Summary
Highlights
Welcome to Domain 1 of the CompTIA Security+ exam cram series 2024 Edition. This domain focuses on General Security Concepts, covering security controls, fundamental security principles, the impact of change management on security, and cryptographic solutions. A PDF copy of this presentation and a clickable table of contents are available in the video description. Recommended study materials include the official Cybex study guide and practice test manual.
Section 1.1 focuses on comparing and contrasting various types of security controls. Categories include technical, physical, managerial, and operational. Technical controls involve hardware or software, physical controls protect real-world objects, managerial controls are policies and procedures, and operational controls are people-centric activities. Control types include preventive, deterrent, detective, corrective, compensating, and directive. Understanding the overlap and context of these controls is crucial for the exam.
Security controls are measures to minimize loss or unavailability due to vulnerabilities. Safeguards are proactive, reducing the likelihood of occurrence, while countermeasures are reactive, reducing impact after an event. Controls can fit into multiple types depending on context; for example, a security camera is both a deterrent and detective. Key descriptive words are provided for each control type to help apply them correctly in exam questions.
Section 1.2 summarizes fundamental security concepts. The CIA Triad consists of Confidentiality (preventing unauthorized access), Integrity (preventing unauthorized modification), and Availability (ensuring authorized access). Non-repudiation guarantees that no one can deny a transaction, often achieved with digital signatures. AAA refers to Authentication (proving identity), Authorization (granting access based on identity), and Accounting (tracking user activity for accountability).
This section further clarifies AAA by introducing Identification. Identification is a subject claiming an identity (e.g., username). Authentication is proving that identity (e.g., password). Authorization is granting access based on the proven identity. Accountability involves auditing and logging actions, promoting good behavior and providing an audit trail for investigations. This applies to both human users and system identities like virtual machines and client devices.
Different authorization models are discussed: non-discretionary access control (system-wide restrictions, e.g., role-based access control), discretionary access control (owner grants/denies access, e.g., NTFS), role-based access control (permissions assigned to roles/groups), rule-based access control (global rules for all subjects, e.g., firewalls), mandatory access control (access based on predefined labels, common in military security), and attribute-based access control (access based on user attributes like department or location).
Gap analysis identifies discrepancies between required security measures (e.g., ISO 27001 standards) and an organization's current operations. The outcome is an attestation from an auditor. Zero trust is a security approach where no entity is trusted by default, based on 'assume breach,' 'verify explicitly,' and 'least privilege access.' It replaces the old perimeter-based 'trust but verify' model, treating identity as the control plane and verifying every request dynamically.
Zero Trust involves a Policy Enforcement Point (PEP) and a Policy Decision Point (PDP). The PEP enables, monitors, and terminates connections, enforcing access control policies. The PDP makes access decisions based on factors like user identity, device health, and risk assessment (who, what, when, where, why). Key elements of Zero Trust Network Architecture in the control plane include adaptive identity, threat scope reduction, policy-driven access control, policy administrator, and policy engine. The data plane includes implicit trust zones, subject and system, and policy enforcement point. Microsoft Entra ID (formerly Azure Active Directory) with Conditional Access policies serves as a practical example.
Physical security is the first outer layer of protection. Controls discussed include bollards (sturdy posts for vehicle barriers), access control vestibules (man traps with interlocking doors to prevent piggybacking), fences (deterring trespassers based on height and composition, augmented by PETAS for intrusion detection), video surveillance (cameras with motion detection), security guards (preventing unauthorized personnel), access badges (electronic door unlocking), and lighting (deterrent, designed for efficiency and protection).
Four types of sensors are covered: infrared (detects heat signatures), pressure (detects changes in weight/pressure), microwave (detects movement using microwaves), and ultrasonic (emits and measures sound waves for movement detection). Deception technologies include honeypots (luring attackers to observe their methods), honeynets (a group of honeypots), honey files (decoy files to attract attackers), and honey tokens (fake database records to detect data theft). These aim to detect, isolate, and observe attackers.
Section 1.3 explains the importance of change management. Configuration management ensures consistent, documented system configurations and enforcement of intended states, often through baselining. Change management is the policy outlining procedures for processing changes (request, approval, testing, documentation) to reduce risk. Change control is the process of evaluating specific requests. Key business processes include explicit approvals, clear ownership, stakeholder analysis, impact analysis, thorough testing (with results documented), and robust backout plans for quick restoration. Maintenance windows are crucial for minimizing business disruption during changes.
Changes can have significant technical implications that impact security. These include updating firewalls and access control lists, restricting activities (e.g., data updates during migration), managing expected downtime, planning for application restarts, addressing challenges with legacy applications (which often introduce vulnerabilities), and tracking dependencies to identify downstream effects. Proactive planning for these implications is essential to avoid service disruptions and security vulnerabilities, as attack surfaces can change.
Documentation is vital for understanding the current state of an operating environment, serving as an ongoing reference for teams. Change management processes should ensure all documentation (including diagrams) is updated before closing changes. Good documentation aids IT/security operations, business continuity, disaster recovery, incident response, and future planning. Version control formally tracks software code and system configurations, with Git being the most widely used system. It helps manage conflicts, tracks different environments (dev, test, prod), and supports security scanning in DevSecOps pipelines.
Section 1.4 covers cryptographic solutions. PKI involves key management (generation, exchange, storage, use, destruction of keys). Certificate Authorities (CAs) create digital certificates. A strong PKI hierarchy has at least three tiers: a Root CA (maintained offline, trust anchor), a Subordinate/Policy CA, and an Issuing CA (issues certificates to clients, servers). Certificate Revocation Lists (CRLs) contain revoked certificates, and Online Certificate Status Protocol (OCSP) offers a faster way to check certificate status. Other terms include Certificate Signing Request (CSR) and Common Name (CN).
Online CAs run continuously, while offline CAs are kept offline for security. Certificate stapling allows web servers to provide OCSP responses directly, and pinning mitigates fraudulent certificates. Certificate chaining establishes a chain of trust from a root certificate. Common trust models include hierarchical, bridge, hybrid, and mesh. Key escrow addresses the recovery of lost private keys. Certificate formats like X.509 are used. Specific certificate types include user, root, domain validated, extended validation, wildcard (for multiple subdomains), code signing (proving software authenticity), self-signed (for test environments only), machine, email, and third-party (for external-facing services). Subject Alternative Name (SAN) certificates support multiple domains and IP addresses in a single certificate. Certificate expiration dates also need to be managed.
Encryption can be applied at different scopes: file encryption (individual files, highly granular), volume encryption (specific partition or volume, for varying protection levels), and disk encryption (entire disk, broad, e.g., BitLocker, DM-Crypt). full disk encryption (FDE) protects data at rest, often leveraging a Trusted Platform Module (TPM) for key storage and secure boot. Self-encrypting drives (SEDs) have encryption built into the hardware, providing stronger protection and following specifications like OPAL Storage. Cloud storage providers automatically encrypt data at rest, and Transparent Data Encryption (TDE) is used for real-time database encryption.
Data in transit (or data in motion) is typically encrypted with TLS/HTTPS for network communications and VPNs. Data in use (or data in processing) is data loaded into volatile memory (RAM) where applications run; in some cases, this data can be encrypted (e.g., Windows Credential Guard for password hashes). Relational databases also offer row-level and column-level encryption for more granular protection within the database, commonly implemented within the database tier or application code.
Symmetric encryption uses a single shared secret key, is fast for bulk data encryption but challenges scalability and key distribution. Asymmetric encryption uses public/private key pairs, supporting scalability, easy key distribution, and non-repudiation. Examples of symmetric algorithms include AES (gold standard, various key lengths), Triple DES (being phased out), Twofish, and Blowfish. Asymmetric algorithms include RSA (key exchange, digital signatures), ECC (modern, smaller key sizes for resource-constrained environments), Diffie-Hellman (key exchange protocol), and ElGamal.
Cipher types discussed are stream ciphers (encrypts one bit/character at a time), block ciphers (encrypts data in blocks, generally more secure), substitution ciphers (replaces characters), and transposition ciphers (rearranges character order). Cryptographic key length significantly impacts security; a small increase in key length leads to an exponential increase in work factor to break encryption. NIST recommends a minimum 2048-bit key for RSA and 256-bit for AES. Static keys are semi-permanent, while ephemeral keys have short lifetimes and are recreated for each session.
Cryptographic tools include the Trusted Platform Module (TPM, a chip on the motherboard for key storage and secure boot), Hardware Security Modules (HSM, physical devices for safeguarding and managing digital keys, often removable), and a hardware root of trust (a line of defense against unauthorized firmware, implemented by TPM/HSM). Key Management Systems (KMS) are cloud services for centralized secure storage of application secrets (e.g., Azure Key Vault, AWS KMS). Obfuscation techniques conceal data: steganography (hiding data within other files), tokenization (replacing data with random tokens, original data in a vault), pseudonymization (replacing PII with artificial identifiers), anonymization (removing all identifying data), data minimization (collecting only necessary data), and data masking (showing only partial data).
Hashing is a one-way function that scrambles plain text to produce a unique, fixed-length message digest (hash). It's used for digital signature verification, random number generation, and data integrity (e.g., file integrity monitoring, validating data transfers). A good hash function allows any input length, produces fixed-length output, is easy to compute, is one-way, and is collision-free (no two inputs generate the same output). Salting adds random data to passwords before hashing to reduce the effectiveness of rainbow table attacks. Digital signatures combine hashing and asymmetric encryption to provide authentication, non-repudiation, and integrity for messages, using the sender's private key to encrypt a message hash.
Key stretching processes strengthen weak keys by making them longer and more random. Blockchain is a distributed public ledger using cryptography to chain data blocks, providing immutability and decentralization (e.g., Bitcoin), and using consensus mechanisms like proof of work. Open public ledgers, in contrast, can be centralized, mutable, and rely on central authority for validation, with transparent transactions. Blockchain transactions can be pseudonymous, unlike typical open public ledgers.
Appropriate cryptographic solutions depend on the use case. ECC is suitable for low-power devices due to smaller key sizes. Specialized hardware improves performance for low-latency scenarios. High resiliency requires strong algorithms to prevent key cracking. Encryption supports confidentiality for sensitive data exchange (e.g., IPsec VPN). Hashing and digital signatures support data integrity and non-repudiation. MFA and certificate-based authentication enhance authentication. Limitations include speed (encryption overhead), size (data expansion), weak keys (compromise strength), time (processing longer keys/data), longevity (algorithm obsolescence), predictability (reliance on random number generation), and key reuse. Resource constraints versus security needs require a balance.