General Security Concepts

Vocabulary flashcards covering core concepts from CompTIA Security+ Domain 1, including security control classifications, CIA triad and AAA fundamentals, Zero Trust, deception technologies, change and configuration management, and cryptographic mechanisms.

Security Control

A safeguard used to reduce risk and protect systems, data, services, and people, which may be a technology, process, policy, or physical safeguard.

Technical (Logical) Controls

Security controls enforced through technology, such as firewalls, encryption, multifactor authentication (MFA), access control lists (ACLs), endpoint protection, and intrusion detection systems.

Managerial Controls

Security controls focused on governance, risk management, and oversight, such as security policies, risk assessments, security planning, and risk acceptance decisions.

Operational Controls

Security controls carried out by people or established procedures, such as security awareness training, incident response procedures, visitor logs, and manual log reviews.

Physical Controls

Security controls that protect facilities, equipment, and people, such as locks, fences, guards, cameras, bollards, and mantraps.

Preventive Control

A control purpose intended to stop an incident before it happens (e.g., MFA, least-privilege permissions, firewall blocking rules, locked doors).

Deterrent Control

A control purpose intended to discourage someone from attempting an attack or violation (e.g., warning signs, visible guards, stated disciplinary consequences).

Detective Control

A control purpose that identifies, records, or alerts on suspicious activity or a security event (e.g., IDS alerts, audit logs, CCTV monitoring, file-integrity monitoring).

Corrective Control

A control purpose that reduces the impact of an incident or restores a system to an acceptable state after a problem (e.g., removing malware, repairing misconfigurations, restoring backups).

Compensating Control

An alternative safeguard used when the preferred control cannot be implemented, intended to reduce risk to an acceptable level.

Directive Control

A control purpose that communicates required or expected behavior (e.g., policies, standards, procedures, posted instructions).

Confidentiality

A core security objective ensuring that information is accessible only to authorized people or systems.

Integrity

A core security objective ensuring that information remains accurate, complete, and protected from improper modification.

Availability

A core security objective ensuring that systems and data are accessible when needed by authorized users.

Non-Repudiation

Evidence that helps prevent a person or entity from credibly denying an action, message, or transaction.

Authentication

The component of the AAA framework that verifies identity, answering the question 'Who are you?'

Authorization

The component of the AAA framework that determines what an authenticated identity is permitted to access or do, answering 'What are you allowed to do?'

Accounting

The component of the AAA framework that records activity for auditing and accountability, answering 'What did you do?'

Zero Trust

A security approach that does not grant implicit trust solely because a user or device is inside a network, explicitly evaluating access using identity, device condition, context, and policy.

Honeypot

A decoy system or service designed to attract and monitor attackers.

Honeynet

A network of decoy systems used to observe or study attacker behavior.

Honeyfile

A decoy file designed to alert defenders when accessed.

Honeytoken

Fake data or an artifact whose use or access signals possible unauthorized activity.

Sinkhole

A controlled destination used to redirect malicious traffic for analysis or containment, such as redirecting requests for known malicious domains.

Change Management

A formal process for requesting, evaluating, approving, implementing, documenting, and reviewing changes to systems, applications, networks, and security configurations.

Change Request

A formal proposal describing what should change, why it is needed, which systems are affected, likely risks, implementation steps, testing, and rollback plans.

Impact Analysis

The evaluation of effects on security, availability, users, business operations, cost, capacity, compatibility, dependencies, and connected services before implementing a change.

Rollback / Backout Plan

A planned recovery path prepared before implementation describing how to return to a known-good state if a change fails or causes unacceptable problems.

Change Authority

The specific person or group authorized to approve a change.

Change Advisory Board (CAB)

A group that reviews proposed changes, risks, schedules, and business impacts, and advises or approves according to organizational policy.

Standard Change

A routine, low-risk, repeatable change that may be preapproved and follow a documented procedure.

Normal Change

A change that follows the usual assessment and approval process.

Emergency Change

An urgent change needed to address a critical issue, such as an active exploit or major outage, which may use an expedited approval process.

User Acceptance Testing (UAT)

A testing phase that checks whether a change meets user or business requirements.

Regression Testing

A testing phase that checks that existing functionality still works after a change is applied.

Maintenance Window

A planned period for performing work, chosen to reduce disruption.

Change Freeze

A period when nonessential changes are restricted, often around critical business periods.

Configuration Management

Maintaining consistent, accurate records of system components, settings, versions, and approved configurations.

Baseline Configuration

An approved reference configuration used to compare a system's current state with its expected state.

Configuration Drift

A difference between a system's actual configuration and its approved baseline.

Version Control

A system that tracks changes to files, code, and configurations over time.

Public Key Infrastructure (PKI)

A framework of policies, processes, people, and technology used to create, issue, validate, and manage digital certificates and public-key identities.

Public Key

A key in asymmetric cryptography that can be shared publicly, used depending on the algorithm to encrypt data or verify digital signatures.

Private Key

A secret key controlled strictly by its owner, used depending on the algorithm to decrypt data or create digital signatures.

Certificate Authority (CA)

A trusted entity that issues and digitally signs certificates.

Registration Authority (RA)

An entity that verifies identities or performs registration tasks on behalf of a Certificate Authority (CA).

Digital Certificate

An electronic document binding an identity to a public key.

Root CA

The top-level Certificate Authority in a trust chain whose certificate is typically trusted through a device or operating system's trust store.

Certificate Chain

A sequence linking an end-entity certificate through any intermediate CAs to a trusted root CA.

Certificate Revocation

Invalidating a digital certificate before its scheduled expiration because it should no longer be trusted.

Certificate Revocation List (CRL)

A list published by a CA identifying certificates revoked before expiration.

Online Certificate Status Protocol (OCSP)

A protocol that allows a client to query certificate revocation status directly in real time.

Encryption

A cryptographic process that transforms plaintext into ciphertext using an algorithm and key to protect confidentiality.

Plaintext

Readable original data prior to encryption.

Ciphertext

Data transformed by encryption so it cannot be understood without the appropriate decryption capability.

Decryption

The process of transforming ciphertext back into plaintext using the appropriate key and algorithm.

Symmetric Encryption

A cryptographic method that uses the same shared secret key for encryption and decryption, commonly used for bulk data.

Asymmetric Cryptography

A cryptographic method using a mathematically related public/private key pair to support digital signatures, encryption, or key establishment.

Data at Rest

Stored data, such as files on a hard drive.

Data in Transit

Data traveling across a network.

Data in Use

Data actively being processed in memory or by an application.

Hashing

A one-way cryptographic process that converts input data into a fixed-length digest, used primarily for integrity checking.

Hash Digest

The fixed-length output produced by a hash function.

Collision (Hashing)

An event that occurs when two different inputs produce the exact same hash digest.

Obfuscation

A technique that makes code or information harder to understand without necessarily providing strong cryptographic protection.

Digital Signature

A cryptographic mechanism created using a private key and verified using the corresponding public key, supporting integrity, authenticity, and non-repudiation.

Blockchain

A type of distributed ledger that stores records in blocks linked through cryptographic hashes using a consensus mechanism.