1.0 General Security Concepts — Security+ SY0-701 Notes

Security Controls

Measures used to protect assets, prevent security events, minimize impacts, and limit damages.

Control Categories

Different types of security controls including technical, managerial, operational, and physical.

Technical Controls

Controls implemented using technology, such as firewalls and anti-virus systems.

Managerial Controls

Administrative policies related to security design and implementation.

Operational Controls

Security measures that are implemented by people instead of systems, such as security guards.

Preventive Controls

Measures put in place to block access to resources or prevent security breaches.

Detective Controls

Controls used to identify and log potential security breaches or unauthorized access.

Corrective Controls

Actions taken after a security event has occurred to mitigate damage and restore systems.

Non-repudiation

A principle ensuring that a party cannot deny the authenticity of their signature on a document or a message.

CIA Triad

A framework consisting of Confidentiality, Integrity, and Availability principles for information security.

Confidentiality

Ensuring that sensitive information is accessible only to those authorized to have access.

Integrity

The assurance that data has not been altered in an unauthorized manner.

Availability

Ensuring that information and resources are accessible to authorized users when needed.

Authorization

The process of determining whether a user or system has permission to access a resource.

Gap Analysis

Assessment to identify the difference between the current state of security and the desired state.

Zero Trust Model

A security framework where no one is trusted by default and verification is required for every access request.

Public Key Infrastructure (PKI)

A system that creates, manages, and stores digital certificates for secure identity verification.

Asymmetric Encryption

A type of encryption that uses a pair of keys (public and private) for secure data exchange.

Symmetric Encryption

An encryption method where the same key is used for both encrypting and decrypting data.

Digital Certificates

Electronic documents used to prove the ownership of a public key.

Certificate Authority (CA)

An entity that issues digital certificates, acting as a trusted third party.

Hashing

The process of converting input data into a fixed-size string of characters, which is typically a hash code.

Steganography

The act of concealing messages or information within other non-secret text or data.

Tokenization

The process of replacing sensitive data with unique identification symbols or tokens.

Encrypted Data

Data that has been transformed into a format that cannot be read without a decryption key.

Cryptographic Keys

Strings of bits used by encryption algorithms to transform plaintext into ciphertext and vice versa.

Key Exchange

The method of sharing encryption keys securely over potentially unsecured channels.