CompTIA SecurityX
Study Guide 2025

Security Program Documentation

Understanding the hierarchy and purpose of security documentation is critical for organizational security posture.

• Policies: High-level statements defining security objectives and organizational stance
• Procedures: Step-by-step instructions for implementing policies
• Standards: Mandatory requirements and specifications (e.g., password complexity, encryption standards)
• Guidelines: Recommended best practices and suggestions (flexible, not mandatory)

📚 External Resource: ISO/IEC 27001 Information Security Management

Program Management

• Security Training: Awareness programs, role-based training, continuous education
• Phishing Awareness: Simulated phishing campaigns, user reporting mechanisms
• Privacy Training: Data protection, GDPR/CCPA compliance, PII handling
• Communication: Stakeholder engagement, incident notifications, security bulletins
• Reporting: Executive dashboards, compliance reports, metrics and KPIs
• RACI Matrix: Responsible, Accountable, Consulted, Informed framework for role clarity

🔧 Frameworks and Standards High Priority

• COBIT: Framework Control Objectives for Information and Related Technology - IT governance framework
• ITIL: Framework IT Infrastructure Library - IT service management best practices. Learn more in our ITIL guide
• NIST Frameworks: Critical Cybersecurity Framework (CSF), Risk Management Framework (RMF)
• CSA: Cloud Focus Cloud Security Alliance frameworks for cloud security

📚 External Resources: NIST Cybersecurity Framework | Cloud Security Alliance

Configuration Management

• Asset Life Cycle: Procurement, deployment, maintenance, decommissioning, disposal
• CMDB: Configuration Management Database - centralized asset repository
• Inventory Management: Hardware, software, licenses, version control
• Change Management: Approval workflows, testing procedures, rollback plans

GRC Tools

• Control Mapping: Aligning security controls to regulatory requirements
• Automation: Automated compliance assessments, continuous monitoring
• Compliance Tracking: Evidence collection, audit trails, remediation tracking
• Risk Registers: Centralized risk documentation and treatment plans

Data Governance

• Production Data: Live operational data requiring highest security controls
• Development Data: Test data, synthetic datasets, data masking
• Testing Environments: QA data, sanitization procedures
• Data Classification: Public, internal, confidential, restricted
• Data Retention: Legal hold, retention policies, secure deletion

Risk Management

• Impact Analysis: Business impact assessment (BIA), disaster recovery planning
• Risk Assessment:
  • Quantitative: Annual Loss Expectancy (ALE), Single Loss Expectancy (SLE)
  • Qualitative: Risk matrices, likelihood and impact scoring
• Third-Party Risk: Vendor assessments, supply chain security, contractual requirements
• CIA Triad: Confidentiality, Integrity, Availability considerations

📚 Related Guide: CASP+ Risk Management Resources

Threat Modeling

• Actor Characteristics: Nation-state, insider threats, hacktivists, organized crime
• Attack Patterns: TTPs (Tactics, Techniques, Procedures), kill chain analysis
• Frameworks:
  • MITRE ATT&CK: Comprehensive matrix of adversary tactics and techniques
  • CAPEC: Common Attack Pattern Enumeration and Classification
  • STRIDE: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege

📚 External Resource: MITRE ATT&CK Framework

Attack Surface Analysis

• Architecture Reviews: Security design reviews, threat surface mapping
• Data Flows: Data flow diagrams (DFDs), trust boundaries, entry/exit points
• Trust Boundaries: Network segmentation, security zones, perimeter definition
• Attack Surface Reduction: Minimize exposed services, disable unnecessary features

Compliance Strategies

• PCI DSS: Payment Card Industry Data Security Standard for cardholder data
• ISO/IEC 27000 Series: International information security standards
• HIPAA: Healthcare data protection requirements
• GDPR/CCPA: Data privacy regulations (EU and California)
• SOX: Sarbanes-Oxley financial reporting controls
• FedRAMP: Federal cloud security authorization

📚 Related Guide: CASP+ Governance & Compliance Guide

Cloud Security Capabilities

• CASB (Cloud Access Security Broker):
  • API-based: Direct integration with cloud services for visibility and control
  • Proxy-based: Inline monitoring and enforcement of security policies
• Shadow IT Detection: Unsanctioned cloud service discovery and risk assessment
• Shared Responsibility Model: Understanding cloud provider vs. customer security obligations
• CI/CD Pipeline Security: DevSecOps integration, automated security testing
• Infrastructure as Code (IaC): Terraform, Ansible, CloudFormation security configurations
• Container Security: Docker, Kubernetes security, image scanning, runtime protection
• Orchestration: Container orchestration security, service mesh (Istio, Linkerd)
• Serverless Workloads: Lambda, Azure Functions security considerations

📚 External Resources: AWS Shared Responsibility Model | Kubernetes Security

Cloud Data Security

• Data Exposure: Misconfigured S3 buckets, public access controls
• Data Leakage: DLP policies, egress filtering, data classification
• Data Remanence: Secure deletion in multi-tenant environments
• Insecure Storage: Unencrypted databases, weak access controls
• Encryption Keys: KMS (Key Management Service), HSM, key rotation policies
• Data Sovereignty: Geographic data residency requirements

Cloud Control Strategies

• Proactive Controls: Preventative measures, secure defaults, policy enforcement
• Detective Controls: Logging, monitoring, anomaly detection, SIEM integration
• Preventative Controls: Access controls, network segmentation, WAF
• Customer-to-Cloud Connectivity: VPN, Direct Connect, ExpressRoute security
• Service Integration: API security, OAuth, service-to-service authentication
• Continuous Authorization: Just-in-time access, adaptive authentication

Network Architecture

• Network Segmentation: VLANs, security zones, DMZ architecture
• Microsegmentation: East-west traffic control, workload-level isolation
• VPN Technologies: Site-to-site, remote access, split tunneling considerations
• Always-On VPN: Persistent encrypted connectivity, pre-login security
• API Integration: REST, GraphQL, API gateways, rate limiting

📚 Related Guide: Network+ Fundamentals

Security Boundaries

• Asset Identification: Discovery tools, CMDB integration, shadow IT detection
• Asset Management: Life cycle tracking, ownership assignment
• Attestation: Compliance verification, configuration validation
• Data Perimeters: Data boundary definition, cross-boundary controls
• Secure Zones: High-security areas, secure enclaves, air-gapped networks

Deperimeterization

• SASE (Secure Access Service Edge): Converged network and security as a service
• SD-WAN: Software-defined wide area networking with integrated security
• Software-Defined Networking: Centralized control plane, programmable networks
• Cloud-Native Security: Distributed security models, edge computing

📚 External Resource: Gartner SASE Framework

Zero Trust Concepts

• Subject-Object Relationships: Defining trust relationships between entities
• Never Trust, Always Verify: Continuous authentication and authorization
• Least Privilege Access: Minimal permissions, just-in-time elevation
• Assume Breach Mentality: Lateral movement prevention, segmentation
• Device Trust: Endpoint posture assessment, device compliance

📚 External Resource: CISA Zero Trust Maturity Model

Automation & Scripting

• Scripting Languages:
  • PowerShell: Windows automation, Active Directory management
  • Bash: Linux/Unix shell scripting, system administration
  • Python: Security tool development, API integration, data analysis
• Event Triggers: Automated response to security events, webhooks
• Infrastructure as Code (IaC): Terraform, Ansible, Puppet, Chef configuration management
• Cloud APIs: AWS SDK, Azure CLI, Google Cloud APIs for automation
• Generative AI: ChatGPT integration, AI-assisted security operations
• Containerization: Docker automation, Kubernetes operators
• Automated Patching: Patch management systems, vulnerability remediation workflows
• SOAR: Security Orchestration, Automation, and Response platforms
• Workflow Automation: ServiceNow, JIRA integration, ticketing automation

Vulnerability Management

• Vulnerability Scanning: Nessus, Qualys, OpenVAS, authenticated vs. unauthenticated scans
• Reporting: Executive summaries, technical remediation reports, trend analysis
• SCAP (Security Content Automation Protocol):
  • OVAL: Open Vulnerability and Assessment Language
  • XCCDF: Extensible Configuration Checklist Description Format
  • CPE: Common Platform Enumeration
  • CVE: Common Vulnerabilities and Exposures
  • CVSS: Common Vulnerability Scoring System
• Prioritization: Risk-based vulnerability management, exploitability assessment

📚 Related Guides: Security+ Vulnerability Management | CySA+ Vulnerability Management

🔐 Advanced Cryptography V5 Enhanced

• Post-Quantum Cryptography (PQC): New to V5 Critical Quantum-resistant algorithms, NIST PQC standardization
• Key Stretching: PBKDF2, bcrypt, scrypt for password hashing
• Homomorphic Encryption: Advanced Topic Computing on encrypted data without decryption
• Forward Secrecy: Perfect Forward Secrecy (PFS), ephemeral key exchange
• Hardware Acceleration: AES-NI, cryptographic accelerators, TPM, HSM

📚 External Resource: NIST Post-Quantum Cryptography

Cryptographic Use Cases

• Data at Rest: Full disk encryption (BitLocker, LUKS), database encryption (TDE)
• Data in Transit: TLS/SSL, VPN encryption, secure protocols
• Data in Use: Memory encryption, secure enclaves (Intel SGX)
• Secure Email: S/MIME, PGP/GPG encryption and digital signatures
• Blockchain: Distributed ledger cryptography, smart contract security
• Privacy: Differential privacy, zero-knowledge proofs
• Compliance: FIPS 140-2/3 validated cryptography
• Certificate-Based Authentication: PKI, X.509 certificates, mutual TLS

📚 Related Guide: Security+ Cryptography Guide

Cryptographic Techniques

• Tokenization: Replacing sensitive data with tokens, payment card tokenization
• Code Signing: Digital signatures for software integrity verification
• Cryptographic Erase: Secure data sanitization through key destruction
• Digital Signatures: RSA, ECDSA, non-repudiation, message authentication
• Hashing: SHA-256, SHA-3, collision resistance, integrity verification
• Symmetric Cryptography: AES, ChaCha20, stream vs. block ciphers
• Asymmetric Cryptography: RSA, ECC, key exchange (Diffie-Hellman, ECDH)

Monitoring and Data Analysis

• SIEM (Security Information and Event Management):
  • Event Parsing: Log normalization, field extraction, timestamp correlation
  • Retention: Compliance-based retention policies, hot vs. cold storage
  • False Positives/Negatives: Tuning rules, reducing alert fatigue
• Aggregate Analysis:
  • Correlation: Multi-event analysis, attack chain detection
  • Prioritization: Risk-based alert ranking, severity scoring
  • Trend Analysis: Historical pattern identification, anomaly detection
• Behavior Baselines:
  • Network Baselines: Traffic patterns, bandwidth usage, protocol analysis
  • System Baselines: CPU, memory, disk I/O normal ranges
  • User Baselines: Access patterns, login times, typical activities

📚 Related Guide: CySA+ Security Operations

Vulnerabilities and Attack Surface

• Common Vulnerabilities:
  • Injection Attacks: SQL injection, command injection, LDAP injection
  • Cross-Site Scripting (XSS): Reflected, stored, DOM-based XSS
  • Insecure Configurations: Default credentials, unnecessary services, misconfigurations
  • Outdated Software: Unpatched systems, EOL software, legacy applications
  • Weak Ciphers: Deprecated algorithms (DES, RC4, MD5), weak SSL/TLS configurations
• Mitigations:
  • Input Validation: Whitelist validation, sanitization, encoding
  • Patch Management: Automated patching, vulnerability prioritization
  • Encryption: Strong cipher suites, TLS 1.3, certificate management
  • Defense-in-Depth: Layered security controls, redundancy

📚 Related Guides: Security+ Application Security | PenTest+ Attacks & Exploits

Threat Hunting

• Internal Intelligence:
  • Honeypots: Deception technology, attacker behavior analysis
  • UBA: User Behavior Analytics, anomaly detection
• External Intelligence:
  • OSINT: Open-source intelligence gathering, social media monitoring
  • Dark Web: Threat actor forums, credential dumps, exploit marketplaces
  • ISACs: Information Sharing and Analysis Centers (sector-specific)
• TIPs (Threat Intelligence Platforms): Automated threat feed aggregation
• IoC Sharing:
  • STIX: Structured Threat Information eXpression
  • TAXII: Trusted Automated eXchange of Intelligence Information
• Rule-Based Languages:
  • Sigma: Generic signature format for SIEM systems
  • YARA: Malware identification and classification rules
  • Snort: Network intrusion detection signatures

Incident Response

• Malware Analysis:
  • Sandboxing: Cuckoo, Any.Run, automated dynamic analysis
  • IoC Extraction: File hashes, IP addresses, domains, registry keys
  • Code Stylometry: Malware attribution through coding patterns
• Reverse Engineering: Static analysis, disassemblers (IDA Pro, Ghidra), debuggers
• Metadata Analysis: File properties, EXIF data, document metadata
• Data Recovery: Forensic imaging, deleted file recovery, timeline analysis
• Root Cause Analysis: 5 Whys, fishbone diagrams, incident timelines

📚 Related Guides: Security+ Incident Response | CySA+ Incident Response