CompTIA Security+ Chapter 1: Security Controls, Cryptography, and Architecture

Comprehensive vocabulary flashcards covering the core concepts of CompTIA Security+ Chapter 1, including security control categories and types, AAA architecture, Zero Trust design, physical security measures, change management, symmetric/asymmetric cryptography, hashing, and Public Key Infrastructure (PKI).

"One of the categories of security controls. Refers to security controls that are implemented via technological systems. Includes methods such as OS security controls

firewalls

"One of the categories of security controls. Refers to administrative controls associated with security design and implementation. Includes measures such as security policies

standard operating procedures

One of the categories of security controls. Refers to security controls implemented by or participated in by human users. Includes such measures as security guards and awareness programs/user training.

Operational Controls

"One of the categories of security controls. Refers to security controls that are specifically designed to limit physical access to systems. Includes measures such as guard shacks

fences

"One of the types of security controls that is meant to block or restrict access to resources. Includes measures such as firewalls

security policies

A firewall is a ____ ____ control

technical preventative (category -> type)

"One of the types of security controls that is meant to discourage intrusion attempts without directly preventing access. Includes measures such as splash screens

threats of consequences

"One of the types of security controls that is meant to identify and log intrusion attempts without directly preventing access in all cases. Includes measures such as system log collection and analysis

login reports

"One of the types of security controls that is meant to apply a control after an intrusion event has been detected in order to reverse the impact of such an event. Allows an infrastructure to continue operating with minimal downtime. Includes methods such as restoring backups

creating policies for reporting security issues

"One of the types of security controls that is used to control a security event via alternative means when existing controls are not sufficient to control such events. May be a temporary security measure and is primarily used to prevent vulnerabilities from being exploited. Includes measures such as firewalls blocking applications instead of patching the vulnerable application

implementing a separation of duties

"One of the types of security controls that is meant to direct subjects towards security compliance

providing a relatively weak security control. Includes measures such as storing all sensitive files within a dedicated protected folder

"Refers to a combination of principles used to encapsulate the three main fundamentals of information security

which are confidentiality

"One of the aspects of the CIA triad. Aims to prevent disclosure of sensitive information to unauthorized personnel or systems. Enforced via methods such as encryption

access controls

"One of the aspects of the CIA triad. Means that sent data over a network must not be tampered with or changed in transit without detection. Enforced via methods such as hashing

digital signatures

An aspect of data integrity that is used to provide proof of data integrity by asserting that sent data truly originated from the purported sending party.

Non-Repudiation

"One of the aspects of the CIA triad. Means that systems should remain consistently available to users. Enforced via methods such as redundancy

fault tolerance

"An aspect of cryptography referring to the fact that

when an individual sends data

"One of the aspects of non-repudiation which refers to verification that sent data is identical to received data

or that data was not tampered with in transit. Enforced using hashes/message digests/fingerprints."

"If data is changed in transit even if only a single character is changed

then the ____ will be different from the original message"

"One of the aspects of non-repudiation which refers to proof of the source of a message

or verification of the user that sent a message over a network. Typically enforced using digital signatures. Verifies that the source of a message truly is the purported sender."

Digital signatures used to provide proof of origin are signed using the:

"private key

Digital signing proceeds as follows:

"Sender opts to digitally sign outgoing message Plaintext version of message converted to hash version

"The first step of AAA. Means to present an identity

or make a claim that one is who they say they are

"The second step of AAA. Means to verify a digital identity

which is typically done using a password and other authentication factors."

The third step of AAA. Means to provide certain resources and access to users based on their digital identity and predefined permissions.

Authorization

"The final step of AAA. Means to log various statistics associated with a user

such as login/logout time and data sent/received."

AAA proceeds as follows:

"User sends a login requests to a service Login request sent to AAA server by firewall If information for user is matched

Devices attempting to authenticate to systems and services within an infrastructure are typically identified using

"digital certificates

Certificate Authority (CA)

"Refers to a device or software responsible for managing certificates for an infrastructure

The certificate on a CA is signed by a ____ CA:

root

"Anytime a device within an infrastructure attempts to authenticate

its certificate is compared to:"

Refers to frameworks that determine which resources devices and users have in relation to their own predefined permissions.

Authorization Model

Authorization models are typically placed in the middle of

end users and services

The main issue with using no authorization model would be the fact that

"it is not scalable due to the fact that it creates simple

Abstractions in the context of authorization models mean to

"create a clear relationship between a user and the resources that they have permissions to access

"Adding a user to a permissions group

thereby automatically granting a user or large distribution of users permissions to access various resources

Refers to a measure in information security that compares the desired security state and the desired security state for an infrastructure.

Gap Analysis

The gap analysis baseline describes:

"desired security state that can be worked towards and used as a reference when attempting to achieve a certain security state. May include baselines created by various entities

"Security baselines typically include evaluations of various components of an infrastructure

such as"

Gap analyses typically begin with a

"compare and contrast between current and desired security state

"Once information has been gathered for a gap analysis

the final comparison involves"

Refers to a report generated from a gap analysis that includes a formal description of the current security state as well as recommendations for meeting the desired baseline.

Gap Analysis Report

Means that all devices on a network are inherently untrusted and all authentication requests must be examined before devices are allowed to communicate on a network or gain access to resources.

Zero Trust

"Means to segment a network into different functional planes

such as physical

"One of the functional planes of operation. Refers to the part of a device that performs a security process by processing frames

packets

"One of the functional planes of operation. Manages the actions of the data plane

defining policies and rules and determining how packets should be forwarded. Includes measures such as routing

The data plane can be conceptualized as

"the interfaces or ports on a networking device

The control plane can be conceptualized as:

the configuration file/settings of a networking device

"One of the aspects of zero trust which refers to examination of a user who sends an authentication request

which considers both information about the sender and the requested resources. Examines such information such as relationship to the infrastructure

One of the aspects of zero trust which means to decrease the number of possible entry points into a network.

Threat Scope Reduction

One of the aspects of zero trust that combines all information curated about the sender of an authentication request (adaptive identity) with a predefined set of rules.

Policy-Driven Access Control

"One of the aspects of zero trust which means to base authentication requests on the location of the physical device requesting authentication. Allows different locations on a network to be designated as either trusted or untrusted

granting access to devices in certain zones depending on their assigned trust status."

"Refers to a particular device or location on a network that is used to check all authentication requests against the authentication policy for an infrastructure

granting access to resources and communications depending on whether or not the source/information contained in the authentication request match the policy."

"The PEP does not provide authentication decisions

but rather forwards curated information about an authentication request/source to the"

Refers to a device or location on a network that receives information about an authentication request from a PEP and uses a policy engine and policy administrator in order to determine whether or not a device should be granted authentication to a network and its resources.

Policy Decision Point (PDP)

"One of the tools used by a PDP. Evaluates access decisions based on policies and other information sources. Grants

denies

"One of the tools used by a PDP. Communicates with the PEP and generates access tokens or credentials

communicating to the PEP whether to allow or disallow access."

Authentication requests from an untrusted zone using policy-based authentication proceed as follows:

"Subject in an untrusted network zone sends an authentication request using the data plane Authentication request is stopped at the PEP

"One of the physical security controls. Used to prevent physical access to a certain area and channel users through a certain area. Predominantly used to prevent vehicular access

but allow foot traffic. Can also be used as a security notice and prevent injuries."

One of the physical security controls. Refers to a room that users must pass through to gain access to a secure area in which all doors are locked and users must use an access badge to unlock doors. Typically only permits access for one user at a time or a controlled group.

Access Control Vestibules

"One of the physical security controls. Typically implemented in order to create a secure perimeter around an area. Can be transparent or opaque and are typically robust

or not easily penetrated."

"One of the physical security controls. Can be used to replace physical security guards and provides functions such as object and motion detection. Typically consolidates all recorded footage to a singular database

allowing footage to be accessed and viewed from multiple locations on a network."

One of the physical security controls. Can be used to provide physical protection at the reception area of a facility and validates the identification of existing users. Can also provide access for visitors by maintaining a visitor log.

Security Guard

Means that at least two security guards are used at all times for admittance to secure areas so that one security guard cannot circumvent existing security controls because there are checks and balances from the other guard.

Two-Person Integrity/Control

"One of the physical security controls. Typically includes details about a user

such as their name and picture. Often required to be worn at all times and electronically logged anytime a user uses it to gain access to an area. Provides a visual indication that a user is allowed to access a sensitive area."

One of the physical security controls. Can be used to add security to particularly dark areas by improving sight into such areas.

Lighting

One of the physical security controls. Detects infrared radiation in both light and dark conditions. Commonly implemented in motion detectors.

Infrared Sensors

One of the physical security controls. Detects a change in force.

Pressure Sensors

One of the physical security controls. Designed to detect movement across large areas.

Microwave Sensors

One of the physical security controls. Sends ultrasonic signals and receives reflected sound waves. Can be used to provide motion and collision detection.

Ultrasonic Sensors

One of the deception and disruption technologies. Refers to a false virtual network that is used to attract and trap malicious technologies. Can be used to provide insight into the types of attacks being carried out and the classes of systems being targeted.

Honeypot

One of the deception and disruption technologies. Refers to a combination of two or more honeypots into a larger virtual network. Can be used to make a false virtual network more realistic and believable.

Honeynets

One of the deception and disruption technologies. Refers to files that contain false information that can be used to attract and trap malicious technologies. Alerts should be rendered if any malicious users attempt to access honeyfiles.

Honeyfiles

"One of the deception and disruption technologies. Refers to a piece of traceable data added to a honeynet so that

if data is stolen or moved

Refers to a formal process for managing changes within an infrastructure.

Change Management

A typical change approval process proceeds as follows:

Complete request forms Determine purpose of the change Identify the scope of the change Schedule a date and time to make a change Determine affected systems and impact of the change Analyze the risk associated with the change Get approval from the change control board Get end-user acceptance after the change is complete

"One of the aspects of change management that involves determining the risk value associated with a particular infrastructure change

which can be something such as high

Refers to a testing environment that provides no connection to the real world or production system/network.

Sandbox Environment

One of the aspects of change management that involves reverting back to a previous or original configuration that was in place before a change was implemented in the event that a particular system change or fix did not have a desired effect.

Backout Plan

"One of the aspects of change management that involves determining what the best time would be to make a system change so as to guarantee minimal impact to production systems. An example would be determining a particular time of day

such as after hours when business is not being conducted or during a slower time of year to make a change."

One of the aspects of change management which refers to a standard process that should be followed when using or making changes to systems.

Standard Operating Procedure (SOP)

One of the technical change management tools. Can be used to allow or prevent certain applications to function or forward traffic within an infrastructure. Done to prevent malicious or vulnerable applications from being able to run on workstations and forward traffic over a network.

Allow/Deny List

The main difference between allow and deny list is:

"allow lists block all applications by default

AV and AM are examples of:

deny lists

Change control documents list

"changes that are authorized to be made to an infrastructure

The potential for downtime is the primary reason why:

"changes are typically done via certain maintenance windows

A technical change management activity that involves rebooting an entire system. May involve a reset of an entire OS or singular services on a system.

Restart

"Refers to applications within an infrastructure that are outdated and unsupported by a developer. Typically requires that no changes be made to such systems and applications due to the fact that

because they are outdated

Refers to variables or parameters that a certain application or service requires to be able to function properly. An example would be a certain service not running unless other services run.

Dependencies

"A technical change management activity that involves tracking configuration changes for a file or application over time. Allows one to revert back to a previous setting throughout the change/development process. Involves device configurations

OS patches and updates

"Refers to policies

procedures

a particular user is who they say they are using digital certificates

The PKI allows one to determine whether or not

One of the forms of encryption. Means to use the same exact key to both encrypt and decrypt data. Uses a secret key algorithm or a shared secret due to the fact that the key must be shared in order to be used.

Symmetric Encryption

The main disadvantage of using symmetric encryption is

the fact that it is not scalable due to the fact that the shared key can be challenging to distribute to large groups of users.

The main advantage of symmetric encryption is

"the fact that it requires less overhead than asymmetric encryption

"One of the forms of encryption. Means to perform encryption and decryption with two keys that are different

but mathematically related

Private keys are often saved:

on the generator/sender’s device for security and are also secured using a password

Asymmetric encryption proceeds as follows:

Sender uses the receiver’s public key to encrypt the message Receiver uses their own private key to decrypt the message

Refers to a storage space that is used to manage private keys for certain users. Typically used for infrastructures with large distributions of users in order to store/manage public and private key pairs. Can be used to decrypt data if a user is not the original user who encrypted sent data.

Key Escrow

A user leaving an organization and transferring their private key to another user or storage space so that any data encrypted with their public key can be decrypted using that private key is a use case for:

key escrow