Security+ Study Guide

The CIA Triad

• Confidentiality: Ensuring information is not disclosed to unauthorized entities. (Goal: Keep it secret)
• Integrity: Ensuring data is accurate and has not been tampered with. (Goal: Keep it trustworthy)
• Availability: Ensuring resources are accessible to authorized users when needed. (Goal: Keep it running)

Authenticity & Non-Repudiation

• Authenticity: Proving a user/system is who they claim to be.
• Non-repudiation: Ensuring a party cannot deny an action they performed (e.g., through digital signatures).

The Risk Formula

Risk = Threat × Vulnerability × Impact

• Threat: A potential cause of an unwanted incident.
• Vulnerability: A weakness that can be exploited.
• Impact: The resulting damage if the threat exploits the vulnerability.

Risk Treatment Options

• Mitigation: Reducing risk (e.g., installing a firewall).
• Avoidance: Stopping the risky activity entirely.
• Transference: Shifting risk to another party (e.g., Insurance).
• Acceptance: Deciding the risk is low enough to live with.

Controls by Function

• Preventive: Stops the event (e.g., Lock).
• Detective: Alerts that an event happened (e.g., CCTV, Log).
• Corrective: Fixes the system after the event (e.g., Backups).

Controls by Implementation

• Technical: Hardware/Software (e.g., Encryption).
• Administrative: Policies/People (e.g., Training).
• Physical: Tangible barriers (e.g., Fences).

Authentication Factors

• Know: Password, PIN.
• Have: Token, SMS OTP.
• Are: Fingerprint, Retina.
• Where: IP, GPS.
• Do: Typing cadence.

Zero Trust & Defense in Depth

• Zero Trust: "Never Trust, Always Verify." No one is trusted by default, even inside the network.
• Defense in Depth: Using multiple layers of security (e.g., Firewall → Antivirus → Encryption) so if one fails, others remain.

Adversary, opportunity, and intent

• A threat actor is an individual or group that can cause harm by exploiting a vulnerability or taking advantage of an opportunity.
• Assess an actor using motivation (why), capability (skills and tools), resources (time, money, infrastructure, access), and intent (whether they plan to act).
• Actor categories are useful patterns, not guarantees. A real incident may involve several actors, and motives can overlap or change.

Motivations and typical profiles

• Nation-state: Espionage, strategic advantage, intellectual property theft, or disruption. Often well-funded, patient, and capable of sustained operations.
• Organized crime: Primarily financial gain through fraud, ransomware, extortion, data theft, or sale of access. May operate as a professional ecosystem.
• Hacktivist: Political, ideological, or social cause. May deface sites, leak information, or conduct denial-of-service attacks for visibility.
• Terrorist group: Seeks to advance ideological or political objectives, create fear, or disrupt. Cyber capability and resources vary widely.
• Insider threat: An employee, contractor, or partner who misuses authorized access, intentionally or unintentionally. May steal data, sabotage systems, or expose information through mistakes.
• Unskilled attacker: Uses publicly available tools or instructions with limited expertise; sometimes called a script kiddie. Can still cause damage through easy-to-exploit weaknesses.
• Competitor: May seek business advantage or trade secrets, directly or through a third party. Competitive intelligence must be distinguished from unlawful intrusion.

How much effort can an actor sustain?

• Capability includes technical skill, access to exploit code, operational security, and ability to adapt when detected.
• Resources include funding, personnel, time, infrastructure, and insider or supply-chain access. A well-resourced actor can pursue a target over a long period.
• Advanced persistent threat (APT) describes a capable, persistent, targeted operation, commonly associated with espionage. It is a description of behavior and capability, not one specific malware family.
• Insider threats can be especially difficult to detect because the actor may already have legitimate credentials and knowledge of business processes.

Use evidence carefully

• Indicators of compromise (IOCs) are observable clues such as malicious IP addresses, domains, file hashes, or unusual processes.
• Tactics, techniques, and procedures (TTPs) describe how an actor operates. TTPs can be more durable than individual indicators, which attackers can replace quickly.
• Attribution is the assessment of who may be responsible. It is difficult: tools can be copied, infrastructure can be compromised, and actors can intentionally plant misleading evidence.
• Use threat intelligence to prioritize defenses and investigation. Validate indicators against the environment and consider confidence, source, and freshness.

Controls that limit impact

• Apply least privilege, strong authentication, timely offboarding, and periodic access reviews to reduce misuse of accounts.
• Patch exposed systems, segment networks, maintain tested backups, and monitor for suspicious behavior to reduce the chance and impact of compromise.
• Use separation of duties, audit trails, and data-loss controls for sensitive workflows; investigate anomalies consistently and fairly.
• Train users to report suspicious messages and activity promptly. A report is a signal to investigate, not proof of malicious intent.

Protect people, facilities, and information

• Physical security prevents, detects, delays, or responds to unauthorized physical access, theft, tampering, and environmental hazards.
• Apply defense in depth: combine perimeter controls, building entry controls, secure-area controls, and protection of individual devices or media.
• Use least privilege for physical access too: grant access only to the people who need it, to the areas they need, for the time required.
• Plan for people safety as well as confidentiality, integrity, and availability. Emergency egress must remain safe and compliant.

Make access deliberate and accountable

• Fences, gates, bollards: Define boundaries, deter entry, and delay vehicles or people. They do not replace identity checks.
• Lighting and signage: Improve visibility, discourage unauthorized access, and communicate restricted areas.
• Locks, keys, badges, PINs, biometrics: Authenticate or control entry. Revoke lost credentials and promptly disable access when roles change.
• Guards and reception: Verify visitors, enforce procedures, observe activity, and respond to incidents.
• Mantrap: A small controlled space with two interlocking doors that helps prevent tailgating into a secure area.
• Turnstile: Restricts passage to one person at a time; effectiveness depends on monitoring and anti-tailgating procedures.

People are part of the control

• Tailgating: An unauthorized person follows an authorized person through a controlled entry without the authorized person's cooperation.
• Piggybacking: An authorized person knowingly or carelessly allows another person to enter using their access. Usage sometimes overlaps, so follow the exam scenario's wording.
• Require visible badges, challenge unfamiliar people politely, escort visitors, use visitor logs, and avoid holding secure doors open for unknown people.
• Issue temporary credentials with an owner and expiry. Recover badges and keys, and update access promptly after termination or transfer.
• Use anti-passback or turnstile controls where appropriate; investigate badge sharing and unusual access times without relying on a single signal.

Know what happened and act on it

• CCTV/video surveillance provides monitoring or recorded evidence. Place cameras to cover entrances and sensitive areas while respecting privacy requirements.
• Motion, door, glass-break, and pressure sensors detect activity or tampering and can trigger alarms.
• Security guards can deter, observe, verify alarms, and respond; procedures and communications determine their effectiveness.
• Synchronize timestamps, restrict access to recordings, retain evidence according to policy, and test alarms and response procedures.
• A control may have several functions. Identify the function emphasized by the question: deterrent, preventive, detective, corrective, or compensating.

Protect what is inside the building

• Restrict server rooms, network closets, records storage, and loading areas separately from general office access. Keep access logs and escort visitors.
• Secure laptops and portable devices with locked storage or cable locks; do not leave sensitive screens or printed material exposed to visitors.
• Protect sensitive paper with locked cabinets and secure disposal. Use approved shredding or destruction for media containing sensitive data.
• Use data sanitization before reuse or disposal. Choose a method appropriate to the media and policy; physical destruction may be required when data cannot be reliably sanitized.
• Control shipping, receiving, and equipment disposal to prevent theft, tampering, or loss of chain of custody.

Keep critical services operating safely

• UPS: Provides short-term battery backup and power conditioning so systems can ride through brief outages or shut down safely.
• Generator: Supplies longer-duration backup power when fuel and maintenance are available; it usually takes time to start and transfer load.
• HVAC: Keeps equipment within temperature and humidity ranges; monitor conditions and alert on failures.
• Fire detection and suppression: Detect smoke or heat and control fires. Select suppression appropriate to the room, equipment, and occupant safety.
• Water, leak, and environmental sensors: Alert staff to flooding, humidity, temperature, or other conditions that threaten equipment.
• Redundancy: Diverse power, cooling, and network paths reduce single points of failure; test them rather than assuming they work.