General Security Concepts
12% of exam • Foundation of security principles
1.1 Security Control Categories and Types
Control Categories
The "How"Technical (Logical)
Implemented via hardware or software mechanisms.
Managerial (Administrative)
Directives, guidelines, and policies set by management.
Physical
Tangible mechanisms protecting the facility and hardware.
Control Function Types
The "When"Preventive
Stop attack before it happens
Detective
Identify attack during/after
Corrective
Restore after attack
Deterrent
Discourage attacker
Compensating
Alternative control
Directive
Rules & compliance
Exam Tip
Controls can be multiple types! A camera is Detective (records video) but also Deterrent (people see it and behave).
1.2 Fundamental Security Concepts
The CIA Triad
Confidentiality
Encryption, Access Controls, Steganography
Integrity
Hashing, Digital Signatures, Checksums
Availability
Redundancy, Backups, Patching
AAA Framework
-
AuthN
Authentication "Who are you?" (Password, Biometrics)
-
AuthZ
Authorization "What can you do?" (Permissions)
-
Acct
Accounting "What did you do?" (Logs)
Zero Trust
"Never trust, always verify"
Non-repudiation
Proof of origin and integrity. The sender cannot deny sending the message.
Key Tech: Digital Signatures (Private Key signs hash)
1.3 Change Management
Request & Review
Submit a formal request. Identify risks, impact, and dependencies.
Approval (CAB)
The Change Advisory Board reviews and approves/denies the change.
Test & Implement
Test in sandbox. Deploy in maintenance window. Have a Backout Plan ready!
1.4 Cryptographic Solutions
Symmetric
One shared key for encryption & decryption.
Asymmetric
Public key encrypts, Private key decrypts.
Hashing (Integrity)
One-way fingerprint of data. Cannot be reversed.
PKI Components
- CA Certificate Authority. Signs & issues certs.
- CSR Certificate Signing Request. Sent to CA.
- CRL Revocation List. Bad certs go here.