D1: General Security Concepts

Security controls are safeguards or countermeasures that reduce risk. The exam separates them into two dimensions: what they are made of (category) and what they do (type). A single control can belong to one category and multiple types simultaneously.

Control Categories

A category describes how the control is implemented.

Control Types

A type describes the function the control performs in the security lifecycle.

Mapped Examples

The CIA Triad

The CIA triad is the foundational model of information security. Every security control maps to one or more of these three properties. When a security decision needs justification, you trace it back here.

These properties can work against each other. Maximizing confidentiality (encrypting everything with strict key management) can hurt availability if a user loses their key. Security architecture means balancing all three based on what a particular asset or system needs most.

Non-repudiation

Non-repudiation ensures that a party cannot deny having performed an action. If you send a digitally signed document, the signature is proof it came from you. You cannot credibly claim later that you did not send it, because only you have the private key that produced the signature.

Technical controls that support non-repudiation: digital signatures, audit logs, timestamping, access records. Non-repudiation is closely tied to integrity and authentication — but it adds the legal and evidentiary dimension of proving who did what.

Authentication, Authorization, and Accounting (AAA)

AAA describes the three phases of access control in a system.

In enterprise networks, AAA is often implemented through RADIUS or TACACS+. RADIUS is widely used for wireless and VPN authentication. TACACS+ is more common for network device administration because it separates authentication, authorization, and accounting into independent sessions, allowing more granular control.

Authentication Factors

Authentication relies on proving identity through one or more of these factor types:

Multi-factor authentication (MFA) requires two or more different factor types. A password plus a security question is two knowledge factors — that is single-factor authentication repeated twice, not MFA. A password plus a hardware token is a password (something you know) plus a physical device (something you have): that is genuine MFA.

Gap Analysis

Gap analysis compares an organization's current security posture against a desired target state: a regulatory requirement, an industry framework like NIST CSF or ISO 27001, or an internally defined baseline. The output is a list of gaps where controls are missing, insufficient, or not aligned to the standard.

Gap analysis answers the question: "Where are we vulnerable relative to where we need to be?" It is a structured way to prioritize security investment rather than reacting to incidents.

Zero Trust Architecture

Zero Trust is an architectural principle: no user, device, or network connection should be trusted by default, regardless of where it is coming from — including inside the corporate network. Every access request is evaluated explicitly based on identity, device health, location, and behavior.

The traditional security model assumed that everything inside the network perimeter was safe and everything outside was hostile. That assumption is broken by remote work, cloud services, and BYOD. Zero Trust replaces "trust the network" with "verify every access."

Three guiding principles:

• Verify explicitly: Always authenticate and authorize using all available signals (identity, location, device posture, service requested).
• Use least privilege: Grant access only to what is needed for the specific task, and no more. Just-in-time (JIT) and just-enough-access (JEA) are implementations of this.
• Assume breach: Design as if an attacker is already inside. Limit blast radius through microsegmentation, encrypt data in transit and at rest, and monitor everything.

Physical Security

Domain 1 requires specific knowledge of physical security controls and what each one does. Physical security is not just about keeping people out — it is about controlling access, detecting unauthorized presence, and reducing the effectiveness of physical attacks.

Deception and Disruption Technology

Deception technology creates fake assets that look real to an attacker. The key property is that legitimate users have no reason to touch these resources. Any interaction with them is an indicator of compromise.

Change management is a formal process for controlling modifications to systems, networks, and applications. Its security function is to prevent changes from introducing new vulnerabilities, creating outages, or bypassing existing controls. Poorly managed changes are a common root cause of both security incidents and unplanned downtime.

Business Process Controls

Technical Implications of Change

Changes to systems have downstream security effects that must be planned for.

• Allow lists and deny lists: A new application or process may need to be explicitly permitted (added to an allow list) or blocked. An application change may require updating which executables or IP ranges are permitted in firewall or endpoint policies.
• Restricted activities: Certain changes trigger additional security review before they can proceed: installing new software, opening inbound firewall ports, creating administrative accounts, or modifying encryption settings.
• Downtime: Planned downtime must be communicated and scheduled. Unplanned downtime during a change is a finding that reflects poor change planning.
• Service and application restarts: Some configuration changes require restarting services. This can cascade to dependent systems and must be accounted for in the impact analysis.
• Legacy applications: Older systems may not support modern controls (newer TLS versions, MFA integration, current cipher suites). Changes that assume modern capabilities may break or expose legacy components.
• Dependencies: A change to one system can break another that relies on it. Dependency mapping is part of impact analysis — changes to a core authentication service can cascade to every application that uses it.

Documentation Requirements

• Updating diagrams: Network diagrams, data flow diagrams, and system architecture diagrams must be updated after changes to reflect the new actual state. Stale diagrams mislead incident responders and auditors.
• Updating policies and procedures: If a change alters how something is done, the written procedures must be updated. Undocumented changes create institutional knowledge gaps.
• Version control: Configuration files, scripts, and documentation should be stored in a version control system. Version history provides an auditable record of what changed, when, and who authorized it.

Cryptography is the practice of securing information through mathematical transformations. Domain 1 covers the core building blocks: symmetric and asymmetric encryption, hashing, digital signatures, key exchange, and the controls built on top of them.

Symmetric Encryption

Symmetric encryption uses the same key for both encrypting and decrypting data. Both the sender and receiver must possess the same secret key. This approach is fast and efficient for large data volumes, but it creates a key distribution problem: how do you securely share the key with the other party in the first place?

Asymmetric Encryption

Asymmetric encryption uses a mathematically linked key pair: a public key (shared openly) and a private key (kept secret by the owner). Data encrypted with the public key can only be decrypted with the corresponding private key, and vice versa.

This solves the key distribution problem: you can publish your public key to anyone. Only your private key can decrypt messages sent to you. Asymmetric encryption is much slower than symmetric, so it is used primarily for key exchange and digital signatures rather than encrypting large data volumes.

Hybrid Encryption

In practice, symmetric and asymmetric encryption are almost always used together. TLS (the protocol that secures HTTPS) is the most common example:

1. Asymmetric cryptography (RSA or ECDH) establishes a shared session key during the handshake
2. That session key drives AES symmetric encryption for the actual data transfer

This gives you the key distribution strength of asymmetric (no need to pre-share a secret) with the performance of symmetric (AES is fast enough for continuous data streams).

Hashing

A hash function takes input of any length and produces a fixed-length output called a digest or checksum. Hash functions are one-way: you cannot reverse the output to recover the original input. They are used to verify data integrity, not to protect confidentiality.

Key properties of a secure hash function:

• One-way (pre-image resistance): You cannot derive the input from the output
• Deterministic: The same input always produces the same output
• Avalanche effect: A tiny change to input produces a completely different output
• Collision resistance: It should be computationally infeasible to find two different inputs that produce the same hash

Salting

A salt is a random value added to a password before hashing. Without salting, two users with the same password produce identical hashes. Attackers exploit this with precomputed lookup tables called rainbow tables: large databases mapping common passwords to their hash values.

Adding a unique salt per user makes every hash unique, even if the underlying passwords are identical. Rainbow tables become useless because they would need to be recomputed for every possible salt value. Salts are stored alongside the hash in the database. Their purpose is uniqueness and unpredictability, not secrecy.

Key Stretching

Key stretching takes a short or potentially weak password and makes it much harder to brute-force by deliberately slowing down the hashing process. The algorithm is designed to require many iterations and significant computation, so even fast modern hardware takes a meaningful amount of time per guess.

Digital Signatures

A digital signature provides two guarantees: integrity (the content was not altered) and non-repudiation (it came from someone who possesses the specific private key). Signatures do not encrypt the content — they verify it.

How a digital signature works:

1. The sender hashes the message or document (e.g., SHA-256)
2. The sender encrypts that hash with their private key. That encrypted hash is the signature.
3. The sender transmits both the original message and the signature
4. The recipient decrypts the signature using the sender's public key, recovering the hash
5. The recipient independently hashes the received message and compares the two hashes
6. If the hashes match: the message was not tampered with (integrity) and came from the key owner (authenticity)

Key Exchange

Key exchange protocols solve a specific problem: how do two parties agree on a shared secret over an untrusted channel without ever transmitting the secret itself?

• Diffie-Hellman (DH): The original protocol. Each party generates a private value and a corresponding public value. The math combines both public values in a way that produces the same shared secret on both ends, without either party ever sending that secret. An eavesdropper sees only the public values and cannot derive the shared secret without solving a computationally infeasible problem.
• ECDH (Elliptic Curve Diffie-Hellman): The ECC-based version of Diffie-Hellman. Equivalent security with much smaller keys and faster computation.
• ECDHE (Ephemeral ECDH): Uses a fresh, temporary key pair for each session. This provides Perfect Forward Secrecy (PFS): even if the server's long-term private key is later compromised, past recorded session traffic cannot be decrypted because each session's key was independently generated and discarded.

Obfuscation Techniques

Blockchain and Open Public Ledgers

A blockchain is a distributed, append-only ledger where each block of recorded data is cryptographically linked to the previous block via a hash. Altering any block changes its hash, which invalidates all subsequent blocks — making tampering evident.

On a public (open) blockchain, all participants can independently verify the complete transaction history. No single entity controls the ledger. Transactions are signed with private keys, providing non-repudiation.

From a security perspective, blockchain provides strong data integrity and non-repudiation properties. Beyond cryptocurrency, these properties are applied to supply chain provenance (tracking who handled a product at each step), audit log tamper-evidence, and digital identity schemes.

Algorithm and Key Length Reference

PKI is the ecosystem of roles, policies, hardware, software, and procedures that creates, manages, distributes, and revokes digital certificates. A certificate binds a public key to an identity (a domain name, an organization, a person, or a device) in a way that a trusted third party has verified. That trust is what makes HTTPS work.

Certificate Authority (CA) Hierarchy

Trust in PKI flows from a hierarchy of certificate authorities.

Certificate Lifecycle

1. Key generation: The entity generates a public/private key pair. The private key never leaves the entity's control.
2. Certificate Signing Request (CSR): The entity creates a CSR containing the public key and identifying information (domain name, organization, location). The CSR is sent to the CA.
3. Vetting: The CA (or RA) verifies the identity claims in the CSR. The depth of verification depends on the certificate type (DV, OV, or EV).
4. Issuance: The CA signs the certificate with its private key. This signature is what establishes trust. The signed certificate is returned to the requestor.
5. Installation: The certificate is installed on the server, application, or device.
6. Renewal: Certificates have a fixed validity period (typically one to two years for public certificates). They must be renewed before expiry or services will break.
7. Revocation: If a certificate must be invalidated early — due to key compromise, organizational change, or domain loss — the CA revokes it and publishes the revocation status.

Certificate Revocation Methods

When a certificate must be invalidated before its expiry date, the CA must publish notice so that clients can check the status before trusting it.

Certificate Types

Certificate types reflect the level of identity verification the CA performed before issuance.

Certificate Formats

The same certificate data can be stored in different file formats. The format matters when moving certificates between systems or importing them into applications.

Trust Models