comptia fundamentals of security

Confidentiality

Protection of information from unauthorized access & disclosures.

Integrity

Ensure information and data remain accurate and unchanged from their original state unless modified by authorized individual.

avaliability

Ensure information, systems, and resources are accessible when needed by authorized users

Non-Repudiation

Providing undeniable proof in digital transaction

Authentication

security measure that ensures individuals or entities are who they claim to be

Authorization

Determining actions or resources authenticated user can access

Accounting

Security measure to ensure all user activites are properly tracked and recorded

Technical Controls

Technologies, hardware, and software mechanisms that are implemented to manage and reduce risks

ex: Firewalls, Encryptions, detection systems.

Managerial Controls

involve strategic planning and governance of security

Operational controls

Procedures and measures designed to protect data on a day-to-day basis, governed by internal processes and human actions.

Physical Controls

Tangible, real-world measures taken to protect assets

Preventative controls

Proactive measures implemented to thwart potential security threats or breaches

Detterent controls

Aim to discourage potential attackers by making the effort seem less appealing or more challenging

Detective Controls

Monitor and alert organizations to malicious activities as they occur or shortly thereafter

Corrective controls

mitigate any potential damage and restore systems to their normal state

Compensating controls

Alternative measures when primary controls are not feasible

Directive Controls

often rooted in policy or documentation and set the standards for behavior within an organization

Gap analysis

process of evaluating the difference between an organizations current performance and its desired performance

POA&M Plan of Action and Milestones

outlines the specific measures to address each vulnerability, allocate resources, and set up timelines

Zero Trust

"Trust nothing and Verify Everything"

Demands verification for every device, user, and transaction within the network