What 'General security concepts' covers

This is the foundation domain of Security+ (SY0-701). It covers security controls, the CIA triad, AAA, cryptographic basics, and change management. It is roughly 12% of the exam, but the ideas underpin every other domain, so learn it properly.

Categories and types of controls

Controls are described two ways: category (how it works) and type (what it does).

• Categories: technical (firewalls, encryption), managerial (policies, risk assessments), operational (awareness training, guards), physical (locks, fencing, CCTV).
• Types: preventive (stops an incident, eg MFA), deterrent (discourages, eg warning signs), detective (finds it, eg IDS, logs), corrective (fixes it, eg backups, patching), compensating (an alternative when the main control is not possible), directive (tells people what to do, eg policy).
• Common mistake: mixing up deterrent and preventive. A sign is deterrent; a locked door is preventive.

CIA triad and related concepts

• Confidentiality: only authorised people see the data (encryption, access control).
• Integrity: data has not been altered (hashing, digital signatures).
• Availability: systems are up when needed (redundancy, backups, DR).
• Non-repudiation: proof someone did an action, so they cannot deny it (digital signatures).
• AAA framework: Authentication (who you are), Authorization (what you can do), Accounting (logging what happened).

Cryptographic basics

• Symmetric encryption: one shared key, fast, used for bulk data (AES).
• Asymmetric encryption: public/private key pair, used for key exchange and signatures (RSA, ECC).
• Hashing is one-way and used for integrity, not confidentiality — never say 'encrypt with a hash'.
• Digital signature = hash of the message encrypted with the sender's private key; verifies both integrity and authenticity.
• PKI issues and manages certificates via a Certificate Authority (CA); a certificate binds a public key to an identity.

Zero Trust

'Never trust, always verify.' Every request is authenticated and authorised regardless of network location. Two planes: the control plane (policy engine, policy administrator) decides; the data plane (policy enforcement point) enforces. No implicit trust just because a device is inside the corporate network.

Change management

Changes to systems must go through a formal process: request, impact analysis, approval (Change Advisory Board), testing, implementation, and a documented backout plan. Common mistake: skipping the backout plan — always have a way to reverse a change that goes wrong.

Common exam traps

• Gap analysis compares current state to desired state, not a type of control.
• 'Least privilege' and 'need to know' sound similar but least privilege is about permission level, need to know is about data access relevance.
• Encryption protects confidentiality; hashing protects integrity; they are not interchangeable answers.

Threats, vulnerabilities and mitigations

This domain covers threat actors, attack types, vulnerabilities and how to reduce risk. It is one of the heaviest-weighted areas in Security+ SY0-701, so know it cold.

Threat actor types

• Nation-state: highest resources and sophistication, often APT (advanced persistent threat) level, motivated by espionage/disruption.
• Organised crime: financially motivated, uses ransomware and fraud.
• Hacktivist: ideologically motivated, favours defacement and DDoS.
• Insider threat: has legitimate access already, hardest to detect by perimeter tools.
• Unskilled attacker (formerly 'script kiddie'): low skill, uses off-the-shelf tools.
• Shadow IT: not malicious but creates unmanaged, unpatched attack surface.

Common attack vectors

• Phishing, vishing (voice), smishing (SMS) and pretexting are all social engineering.
• Business email compromise (BEC) targets finance staff using spoofed executive emails.
• Watering hole attacks compromise a site the victims already trust and visit.
• Supply chain attacks compromise a trusted vendor or update mechanism to reach many victims at once.

Malware and vulnerability types

• Ransomware encrypts data and demands payment; know the difference from a wiper, which destroys data with no recovery intent.
• Zero-day: a vulnerability exploited before a patch exists — no CVE fix available yet.
• Buffer overflow, SQL injection and cross-site scripting (XSS) remain classic application-layer weaknesses; injection flaws stem from unvalidated input.
• Race conditions (e.g. time-of-check to time-of-use, TOCTOU) exploit timing gaps in code logic.

Mitigation techniques

• Segmentation isolates critical systems on separate network zones to limit lateral movement.
• Least privilege gives users/accounts only the access they need, nothing more.
• Patch management closes known vulnerabilities — the number one defence against non-zero-day exploits.
• Hardening: disabling unused services/ports, changing default credentials, applying secure baselines.
• Compensating controls are used when the primary control cannot be applied (e.g. legacy systems that cannot be patched).

Common mistakes

• Confusing a vulnerability (a weakness) with a threat (the actor/event that could exploit it) with risk (the likelihood x impact).
• Assuming patching alone stops zero-days — it cannot, since no patch exists yet; mitigating controls (segmentation, monitoring) are needed instead.
• Mixing up vishing/smishing/phishing — the exam tests you know which channel each uses.

What security architecture covers

Security architecture is about designing IT environments so that security is built in, not bolted on. Security+ tests your grasp of models, network design patterns, and infrastructure concepts that reduce risk by design.

Zero Trust

Zero Trust assumes no user or device is trusted by default, inside or outside the network perimeter - 'never trust, always verify'. Two core planes: the control plane (policy engine, policy administrator - decides who gets access) and the data plane (policy enforcement point - actually blocks or allows traffic). Verification happens continuously, not just at login. Common mistake: candidates think Zero Trust means 'no VPN' - it actually means every request is authenticated and authorised regardless of location.

Network infrastructure concepts

• Physical isolation: air-gapped systems have no network connection at all - highest security, used for critical control systems.
• Logical segmentation: VLANs split one physical network into separate broadcast domains without new cabling.
• Screened subnet (formerly called DMZ): a buffer zone between the internet and the internal LAN, holding public-facing servers (web, mail) so a breach there doesn't reach the internal network directly.
• Extranet: a controlled-access network segment shared with trusted external partners.
• Intranet: the private internal network, not reachable from outside.

Deployment and infrastructure models

• On-premises vs cloud vs hybrid: cloud shifts responsibility per the shared responsibility model - the provider secures the cloud, the customer secures what's IN the cloud (data, access, configuration).
• IaaS, PaaS, SaaS: the customer's security duties shrink as you move from IaaS towards SaaS, but data protection remains the customer's job in all three.
• Microservices and containerisation (e.g. Docker) isolate application components, but each container image must be scanned and patched.
• Serverless computing removes server management but expands the attack surface at the API/function level.

Resilience and site considerations

• High availability aims for near-continuous uptime (often quoted as 'five nines' = 99.999%).
• Site types: hot site (fully operational, fastest failover, most expensive), warm site (partially equipped, some setup needed), cold site (basic facility only, cheapest, slowest to activate).
• Load balancing and clustering spread load and remove single points of failure.

Common mistakes

Students confuse 'DMZ' terminology with modern exam wording ('screened subnet') - know both. They also forget that Zero Trust is a strategy applied across the whole architecture, not a single product, and that segmentation (VLANs, screened subnets) is a foundational control referenced across many other domains, including incident containment.

What 'security operations' covers

This domain is the day-to-day running of a secure environment: hardening systems, managing identity, monitoring, and keeping assets under control. It is the biggest single domain on the exam, so know it cold.

Hardening and baselines

• Apply secure baselines (CIS Benchmarks) then monitor for drift back to insecure defaults.
• Disable unused ports, protocols and services - the classic mistake is leaving default accounts and default passwords active.
• Patch management: test patches in a staging ring before production, and track a defined patch cadence (not 'whenever').
• Mobile hardening options include full device encryption, remote wipe, geofencing and containerisation (COPE, BYOD, CYOD are the ownership models).

Asset and change management

• You cannot secure what you cannot see - maintain an accurate asset inventory including IoT and decommissioned kit.
• Every change goes through a formal change management process: request, impact assessment, approval by a change advisory board (CAB), test, implement, and a documented backout plan.
• Common mistake: skipping the backout plan - the exam will flag a scenario where a change has 'no rollback' as the wrong answer.

Identity and access management

• Enforce least privilege and need-to-know as defaults, not afterthoughts.
• Use role-based access control (RBAC) tied to job function, reviewed periodically (access recertification).
• Onboarding/offboarding must be prompt - offboarding especially: revoke access the same day, not 'next cycle'. Delayed deprovisioning is a favourite exam trap.
• Privileged access management (PAM) tools give just-in-time, time-boxed admin rights instead of standing privilege.

Monitoring, logging and alerting

• Centralise logs to a SIEM for correlation; keep clocks synced via NTP so timestamps actually line up across systems.
• Log retention should match your compliance requirement, not just disk space available.
• Alert tuning matters: too many false positives causes alert fatigue and real incidents get missed.

Vulnerability management

• The cycle is: identify (scan), analyse, prioritise (often by CVSS score), remediate, and validate the fix with a rescan.
• False positive = flagged but not actually a vulnerability; false negative = missed vulnerability that IS present - false negatives are the more dangerous exam answer.
• Penetration testing needs written authorisation (a rules of engagement document) before it starts - unauthorised testing is illegal even with good intentions.

Common exam mistakes

• Confusing vulnerability scanning (automated, passive) with penetration testing (manual, exploits weaknesses).
• Forgetting that hardening is continuous - one-off configuration is not 'secure operations'.

What IAM covers

Identity & Access Management (IAM) is about proving who someone is (authentication) and then controlling what they can do (authorisation). Security+ tests both the theory and the specific technologies.

Authentication factors

There are three classic factors: something you know (password, PIN), something you have (smart card, token, phone), and something you are (biometrics - fingerprint, iris, face). A fourth, less tested factor is somewhere you are (geolocation). Multifactor authentication (MFA) means combining factors from at least two different categories - two passwords is NOT MFA, it is just two knowledge factors.

Authentication protocols and standards

• Kerberos uses tickets and a Key Distribution Centre (KDC); tickets typically expire (commonly 10 hours by default in Windows AD), preventing indefinite reuse.
• LDAP (port 389, or 636 for LDAPS) is the standard for querying directory services like Active Directory.
• RADIUS (UDP 1812/1813) and TACACS+ (TCP 49) are AAA protocols for network device and remote access authentication. TACACS+ encrypts the whole packet; RADIUS only encrypts the password.
• SAML, OAuth 2.0 and OpenID Connect (OIDC) enable federation and single sign-on (SSO) across organisations. SAML uses XML assertions; OAuth issues access tokens; OIDC adds an identity layer on top of OAuth.

Access control models

• DAC (Discretionary): the resource owner decides who gets access.
• MAC (Mandatory): access set centrally by security labels/clearance (used in military/government).
• RBAC (Role-Based): access tied to job role, not the individual.
• ABAC (Attribute-Based): access decided dynamically from attributes (time, location, device).
• Rule-Based access control uses if-then rules (e.g. firewall ACLs).

Key principles

• Least privilege: give users only the access they need to do their job, nothing more.
• Need to know: even with clearance, only see information relevant to the task.
• Separation of duties: split critical tasks between two or more people to stop fraud.
• Just-in-time (JIT) access and privileged access management (PAM) grant elevated rights temporarily, then revoke them.

Common mistakes to avoid

• Confusing authentication (who you are) with authorisation (what you can do) - a classic exam trap.
• Forgetting that federation and SSO reduce password fatigue but create a single point of failure if the identity provider is compromised.
• Assuming biometrics are foolproof - they can be spoofed and cannot be 'reset' like a password if stolen.
• Not rotating or expiring service account credentials, a top real-world breach cause.

Symmetric vs asymmetric

Symmetric crypto uses one shared key for encryption and decryption - fast, used for bulk data. AES is the standard, typically AES-256 in GCM mode for authenticated encryption. Key exchange is the weakness - both parties need the same secret safely.

Asymmetric (public key) crypto uses a key pair - public key encrypts or verifies, private key decrypts or signs. RSA (2048-bit minimum, 3072+ recommended) and ECC (256-bit, e.g. secp256r1) are the main algorithms. ECC gives equivalent strength to RSA with much smaller keys, so it suits mobile and IoT.

Hashing

Hashing is one-way - turns data into a fixed-length digest, cannot be reversed. Used for integrity checks and password storage. SHA-256 and SHA-3 are current standards. Never use MD5 or SHA-1 for security purposes - both are broken for collision resistance. Passwords must be salted and hashed with a slow algorithm like bcrypt, scrypt, or Argon2, never a fast general hash alone.

PKI structure

A Certificate Authority (CA) issues digital certificates binding a public key to an identity, following X.509 format. The chain of trust runs Root CA to Intermediate CA to end-entity certificate. Root CAs are kept offline for security. A Certificate Signing Request (CSR) is submitted to get a cert issued.

Revocation and validation

CRL (Certificate Revocation List) is a downloadable list of revoked certs - slow and can be large. OCSP (Online Certificate Status Protocol) checks a single cert's status in real time - faster. OCSP stapling lets the server provide a signed, timestamped OCSP response itself, improving speed and privacy.

Key exchange and hybrid use

Diffie-Hellman (and ECDHE for forward secrecy) lets two parties agree a shared symmetric key over an insecure channel without sending the key itself. TLS uses this hybrid model: asymmetric crypto for the handshake/key exchange, symmetric crypto (AES) for the actual session data - asymmetric is too slow for bulk encryption.

Digital signatures

Signing uses the sender's private key on a hash of the message; anyone verifies with the sender's public key. This proves authenticity, integrity, and non-repudiation.

Common exam traps

• Confusing which key encrypts vs decrypts in asymmetric crypto (public encrypts/verifies, private decrypts/signs).
• Forgetting AES is symmetric and RSA/ECC are asymmetric.
• Thinking hashing is encryption - it is not reversible.
• Mixing up CRL (list, slower) with OCSP (real-time, single query).
• Not knowing PFS (Perfect Forward Secrecy) means session keys aren't compromised even if the long-term private key is later exposed - achieved via ephemeral Diffie-Hellman (DHE/ECDHE).