CompTIA Security+ Certification (SY0-501)

CompTIA Security+ Certification (SY0-501)

1. The Goal: CIA

   • Confidentiality
   • Integrity
   • Accessibility
   • Auditing & Accountability
   • Non-Repudation

2. Entities

   • Asset
     • Part of infrastructure (or resource) that provides benefit to the organization
   • Risk
     • Threats applied to vulnerability
   • Threat Actor
     • An entity that initiates threat (often can be human but also can be hurricane, etc)
     • attibutes
       • relation
         • Internal
         • External
       • sophistication
       • resourcing/funding
       • Intent/motivation
       • Use of Open Source Intelligence (OSINT)
     • types
       • Script kiddies
       • Hactivists
       • Organized crime
       • Nation states (Advanced Persistent Threat - APT)
       • Insiders
       • Competitors
   • Threat
     • A discovered action that exploits vulnerability's potential to do the harm to an asset.
   • Vulnerability
     • A weakness that allows an asset to be exploited
   • Likelihood
     • A level of certainty that something will happen
     • Quantative
       • Often measured as % over a year or cost to fix
     • Qualitative
       • Fuzzy measure like low, med, high (for example customer's loyalty)
   • Impact
     • An actual harm caused by the threat