Security+ Course Notes

This section establishes foundational security principles essential for understanding more advanced topics. It covers core concepts like the CIA triad, security controls, change management, and Public Key Infrastructure (PKI). A strong grasp of these basics is critical for correctly interpreting scenario-based questions throughout the exam.

• Distinguish between preventative controls (stopping incidents) and incident response (reacting to incidents).

• Read scenario questions carefully and identify the *specific* problem being described. Don't jump to conclusions.

The exam tests identifying and mitigating threats and vulnerabilities, a core responsibility for any security professional. Understanding the attacker's perspective – their motivations, tools, and techniques – is crucial for building effective defenses. It's not enough to simply know *what* a threat is; you must understand *how* it exploits vulnerabilities and *what* controls can be implemented to reduce risk.

• **Phishing vs. Whaling:** Remember that whaling is a targeted form of phishing aimed at high-value individuals.

• Prioritize patching based on the Common Vulnerability Scoring System (CVSS) score and exploitability.

The exam tests security architecture, which is the foundation for protecting systems and data. It's not just about individual tools, but how they fit together to create a resilient and secure environment. Understanding architectural principles allows you to design, implement, and evaluate security controls effectively.

• **IaaS vs. PaaS vs. SaaS:** Understand the differences in responsibility. IaaS gives you the most control, PaaS manages the OS, and SaaS manages everything.

• Prioritize security principles over cost or convenience when evaluating architectural options.

The exam tests the operational aspects of security – what you do *after* implementing preventative controls. It's about detecting, responding to, and recovering from security incidents, and maintaining a secure environment over time. Expect questions about incident response phases, vulnerability management, asset tracking, and security tools.

• **Hashing vs. Encryption:** Hashing is one-way; encryption is reversible. Understand their different use cases (data integrity vs. confidentiality).

• Prioritize actions based on the immediate threat level. Containment is often the first step.

The exam tests the foundational elements of a robust security program, moving beyond technical controls to encompass governance, risk management, and compliance. It’s not just about implementing firewalls or antivirus; it’s about establishing a framework that ensures security efforts align with business objectives and legal requirements.

• **Risk Appetite vs. Risk Tolerance:** Risk appetite is the *willingness* to take risk; risk tolerance is the *acceptable level* of risk. They are related but distinct concepts.

• Read scenario questions carefully and identify the key objectives and constraints.