Principles of Information Security: CompTIA Security+ Key Concepts

CompTIA Security+ Key Concepts

CompTIA Security+ Key Concepts – Exam-Ready Study Guide

(CISSP, Security+, CEH-Aligned | NIST/ISO/OWASP/MITRE Terminology)

What This Is

The CompTIA Security+ (SY0-701) certification validates foundational cybersecurity skills for roles like SOC analyst, security engineer, or IT auditor. It covers threats, vulnerabilities, risk management, cryptography, network security, and incident response—all mapped to NIST SP 800-53, ISO 27001, and MITRE ATT&CK. For example, in 2023, the Clop ransomware gang exploited a zero-day in MOVEit (CVE-2023-34362), stealing data from 1,000+ organizations (including U.S. government agencies) due to unpatched software and weak access controls—exactly the kind of real-world scenario Security+ prepares you to prevent.

Key Terms & Concepts

• CIA Triad (Confidentiality, Integrity, Availability):
  The core goals of security. Confidentiality = only authorized users access data (e.g., encryption). Integrity = data isn’t altered (e.g., hashing). Availability = systems are up when needed (e.g., DDoS protection).
  Tools: AES (confidentiality), SHA-256 (integrity), load balancers (availability).

• Risk (NIST SP 800-30):
  The likelihood of a threat exploiting a vulnerability, causing impact (e.g., financial loss, reputational damage).
  Formula: Risk = Threat × Vulnerability × Impact.

• Threat Actor (MITRE ATT&CK):
  A person/group that exploits vulnerabilities. Types:

• APT (Advanced Persistent Threat): Nation-state hackers (e.g., Russia’s Cozy Bear).
• Script Kiddie: Unskilled attacker using pre-made tools (e.g., Metasploit).

• Insider Threat: Malicious employee (e.g., Snowden) or negligent user (e.g., misconfigured cloud storage).

• Vulnerability (CVE/NVD):
  A weakness in software/hardware (e.g., Log4Shell (CVE-2021-44228) in Apache Log4j). Tracked in the National Vulnerability Database (NVD).

• Exploit:
  Code/method that takes advantage of a vulnerability (e.g., EternalBlue (CVE-2017-0144) used in WannaCry ransomware).

• Zero-Day:
  A vulnerability unknown to the vendor (no patch exists). Highly valuable to attackers (e.g., Stuxnet’s 4 zero-days).

• Social Engineering (OWASP Top 10):
  Manipulating humans to bypass security (e.g., phishing, tailgating, pretexting).
  Example: CEO fraud (BEC) – attacker impersonates an executive to wire money.

• Defense in Depth (NIST SP 800-160):
  Layered security controls (e.g., firewall + IDS + endpoint protection + user training).
  Analogy: A castle with moats, walls, and guards.

• Least Privilege (ISO 27001 A.9.1.2):
  Users/systems get only the permissions they need (e.g., a HR employee can’t access finance data).

• Non-Repudiation:
  Ensures a user can’t deny an action (e.g., digital signatures, audit logs).

• SIEM (Security Information and Event Management):
  Aggregates logs and detects anomalies (e.g., Splunk, IBM QRadar, Microsoft Sentinel).
  Use case: Detecting a brute-force attack from failed login attempts.

• SOAR (Security Orchestration, Automation, and Response):
  Automates incident response (e.g., Phantom, Demisto). Works with SIEM to block IPs, isolate endpoints.

Step-by-Step / Process Flow

1. Risk Assessment (NIST RMF)

1. Identify Assets: List systems/data (e.g., customer database, HR records).
2. Identify Threats/Vulnerabilities: Use MITRE ATT&CK (e.g., phishing, unpatched software).
3. Assess Impact: Quantify damage (e.g., $1M loss if customer data is breached).
4. Calculate Risk: Risk = Threat × Vulnerability × Impact.
5. Prioritize Risks: Use a risk matrix (High/Medium/Low).
6. Mitigate: Apply controls (e.g., patching, MFA, backups).

2. Incident Response (NIST SP 800-61)

1. Preparation: Create an IRP (Incident Response Plan) and train staff.
2. Detection & Analysis: Use SIEM alerts (e.g., unusual login from Russia at 3 AM).
3. Containment: Isolate infected systems (e.g., disconnect from network).
4. Eradication: Remove malware (e.g., reimage a server).
5. Recovery: Restore from backups, monitor for reinfection.
6. Lessons Learned: Document what went wrong (e.g., "Phishing email bypassed email filter").

3. Hardening a Server (CIS Benchmarks)

1. Disable Unused Services: Turn off FTP, Telnet, RDP if not needed.
2. Patch Management: Apply critical updates (e.g., Windows Update, apt upgrade).
3. Configure Firewall: Block all ports except 80 (HTTP), 443 (HTTPS), 22 (SSH).
4. Enable Logging: Send logs to SIEM (e.g., rsyslog to Splunk).
5. Apply Least Privilege: Remove admin rights from non-admins.
6. Encrypt Data: Use TLS 1.3 for web traffic, BitLocker for disks.

Common Mistakes

Certification Exam Tips

1. Security+ loves "best practice" questions.
2. Example: "Which is the best way to secure a database?" → Least privilege + encryption + audit logs (not just "use a firewall").
3. Know the difference between:
4. False Positive (SIEM flags normal activity as malicious) vs. False Negative (SIEM misses a real attack).
5. Type I Error (False Positive) vs. Type II Error (False Negative).
6. Management vs. Technical Controls:
7. Management: Policies, training, risk assessments.
8. Technical: Firewalls, encryption, IDS.
9. Physical: Badge readers, mantraps.
10. Ports & Protocols are fair game!
11. 22 (SSH), 23 (Telnet ⚠️ insecure), 53 (DNS), 80 (HTTP), 443 (HTTPS), 3389 (RDP).

Quick Check Questions

1. A company’s database was encrypted by ransomware. Which CIA triad component was violated?
2. A) Confidentiality
3. B) Integrity
4. C) Availability

5. D) Non-repudiation
   Answer: C) Availability – Ransomware denies access to data.

6. An attacker sends an email pretending to be the CEO, asking for a wire transfer. What is this attack called?

7. A) Phishing
8. B) Vishing
9. C) Business Email Compromise (BEC)

10. D) Tailgating
    Answer: C) Business Email Compromise (BEC) – A targeted phishing attack impersonating an executive.

11. Which of the following is the best way to mitigate a zero-day vulnerability?

12. A) Install antivirus
13. B) Apply the latest patches
14. C) Use application whitelisting
15. D) Disable unused services
    Answer: C) Use application whitelisting – Blocks unknown executables (zero-days often require running code).

Last-Minute Cram Sheet

1. CIA Triad: Confidentiality, Integrity, Availability.
2. Risk = Threat × Vulnerability × Impact (NIST).
3. Zero-Day: No patch exists ⚠️ (e.g., Stuxnet).
4. Least Privilege: Users get minimum access needed.
5. Defense in Depth: Layers of security (firewall + IDS + endpoint + training).
6. SIEM: Splunk, QRadar, Sentinel (log aggregation + alerts).
7. SOAR: Automates incident response (e.g., block IPs, isolate endpoints).
8. Ports to Know:
9. 22 (SSH), 23 (Telnet ⚠️ insecure), 53 (DNS), 80 (HTTP), 443 (HTTPS), 3389 (RDP).
10. ALE = SLE × ARO (Annualized Loss Expectancy = Single Loss Expectancy × Annualized Rate of Occurrence).
11. Common Attacks:
    • Phishing (email), Vishing (voice), Smishing (SMS).
    • Ransomware (encrypts data), DDoS (overloads service).