CompTIA Security + Notes

Technical Controls

Controls implemented using systems such as operating system controls and firewalls.

Managerial Controls

Administrative controls associated with security design and implementation, like security policies and standard operating procedures.

Operational Controls

Controls implemented by people rather than systems, including security guards and awareness programs.

Physical Controls

Measures to limit physical access such as guard shacks, fences, and locks.

Preventive Controls

Controls that block access to a resource to prevent unauthorized actions.

Deterrent Controls

Measures that discourage intrusion attempts without directly preventing access.

Detective Controls

Controls that identify and log attempts to breach security.

Corrective Controls

Actions applied after a security event has been detected to minimize damage.

Compensating Controls

Alternative controls put in place when existing controls are insufficient.

Directive Controls

Weak security controls that direct subjects towards compliance.

CIA Triad

Basic fundamentals of security: Confidentiality, Integrity, Availability.

Confidentiality

The principle of preventing disclosure of information to unauthorized parties.

Integrity

Ensuring that messages cannot be modified without detection.

Availability

Ensuring systems are operational and accessible at all times.

Non-Repudiation

The assurance that someone cannot deny the validity of their signature on a document.

Authentication

The process of proving that you are who you say you are.

Authorization

Determining what resources or data you have access to.

Accounting

The logging of all actions taken within the system, including logins and data accessed.

Certificate Authority (CA)

An entity that issues digital certificates for authentication purposes.

Gap Analysis

A method for determining the difference between the current state and desired state of security.

Zero Trust

A security model that assumes no implicit trust and verifies every request as if it originates from an open network.

Data Plane

The part of a network responsible for processing data packets.

Control Plane

Manages the actions of the data plane, defining policies and routing rules.

Policy-driven Access Control

Access control that combines adaptive identity with predefined rules.

Security Zones

Divisions in a network that classify the trust level of the traffic within.

Policy Enforcement Point (PEP)

The component in a system that allows, monitors, and terminates connections based on policy.

Policy Decision Point (PDP)

The component that makes authoritative decisions on access based on policies.