key
Physical security
- Bollards stop vehicle approach
- Access control vestibule beats tailgating
- Fencing deters and delays
- Video with motion detection records evidence
- Guards make judgment calls
- Infrared sensor detects body heat
- Pressure sensor detects weight change
- Microwave and ultrasonic sense movement
- Lighting helps deterrence and cameras
Deception and disruption
- Honeypot
- single decoy system
- Honeynet
- a whole decoy network
- Honeyfile
- bait document nobody should open
- Honeytoken
- fake credential that alerts on use
Any touch of a honeytoken is a real alert because no legitimate process has a reason to use it
Change management
- Request with business case
- Impact analysis
- Approval by the board
- Test
- Maintenance window
- Update documentation
- Owners and stakeholders named up front
- Backout plan before production is touched
- Standard operating procedure for repeat changes
- Allow lists and deny lists updated
- Service or application restart may follow
- Legacy applications and dependencies break first
- Update diagrams and version control
The graded answer is usually the impact analysis and the backout plan, not the speed of the fix
Network access control
- 802.1X
- port based network access control
- EAP
- framework the methods plug into
- EAP-TLS
- certificates on both ends
- Supplicant
- the device asking to join
- Authenticator
- switch or wireless access point
- RADIUS
- 1812 for auth, 1813 accounting
- Posture check
- patch level before network admission
Where encryption is applied
- Full disk
- whole drive, unlocked at boot
- Partition
- one partition of the disk
- Volume
- logical volume across disks
- File
- individual files, separate keys
- Database
- whole store encrypted at rest
- Record
- one row or field
- Transport
- TLS protects data in motion
Key numbers
- AES key sizes
- 128, 192 and 256 bits
- AES block size
- always 128 bits
- SHA-2 outputs
- 224, 256, 384, 512
- RSA minimum
- 2048 bits today
- ECC 256
- roughly RSA 3072 strength
- TLS
- 1.2 acceptable, 1.3 preferred
- Public certificates
- issued for under 400 days
Rapid recall
- Due care
- doing the prudent thing
- Due diligence
- checking before you commit
- Defense in depth
- layers, no single failure decisive
- Least privilege
- only the rights needed
- Separation of duties
- no one person completes it
- Baseline
- approved minimum configuration
- Configuration drift
- systems wander off baseline
Reference strip: concepts, controls, crypto, change
Concepts to name
- CIA triad plus non-repudiation
- AAA for users and devices
- Zero trust control and data planes
- Gap analysis against a chosen framework
- Defense in depth, least privilege
Control words
- Categories: technical, managerial, operational, physical
- Types: preventive, deterrent, detective, corrective
- Also compensating and directive
- Baseline, hardening, configuration enforcement
Crypto words
- Symmetric AES, asymmetric RSA and ECC
- Diffie-Hellman and ephemeral key exchange
- Perfect forward secrecy from ephemeral keys
- Hash, salt, HMAC, key stretching
- Signatures give integrity and non-repudiation
PKI words
- CA, RA, CSR, chain of trust
- CRL, OCSP, OCSP stapling
- Wildcard, subject alternative name
- Key escrow, TPM, HSM, KMS
Change words
- Impact analysis and backout plan
- Approval board and maintenance window
- Allow list, deny list, restricted activities
- Version control and updated diagrams
Quick exam traps
- Trap: A control category and a control type mean the same thing
- Trap: Hashing is encryption that can be reversed with a key
- Trap: Zero trust means buying one product for the perimeter
- Trap: A self-signed certificate is as trusted as a public one
- Trap: Tokenization and masking both keep the original recoverable
- Trap: Change management can be skipped for an emergency fix
- Trap: A longer AES key also changes the AES block size
cybercertprep.com · original revision sheet written from the public body of knowledge