CompTIA SY0-701 Security+ Core Concepts

Understanding Security Control Types

Security controls are the safeguards or countermeasures that protect information systems from threats. They are commonly grouped into three primary categories: preventive, detective, and corrective. A fourth, often overlooked, category is deterrent, which aims to discourage attackers before an incident occurs.

Preventive Controls

Preventive controls stop an unwanted event from happening. The classic example is a firewall, which filters traffic based on defined rules, thereby blocking malicious packets before they reach internal resources. Other preventive mechanisms include access‑control lists, strong authentication, and security policies.

Deterrent Controls

Deterrent controls are designed to discourage potential attackers. They do not stop an intrusion directly but make the effort appear too risky or costly. Examples include warning banners, visible surveillance cameras, and legal notices about penalties for unauthorized access. The primary purpose of a deterrent control is to discourage an intrusion attempt before it begins.

Detective and Corrective Controls

Detective controls, such as intrusion detection systems (IDS) and log monitoring, identify incidents after they occur. Corrective controls, like patch deployment or data restoration from backups, aim to recover or remediate the damage caused by a breach.

The CIA Triad: Core Principles of Information Security

The CIA triad—Confidentiality, Integrity, and Availability—forms the foundation of security policies and risk management. Visual representations often depict the three concepts as the sides of a triangle.

Integrity Placement

In the standard diagram, Integrity is labeled on the right side of the triangle, opposite Confidentiality (left side) and Availability (bottom side). This placement emphasizes that integrity protects data from unauthorized alteration, ensuring that information remains accurate and trustworthy.

Common misconceptions arise when learners assume the central label represents Integrity. Remember: each side of the triangle is distinct, and the right side specifically denotes Integrity.

Control Matrix: Physical, Logical, and Compensating Controls

A control matrix helps organizations map security controls to specific risks. Understanding the differences between physical, logical, and compensating controls is essential for building layered defenses.

Physical Compensating Controls

Compensating controls provide alternative protection when the primary control is unavailable or insufficient. A power generator is a classic example of a physical compensating control. If the main power supply fails, the generator ensures continued operation of critical systems, thereby maintaining availability.

Other Control Types

• System logs – logical detective control that records events for later analysis.
• Firewall – preventive logical control that filters network traffic.
• Sign: Authorized Personnel Only – physical preventive control that restricts access to a location.

Fileless Malware: Infection Process and Registry Persistence

Fileless malware exploits legitimate system tools and memory to avoid detection. One critical step in its lifecycle is establishing persistence so the malicious code runs automatically after a reboot.

Registry Auto‑Start Entry

During Step 5 of the infection process, the malware adds an auto‑start entry to the Windows Registry. This entry typically resides under keys such as HKLM\Software\Microsoft\Windows\CurrentVersion\Run or HKCU\Software\Microsoft\Windows\CurrentVersion\Run. By doing so, the malicious payload is executed each time a user logs on, ensuring the attacker maintains a foothold without dropping a traditional executable file on disk.

Understanding this step helps defenders monitor registry changes and implement detection rules that flag suspicious auto‑start entries.

Cryptographic Foundations: Non‑Repudiation

Non‑repudiation is a vital security property that ensures a party cannot deny the authenticity of their actions. In cryptographic terms, it provides proof that the sender cannot deny sending the message.

How It Works

Digital signatures, created with a sender’s private key, bind the identity of the sender to the message. When the recipient verifies the signature using the sender’s public key, they obtain undeniable evidence of origin. This mechanism is essential for legal contracts, financial transactions, and any scenario where accountability is required.

Non‑repudiation differs from confidentiality (encryption) and integrity (hashing). While encryption protects data from unauthorized reading, and hashing ensures data has not been altered, non‑repudiation guarantees that the sender cannot later claim they did not send the data.

AAA Framework: Authentication, Authorization, and Accounting

The AAA model is a cornerstone of network security, defining how users are identified, granted access, and monitored.

Authorization Explained

After a user successfully authenticates, the Authorization component determines what resources the user may access. It evaluates policies, roles, and permissions to enforce the principle of least privilege. For example, a user with a "Read‑Only" role may view files but cannot modify them, whereas an "Administrator" role grants broader capabilities.

Other AAA Elements

• Authentication – verifies the identity of a user or device (e.g., passwords, biometrics).
• Accounting – tracks user activities, providing audit trails for compliance and forensic analysis.
• Identification – the initial step where a user presents a unique identifier (e.g., username) before authentication.

Zero Trust Architecture: Control Plane Best Practices

Zero Trust is a security paradigm that assumes no implicit trust, even inside the network perimeter. It emphasizes continuous verification and strict access controls.

Control Plane Recommendations

Within a Zero Trust framework, the control plane should define policies and rules for packet forwarding. This means establishing granular, context‑aware policies that dictate how traffic is allowed or denied based on identity, device health, and application intent. Rather than relying solely on perimeter firewalls, Zero Trust pushes policy enforcement closer to the workloads.

Additional Zero Trust Elements

• Encrypt all data in transit – ensures confidentiality and integrity across the network.
• Implement micro‑segmentation – isolates workloads to limit lateral movement.
• Adopt strong identity verification – multi‑factor authentication (MFA) and continuous risk assessment.

Putting It All Together: A Study Guide for CompTIA SY0‑701

Preparing for the Security+ exam requires a solid grasp of the concepts covered above. Use the following checklist to reinforce your knowledge:

• Identify the correct security control type for common devices (e.g., firewall = preventive).
• Explain the purpose of deterrent controls and give real‑world examples.
• Recall the placement of Integrity in the CIA triad diagram (right side).
• Differentiate between physical, logical, and compensating controls; know that a power generator is a physical compensating control.
• Describe each step of a fileless malware infection, especially the registry persistence step (Step 5).
• Define non‑repudiation and illustrate how digital signatures provide this property.
• Distinguish between Authorization, Authentication, Accounting, and Identification within the AAA framework.
• Articulate Zero Trust control plane recommendations, focusing on policy definition for packet forwarding.

By mastering these topics, you will be well‑prepared to answer multiple‑choice questions, apply concepts in practical scenarios, and demonstrate a comprehensive understanding of modern cybersecurity principles.