CompTIA Security+ 701: Approaching & Core Concepts

• This training focuses on the CompTIA Security+ 701 exam, covering the latest cybersecurity technologies.
• The aim is to ensure a solid understanding of cybersecurity, not just rote memorization for the certification.
• The training is divided into five domains matching the exam.
• Domain one covers general security concepts and is foundational for newcomers to cybersecurity.

Approaching Security

• Focus on securing valuable data because the company hires security professionals to protect it
• Security enables the business to function without interruption.
• Protecting valuable data will be appreciated by the company.
• Security is an enabler, allowing the business to operate without interruption.

Cybersecurity Framework (NIST)

• The second version of the NIST framework includes governance, involving business leaders in security strategy and funding.
• The framework addresses security as a business problem, not just a technical one.
• The framework includes identifying assets, protecting them, and monitoring for threats.
• The NIST framework makes it easier to understand security by identifying, protecting, and monitoring assets.

Core Security Concepts

• The CIA triad, confidentiality, integrity, and availability makes up the cornerstone of cybersecurity.
• The importance and focus on each aspect of the CIA triad varies depending on the context and the organization.
• Important definitions include threat, vulnerability, risk, and non-repudiation.
• Authentication is an important concept for security.
• Gap analysis is a new concept to the 701 version of the exam.
• A deep dive into zero trust architecture is expected.
• Identification, Authentication, Authorization, and Accounting are important security concepts.

Key Questions for Cybersecurity

• What is your critical data? Understanding how the company makes money helps identify critical data and resources.
• Where is that data located? Knowing the physical or cloud location aids in securing it appropriately.
• Who has access to that data? Review access rights, especially after promotions or role changes.
• Who should have access to it? Ensure that data access aligns with current roles and responsibilities.

Cybersecurity Framework Phases

• Identification involves identifying critical hardware and software.
• Protection involves implementing security measures like firewalls and access control lists.
• Detection involves detecting attackers as soon as possible using intrusion prevention and detection systems.
• Response involves fixing the issue and stopping the bleed.
• Recovery involves restoring systems from backups to recover from damages.
• Governance involves organizational leadership providing strategic direction, funding, and policies for cybersecurity
• The cyber security framework version one came out in 2014.
• Version 1.1 came out in 2018.
• Version 2.0 introduced governance.

The CIA Triad

• The CIA Triad comprises confidentiality, integrity, and availability and is a cornerstone of information security.
• All three elements of the CIA triad must be present for something to be considered secure. The relative importance of each aspect of the CIA triad can vary depending on the specific context.
• Confidentiality aims to maintain secrecy, protecting data like PII, healthcare information, and trade secrets.
• Accomplishing confidentiality involves implementing encryption, access controls, and physical security measures.
• Integrity ensures that data remains unaltered by unauthorized personnel, preserving its originality.
• Hashing algorithms are used to verify data integrity by generating a unique checksum.
• Availability ensures that data and systems are accessible to authorized users when needed.
• Redundancy, fault tolerance, and backup power supplies help ensure availability.

Risk Terminology

• Risk is the probability for loss; security is about managing risk.
• A threat is something that can cause harm, such as a virus, human attacker, or natural disaster.
• A threat actor is someone or something with the intent and means to cause harm.
• A vulnerability is a weakness in a system that a threat can exploit.
• An exploit is a technique or code used to take advantage of a vulnerability.
• Risk is equal to threat times vulnerability. To be classified as a risk, the threat must be able to exploit a valid vulnerability.
• Focus should be put on mitigating the vulnerabilities that matter to your organization that have the highest impact.
• Security balances with functionality.

Non-Repudiation and Authenticity

• Authenticity ensures that data, messages, and identities are real and have not been tampered with.
• Authenticity can be verified through digital signatures
• Digital signatures help verify the authenticity of emails or software patches.
• Non-repudiation prevents someone from denying an action they performed.
• Digital signatures provide proof of identity, preventing denial of actions.

Defense in Depth

• There is no single product that can stop all threats, so defense in depth is needed.
• Defense in depth uses multiple security controls to protect an organization.
• A Unifi threat management system is a single box that comes with a bunch of security capabilities.
• A single point of failure is the enemy of security

Security Control Categories

• Security controls are different ways to secure an organization.
• Technical controls are implemented with technology, such as firewalls and encryption.
• Managerial controls are policies that set the direction and rules of security.
• Operational controls are daily habits that enforce security policies.
• Physical controls are tangible security measures like fences and guards.

Types of Security Controls

• Preventative controls are applied before an attack happens to prevent it.
• Deterrent controls try to discourage someone from attacking, such as warning signs.
• Deterrent controls psychologically discourage attackers through warnings and signs.
• Corrective controls react to an attack and try to restore things to normal operations.
• Recovery controls restore systems to a normal state after an attack or system failure.
• Compensating controls act as alternative controls when the primary one is not available.
• Directive controls provide guidance and instructions through policies and procedures
• A computer Intrusion can be considered a type of trespassing

Training on CompTIA Security+ 701 exam, focusing on cybersecurity fundamentals and business integration. Highlights data security prioritization and the NIST framework's governance role. Covers core security concepts.