all 1 security

1.0 General Security Concepts

1.1 Compare and contrast various types of security controls

Security controls manage risks and are categorized by implementation method and purpose.

1.1.1 - Categories (Implementation Method)

• 1.1.1.1 - Technical Controls:
  Implemented via technology (hardware, software). Examples: Firewalls, antivirus, encryption, MFA, SIEM.

• 1.1.1.2 - Managerial Controls:
  Policies, procedures, guidelines governing security. Examples: Password policy, incident response plan.

• 1.1.1.3 - Operational Controls:
  Day-to-day security practices. Examples: Locking workstations, data backups, security guards.

• 1.1.1.4 - Physical Controls:
  Tangible measures protecting physical assets. Examples: Security cameras, locked doors, access badges.

1.1.2 - Control Types (Purpose/Action)

• 1.1.2.1 - Preventive Controls:
  Stop incidents before they happen. Examples: Firewalls, strong passwords.

• 1.1.2.2 - Deterrent Controls:
  Discourage attackers. Examples: Security cameras, warning banners.

• 1.1.2.3 - Detective Controls:
  Identify incidents after they occur. Examples: IDS, audit logs, antivirus.

• 1.1.2.4 - Corrective Controls:
  Remediate incident impact. Examples: Antivirus removing malware, data restoration.

• 1.1.2.5 - Compensating Controls:
  Alternative controls when primary ones aren't feasible. Examples: Encrypting USB drives, security guards.

• 1.1.2.6 - Directive Controls:
  Guide user behavior towards security. Examples: Security awareness training, acceptable use policies.

1.2 Summarize fundamental security concepts

Core principles underpinning security practices.

• 1.2.1 - CIA Triad:
  Confidentiality (access restriction), Integrity (accuracy), Availability (reliable access).

• 1.2.2 - Non-repudiation:
  Proof of action, preventing denial.

• 1.2.3 - AAA:
  Authentication (identity verification), Authorization (permission), Accounting (activity tracking).

  • 1.2.3.1 - Authenticating people: Verifying the identity of a user trying to access a system.

  • 1.2.3.2 - Authenticating systems: Verifying the identity of a device or application trying to communicate with another system.

  • 1.2.3.3 - Authorization models: Determining what an authenticated user or system is allowed to do.

    • Discretionary Access Control (DAC): Resource owners decide who has access (e.g., file permissions set by a user).

    • Mandatory Access Control (MAC): System-level restrictions based on security labels

    • Role-Based Access Control (RBAC): Assigning permissions based on a user's role within the organization

    • Attribute-Based Access Control (ABAC): Granting access based on a set of attributes

  • 1.2.3.4 - Accounting (Auditing): Tracking user and system activities, including what resources were accessed and for how long.

• 1.2.4 - Gap analysis:
  Comparing current vs. desired security state.

• 1.2.5 - Zero trust:
  "Never trust, always verify."

  • 1.2.5.1 - Control plane: The decision-making component that determines access policies.

    • Adaptive identity: Dynamically assessing and adjusting user and device trust levels based on behavior and risk.

    • Threat scope reduction: Limiting the potential impact of a breach by isolating resources and users.

    • Policy-driven access control: Access decisions are based on clearly defined and enforced policies.

  • 1.2.5.2 - Data plane: The component where data is transmitted and accessed.

    • Implicit trust zones: The zero-trust model eliminates the concept of inherent trust within the network. Every access attempt is treated as potentially hostile.

    • Subject/System: The user or device attempting to access a resource.

    • Policy enforcement point: The component that enforces the access policies defined by the control plane

• 1.2.6 - Physical security:
  Measures to protect physical assets. Examples: Bollards, access control vestibules, fencing, CCTV, security guards, access badges, lighting, sensors.

• 1.2.7 - Deception and disruption technology:
  Measures to deceive attackers. Examples: Honeypots, honeynets, honeyfiles, honeytokens.

1.3 Explain the importance of change management processes and the impact to security

Change management minimizes unintended consequences, reduces downtime, maintains system stability, ensures accountability, and facilitates documentation.

• 1.3.1 - Business processes impacting security operation:
  Approval process, ownership, stakeholders, impact analysis, test results, backout plan, maintenance window, SOP.

• 1.3.2 - Technical implications:
  Allow/deny lists, restricted activities, downtime, service restart, application restart, legacy applications, dependencies.

• 1.3.3 - Documentation:
  Updating diagrams, policies/procedures.

• 1.3.4 - Version control:
  Maintaining change history for easy rollback.

1.4 Explain the importance of using appropriate cryptographic solutions

Cryptography protects data confidentiality, integrity, and authenticity.

• 1.4.1 - Public key infrastructure (PKI):
  Framework for managing digital certificates. Includes public/private keys and key escrow.

• 1.4.2 - Encryption:
  Converting plaintext to ciphertext. Includes full-disk, partition, file, volume, database, and record encryption. Covers transport/communication, asymmetric/symmetric methods, key exchange, algorithms, and key length.

• 1.4.3 - Tools:
  TPM, HSM, key management systems, secure enclaves.

• 1.4.4 - Obfuscation:
  Making data harder to understand. Includes steganography, tokenization, and data masking.

• 1.4.5 - Hashing:
  Verifying data integrity with unique digests.

• 1.4.6 - Salting:
  Adding random data to passwords before hashing.

• 1.4.7 - Digital signatures:
  Verifying sender identity and message integrity.

• 1.4.8 - Key stretching:
  Increasing time to crack password hashes.

• 1.4.9 - Blockchain:
  Distributed, immutable ledger securing transactions.

• 1.4.10 - Open public ledger: A publicly accessible blockchain where transactions are transparently recorded.

• 1.4.11 - Certificates:
  Digital documents binding a public key to an identity. Managed by CAs, CRLs, and OCSP. Includes self-signed, third-party, and wildcard types.