CompTIA Security+ (SY0-701) 2024
Domain 1: General Security Concepts
1. Confidentiality, Integrity, and Availability (CIA Triad)
o Confidentiality: Refers to the protection of information from
unauthorized access. This is enforced through access control
mechanisms like passwords, multi-factor authentication, and
encryption techniques. Examples include file permissions and
secure encrypted communication like HTTPS.
o Integrity: Ensures that information remains unaltered during
transit or storage unless changed in an authorized manner.
Integrity is achieved through hashing (like SHA-256), digital
signatures, and version control. For example, checking hash
values before and after a file transfer confirms integrity.
o Availability: Guarantees reliable and timely access to data and
resources. It involves redundancy (RAID, failover systems),
backups, UPS systems, and disaster recovery plans to keep
services online during outages.
2. iAAA (Identification, Authentication, Authorization,
Accounting)
o Identification: Claiming an identity (e.g., username or ID
number).
o Authentication: Proving the claimed identity (e.g., password,
fingerprint, smart card).
o Authorization: Granting access to resources based on identity
and permissions.
o Accounting: Tracking user actions for auditing and forensic
purposes (e.g., log files).
3. Three States of Data
o Data at Rest: Information stored on physical media such as
hard drives, SSDs, or backups. Protection includes full disk
encryption and access controls.
o Data in Transit: Information moving between systems or
networks. Protected with encryption protocols like TLS or VPN
tunnels.
o Data in Use: Information currently being processed by
applications or systems. Protection may involve memory-level
encryption and secure enclaves.
4. Non-Repudiation
o Non-repudiation ensures that a party in a communication
cannot deny the authenticity of their signature or the sending of
a message. It is typically achieved through the use of digital
signatures, logging, and certificates. This is critical for auditing
and forensic investigations, especially in legal or contractual
contexts. For example, if a user digitally signs an email, they
cannot later claim they did not send it.
5. Security Controls
o Administrative Controls: Policies and procedures designed to
manage people. Examples: security training, background checks,
access control policies, and job rotation.
o Technical Controls: Implemented through hardware/software
to protect systems and data. Examples: firewalls, antivirus,
intrusion detection systems (IDS), and multi-factor authentication
(MFA).
o Physical Controls: Prevent physical access to systems and
facilities. Examples: door locks, biometric access, fencing, CCTV,
and security guards.
6. Threat Actors
o Nation-States: Highly skilled attackers funded by governments.
Objectives include espionage, cyberwarfare, and disruption.
o Hacktivists: Politically or socially motivated attackers. They
deface websites, leak sensitive information, or launch denial-of-
service (DoS) attacks.
o Insiders: People within the organization who exploit their
access. Can be malicious (disgruntled employees) or
unintentional (careless employees).
o Cybercriminals: Motivated by profit, they perform identity
theft, credit card fraud, ransomware attacks, and more.
o Script Kiddies: Inexperienced individuals using pre-built tools
with limited understanding, often for recognition or mischief.
7. Risk Management
o Risk Identification: Determine what threats and vulnerabilities
exist, and how they could impact assets.
o Risk Assessment:
Quantitative Assessment: Assigns monetary values to
risk factors (e.g., cost of a data breach).
Qualitative Assessment: Uses scenarios and judgment
to prioritize risks based on likelihood and impact.
o Risk Response Strategies:
Accept: Recognize the risk and choose to live with it.
Avoid: Change plans to sidestep the risk.
Transfer: Outsource risk (e.g., buy insurance).
Mitigate: Take action to reduce risk, such as installing a
firewall.
8. Gap Analysis
o Gap Analysis is the process of comparing the current security
posture or state of an organization against a desired standard or
compliance framework (e.g., NIST, ISO 27001).
Purpose: Identify missing controls, practices, or policies.
Steps:
Define compliance or security benchmark.
Assess current environment.
Identify gaps between current and required states.
Develop a remediation plan to close the gaps.
Outcome: A clear understanding of what must be done to
meet regulatory, compliance, or internal standards.
9. Data Sovereignty
o Data Sovereignty refers to the concept that data is subject to
the laws and governance structures within the nation where it is
collected or processed. This is critical in cloud computing and
international business operations.
Key Considerations:
Organizations must ensure compliance with local
data protection laws (e.g., GDPR in the EU, CCPA in
California).
Data storage location must align with legal
requirements.
Legal conflicts may arise when data crosses borders
and is subject to foreign jurisdiction.
Example: A company storing EU citizens’ data in the U.S.
must ensure the data handling complies with GDPR, even if
the U.S. has different privacy standards.
…[remaining content unchanged]…
