This section covers Exam Objective 1 of the CompTIA Security+ SY0-701 exam. It focuses on the foundational principles of cybersecurity, including security control types, the CIA triad, AAA, and security frameworks.
Treat this domain as a vocabulary-and-scenarios foundation for the rest of the exam. Security+ questions often describe a business need, an outage, or a suspicious action and ask which principle or control best fits the situation. The strongest answer protects the stated asset while preserving the required availability, usability, and accountability.
Security Control Types
Security controls are measures implemented to protect systems, data, and users. On the exam, classify a control both by how it is implemented (technical, managerial, operational, or physical) and by what it does. A badge reader is a physical control, for example, and it can also be preventive because it stops unauthorized entry.
- Preventive: Block incidents before they occur (e.g., firewalls, locked doors).
- Detective: Identify threats after they occur (e.g., intrusion detection systems, security cameras).
- Corrective: Respond and recover from incidents (e.g., backups, incident response plans).
- Deterrent: Dissuade attackers (e.g., warning signs, security policies).
- Compensating: Provide alternative controls when primary controls are not feasible (e.g., temporary access restrictions).
- Directive: Guide user behavior (e.g., security training, acceptable use policies).
No single control eliminates risk. Defense in depth combines layers so a detective control such as centralized logging can reveal a failed preventive control, and a corrective control such as a tested backup can restore service after an incident. In scenario questions, look for the control that directly addresses the stated gap instead of choosing a broader but less relevant technology.
CIA Triad and AAA
The CIA triad is a fundamental model in cybersecurity, representing the three core principles. Use it to translate a requirement into a security outcome: encryption and access rules support confidentiality; hashes, validation, and signed records support integrity; redundancy, capacity, and recovery plans support availability.
- Confidentiality: Ensures that sensitive information is accessible only to authorized individuals (e.g., encryption, access control).
- Integrity: Ensures that data is accurate and has not been tampered with (e.g., hashing, digital signatures).
- Availability: Ensures that systems and data are accessible when needed (e.g., redundancy, disaster recovery plans).
AAA: Authentication, Authorization, and Accounting are essential for access control:
- Authentication: Verifies the identity of users (e.g., passwords, biometrics).
- Authorization: Determines what actions users are allowed to perform (e.g., role-based access control).
- Accounting: Tracks user activity for auditing purposes (e.g., log files, SIEM tools).
AAA applies those principles to identities. Authentication answers “who are you?”, authorization answers “what are you allowed to do?”, and accounting supplies evidence of “what happened?” through logs and audit trails. Multifactor authentication strengthens authentication, but it does not grant permissions; least privilege and role-based access control are authorization decisions.
Related concepts include non-repudiation, which provides evidence that an action or message came from a particular party, and privacy, which governs appropriate collection, use, and protection of personal data. Digital signatures can support integrity, authentication, and non-repudiation, while data minimization reduces the impact if personal information is exposed.
Frameworks and Models
Security frameworks provide guidelines for implementing and managing cybersecurity programs. Key frameworks include:
- NIST Cybersecurity Framework (CSF): A risk-based approach to managing cybersecurity.
- ISO/IEC 27001: An international standard for information security management systems.
- COBIT: A framework for IT governance and management.
Zero Trust Architecture: A security model that assumes no user or device is trusted by default, even if inside the network perimeter.
Frameworks give an organization a repeatable way to identify risk, select controls, and measure improvement. NIST CSF is a flexible risk-management framework; ISO/IEC 27001 defines requirements for an information security management system; and COBIT focuses on governance and management of enterprise IT. They guide decisions but are not products that automatically secure an environment.
Zero Trust puts this into practice by verifying explicitly, using least privilege, and continuously evaluating device, identity, and context signals. It does not mean blocking every connection. It means each request is evaluated rather than trusted only because it originated from an internal network.
Roles and Responsibilities
Understanding roles and responsibilities is critical for implementing effective security measures:
- Data Owner: Determines data classification and handling rules.
- System Administrator: Manages day-to-day security controls and configurations.
- Security Officer: Enforces policies and manages risk.
Distinguish the data owner, who is accountable for classification and acceptable use, from a data custodian, who implements the storage, backup, and protection procedures. Separation of duties prevents one person from completing a sensitive process alone, while job rotation and mandatory vacations can expose fraud or operational weaknesses.
Physical Security and Deception
Physical security measures protect facilities and equipment from unauthorized access. Examples include:
- Door locks, access control systems, fences, and mantraps.
- Deception strategies like honeypots and honeytokens to detect and mislead attackers.
Physical controls work with administrative procedures. A visitor policy, sign-in process, escort requirement, and secure disposal process reduce the chance that an attacker can tailgate into a facility or recover sensitive information from equipment and media. Honeypots and honeytokens are deception technologies: they should have no normal business use, so interaction with them can provide a high-confidence alert.
Change Management and Cryptography
Change management reduces the risk that a routine update creates a new security exposure or service outage. A sound process records the request, evaluates security and business impact, obtains the appropriate approval, tests the change, schedules implementation, and keeps a rollback plan. Emergency changes may use an accelerated path, but they still require documentation and a review after service is restored.
Cryptographic choices must match the security objective. Symmetric encryption protects data efficiently with a shared secret; asymmetric cryptography uses a public/private key pair for key exchange and digital signatures; and hashing produces a fixed-length value used to verify integrity. Passwords should be stored with a purpose-built, salted, slow password hashing method rather than reversible encryption or a general-purpose hash alone.
Additional Resources
Explore more resources to prepare for the Security+ exam: