Comptia security+

categories of security controls-technical(logical)

controls enforced through tech

what is an example of technical security 2

firewalls and encryption

categories of security controls-managerial

controls implemented through administrative actions & policies

what is an example of managerial examples 2

risk assessments and security policies

categories of security controls-operational

day to day procedures carries out by ppl

example of operational security 2

backups and incident response

categories of security controls-physical

controls that prevent physical access to systems/data

example of physical security 3

security guards, locks, fences

types of security control-preventative

stops threat before it occurs

example of preventative security 2

firewalls, password policies

types of security control- deterrent

discourages an attacker from attacking

example of deterrent security 2

cameras, security system

types of security control-detective

Identify and record incidents

example of detective security 3

cameras, log monitoring, intrusion detection system (IDS)

types of security control-corrective

fixes/mitigates damage after an incident

example of corrective security 2

patch management, backup restoration

types of security control-compensating

alternative control used when a primary one isn’t feasible

example of compensating 1

securing guard checks IDs while scanner is down

What are the 3 elements in the CIA triad

confidentiality, integrity, availability

cia triad- confidentiality

ensures only authorized users access data

cia triad- confidentiality example

encryption

cia triad-integrity

ensures data is accurate and unaltered

cia triad- integrity example

hashing

cia triad- availability

ensures data/ systems are accessible when needed

cia triad-availability example

backups

Non-repudiation

prevents denial of actions/communications

Non-repudiation example

digital signals prove when actions are completed

AAA-authentication

verify identity

AAA-authorization

determines access level

AAA-authorization Role Based Access Control

access based on job role

AAA-authorization attribute based access control

access based attributes (time, device, location)

AAA-accounting

logs and monitors activity

Gap analysis

compares current security posture to desired (compliance) standard and identify whats missing and what to improve

What is the main goal of zero trust architecture

never trust always verify

ZTA-control plane- adaptive identity

adjusts authentication based on behavior and context

ZTA-control plane-threat scope reduction

minimizes what resources are exposed

ZTA-control plane-policy driven access control

rules define who can do what when and how

ZTA-control plane-policy admin

communicates access decisions to enforcement points

ZTA-control plane-policy engine

evaluates context and decides access

ZTA-data plane-implicit trust zones

avoid assuming internal network is safe

ZTA-data plane-subjects/systems

users/apps accessing resources

ZTA-data plane-policy enforcement point

enforces decisions from the policy engine

physical security- bollards

prevent vehicle ramming

physical security- access control vestibule

locks down access between 2 doors

physical security- fencing

perimeter defense

physical security- video surveillance

monitoring and evidence collection

physical security- access badges

controlled physical access

physical security- lighting

enhances visibility and deters threats

physical security- sensors

detect physical presence

deception & disruption tech- honeypot

fake system to attract attackers

deception & disruption tech- honeynet

network of honeypots

deception & disruption tech- honeyfile

decoy file with fake data

deception & disruption tech- honeytoken

embedded bait to trigger alerts if used

Why is change management important to security

ensures that modifications to a system, software or configurations are handled in a secure manner. Minimizes risk, ensures accountability, and maintains compliance

processes that impact security- approval processes

ensures only authorized changes are made

processes that impact security- ownership

assigns responsibility for each change

processes that impact security- stakeholders

involve relevant parties to assess risks

processes that impact security- impact analysis

Identifies security implications

processes that impact security- test results

validates that changes don’t cause vulnerabilities

processes that impact security- back out plan

enables recovery if changes cause failure or threats

processes that impact security- maintenance window

defines secure steps for changes

technical implications-allow/deny lists

updates must reflect newly authorized IPs

technical implications-restricted activities

changes must not violate security policies

technical implications-downtime

planned downtime shouldnt create gaps in monitoring

technical implications-service/app restart

ensures security logging authentication and controls persist after restart

technical implications-legacy apps

May be incompatible with modern security tools/practices

technical implications-dependencies

changes must consider impact on linked systems and services

documentation- updating programs

reflects architecture

documentation-updating policies/procedures

ensures security processes stay aligned with system changes

documentation- version control

tracks changes to configuration/code enabling rollback and accountability

public key infrastructure

enables secure communication through a system of public and private keys

public key infrastructure- public keys

shared key sued to encrypt data/ verify digital signatures

public key infrastructure- private key

secret key used to decrypt data/create digital signatures

public key infrastructure- key escrow

secure storage of encryption keys in case recovery is needed

lvl or encryption- full disk

encrypts entire drive

lvl or encryption-partition/volume

protects a section of storage

lvl or encryption- file

encrypts individual files

lvl or encryption-database/record

encrypts sensitive database entries for compliance

encryption of transit-symmetric

same key to encrypt and decrypt

encryption of transit-asymmetric

public/ private key pair

encryption of transit-key change

securely share keys

encryption of transit- algorithms

defines the method of encryption

encryption of transit-key length

longer keys= stronger security