General Security Concepts establishes the foundational principles and terminology that underpin all cybersecurity practices. This section covers security controls, core security models, governance frameworks, access control mechanisms, and basic cryptographic concepts.
This section represents approximately 12% of the Security+ exam questions. Master these fundamentals as they appear throughout the entire exam.
These concepts form the building blocks for all other Security+ domains. Create flashcards for key terms and practice applying concepts to real-world scenarios.
| Subsection | Key Topics | Exam Focus |
|---|---|---|
| 1.1 Security Controls | Control types, categories, defense in depth | Matching controls to scenarios |
| 1.2 CIA Triad & AAA | CIA principles, AAA framework, non-repudiation | Applying principles to security incidents |
| 1.3 Governance & Compliance | Policies, standards, regulations, frameworks | Regulatory requirements and compliance |
| 1.4 Access Control | Models, methods, least privilege, separation of duties | Selecting appropriate access control methods |
| 1.5 Cryptographic Concepts | Encryption, hashing, PKI, digital signatures | Crypto use cases and algorithm selection |
Security controls are safeguards or countermeasures designed to protect the confidentiality, integrity, and availability of information systems.
| Category | Description | Examples |
|---|---|---|
| Technical | Implemented through technology | Firewalls, encryption, access control lists, IDS/IPS |
| Administrative | Policies and procedures | Security policies, training, background checks, risk assessment |
| Operational | Day-to-day security operations | Backup procedures, incident response, security awareness training |
| Physical | Tangible protections | Locks, guards, surveillance cameras, mantraps |
| Function | Purpose | Examples |
|---|---|---|
| Preventive | Stop incidents from occurring | Firewalls, encryption, access controls, security training |
| Detective | Identify and monitor incidents | IDS, CCTV, audit logs, security monitoring |
| Corrective | Remediate after incidents | Backup restoration, patches, incident response procedures |
| Deterrent | Discourage potential attackers | Warning signs, security guards, visible cameras |
| Compensating | Alternative when primary controls fail | Manual monitoring, temporary controls, workarounds |
| Directive | Direct or limit actions | Security policies, acceptable use policies, procedures |
Operational controls focus on day-to-day security operations and procedures:
Layered security approach using multiple controls:
Be prepared to identify control types and functions in scenario-based questions. Remember the four categories: Technical, Administrative, Operational, Physical. Operational controls are often the most overlooked but are critical for day-to-day security.
The CIA Triad represents the three core principles of information security, while AAA provides the framework for secure access control.
| Principle | Definition | Security Controls | Threats |
|---|---|---|---|
| Confidentiality | Protection from unauthorized disclosure | Encryption, access controls, data classification | Eavesdropping, data theft, social engineering |
| Integrity | Protection from unauthorized modification | Hashing, digital signatures, version control | Data tampering, unauthorized changes |
| Availability | Ensuring authorized access when needed | Redundancy, backups, fault tolerance | DoS attacks, system failures, disasters |
| Component | Purpose | Methods | Technologies |
|---|---|---|---|
| Authentication | Verify identity of users/systems | Passwords, biometrics, tokens, certificates | RADIUS, TACACS+, Kerberos, OAuth |
| Authorization | Determine access rights | RBAC, ABAC, MAC, DAC | Access control lists, security policies |
| Accounting | Track user activities | Logging, auditing, monitoring | SIEM, audit trails, session recording |
When analyzing security incidents, identify which CIA principle was compromised and which AAA component failed. This systematic approach helps in root cause analysis.
Governance establishes the security framework, risk management identifies and treats security risks, and compliance ensures adherence to legal and regulatory requirements.
| Document Type | Purpose | Characteristics | Examples |
|---|---|---|---|
| Policies | High-level management intent | Broad, strategic, mandatory | Information Security Policy, Acceptable Use Policy |
| Standards | Specific mandatory requirements | Detailed, technical, compulsory | Password standards, encryption standards |
| Procedures | Step-by-step instructions | Specific, actionable, repeatable | Incident response procedures, backup procedures |
| Guidelines | Recommended best practices | Advisory, flexible, suggested | Security configuration guides |
| Regulation/Standard | Scope | Key Requirements | Applicability |
|---|---|---|---|
| GDPR | Data privacy and protection | Data subject rights, privacy by design | EU citizens' data worldwide |
| HIPAA | Healthcare information | PHI protection, security safeguards | Healthcare organizations in US |
| PCI DSS | Payment card data | Cardholder data protection | Organizations handling payment cards |
| SOX | Financial reporting | Internal controls, financial accuracy | Publicly traded companies in US |
| FISMA | Federal information systems | Security controls, continuous monitoring | US federal agencies |
Compliance does not equal security. Being compliant with regulations is necessary but not sufficient for comprehensive security. Organizations must go beyond compliance to achieve true security.
Access control systems regulate who or what can view or use resources in a computing environment, implementing the principle of least privilege.
| Model | Control Basis | Implementation | Use Cases |
|---|---|---|---|
| DAC (Discretionary) |
Data owner decides | Access control lists (ACLs) | File systems, small organizations |
| MAC (Mandatory) |
System-enforced policies | Security labels, clearance levels | Military, government systems |
| RBAC (Role-Based) |
Job functions | Role assignments, permissions | Enterprise environments |
| ABAC (Attribute-Based) |
Multiple attributes | Policies evaluating attributes | Dynamic environments, cloud |
| Rule-Based | Global rules | If-then rules applied to all users | Firewalls, network access |
| Method | Description | Examples | Security Level |
|---|---|---|---|
| Something You Know | Knowledge-based authentication | Passwords, PINs, security questions | Low |
| Something You Have | Physical token possession | Smart cards, tokens, mobile devices | Medium |
| Something You Are | Biometric characteristics | Fingerprint, iris scan, facial recognition | High |
| Somewhere You Are | Location-based authentication | GPS location, IP address geolocation | Contextual |
Multi-factor authentication requires at least two different authentication method types. For example: Password (knowledge) + Smart card (possession) = MFA.
Cryptography provides the foundation for secure communications, data protection, and digital trust through mathematical algorithms and protocols.
| Algorithm Type | Purpose | Key Features | Common Examples |
|---|---|---|---|
| Symmetric Encryption | Confidentiality | Single shared key, fast performance | AES, 3DES, Blowfish, RC4 |
| Asymmetric Encryption | Key exchange, digital signatures | Public/private key pairs, slower | RSA, ECC, Diffie-Hellman |
| Hash Functions | Integrity verification | One-way, fixed output size | SHA-256, MD5, SHA-3 |
| Digital Signatures | Authentication, non-repudiation | Hash + asymmetric encryption | DSA, ECDSA, RSA signatures |
| Component | Role | Function | Examples |
|---|---|---|---|
| Certificate Authority (CA) | Trusted entity | Issues and manages digital certificates | DigiCert, Let's Encrypt, internal CA |
| Registration Authority (RA) | Verification agent | Verifies certificate requests | Part of CA or separate service |
| Digital Certificate | Digital credential | Binds public key to identity | X.509 certificates |
| CRL/OCSP | Revocation services | Check certificate validity | Certificate Revocation List, Online Status |
Avoid deprecated algorithms: MD5 and SHA-1 are cryptographically broken. Use SHA-256 or higher for hashing, and AES for symmetric encryption. Quantum-resistant algorithms are becoming increasingly important.