CompTIA Security+ (SY0-701)

This deck introduces the foundational concepts you need to know for the CompTIA Security+ (SY0) certification. The cards walk you through the core language of information security — things like the CIA triad, the Parkerian hexad, defense in depth, least privilege, separation of duties, and the difference between threats, vulnerabilities, and risks. You'll also get familiar with how vulnerabilities are catalogued and scored using systems like CVE and CVSS, which is knowledge that comes up again and again in real IT work.

It's a great fit if you're early in your cybersecurity journey, an IT support or admin professional looking to move into security, or a student preparing to sit the Security+ exam. Even if you're not pursuing the cert, the vocabulary and principles here are useful for anyone who touches systems, networks, or data as part of their job.

Because these concepts build on each other, try working through the cards in order the first time, then let spaced repetition do the heavy lifting on later passes. Pay special attention to terms that sound similar but mean different things — authentication versus authorization, for example — since the exam (and real-world security work) often hinges on telling those apart. And whenever a card references a principle like least privilege or separation of duties, try to think of a concrete scenario where you'd apply it; that small step of connecting the term to a situation makes it stick far longer than rote memorization alone.

The foundation of information security rests on several core principles that every practitioner must understand. The CIA triad—Confidentiality, Integrity, and Availability—defines the three properties that security controls aim to protect. Confidentiality ensures that data is accessible only to authorized parties, integrity ensures that data has not been altered, and availability ensures that systems remain accessible when needed. AAA (Authentication, Authorization, and Accounting) extends this model by adding accountability and access control: authentication verifies identity, authorization determines permitted actions, and accounting tracks what users actually do. Non-repudiation strengthens accountability by ensuring a party cannot deny having performed an action, typically through digital signatures or audit logs. An alternative model, the Parkerian hexad, expands the CIA triad with three additional attributes: possession, authenticity, and utility.

Beyond these models, several guiding principles shape how security controls are applied. Defense in depth uses multiple overlapping security layers so that no single failure causes compromise. The principle of least privilege grants users only the minimum access needed for their job, while need-to-know further restricts access to information required for a specific task, even if the user holds broader clearance. Separation of duties splits critical tasks among multiple people so that no single individual can commit fraud undetected. Together these principles reduce risk by limiting both opportunity and impact.

Risk management requires a precise vocabulary. A threat is a potential cause of harm, a vulnerability is a weakness that can be exploited, and risk is the product of the likelihood that a threat exploits a vulnerability and the resulting impact. A zero-day vulnerability is particularly dangerous because it is unknown to the vendor and has no patch available, leaving attackers free to exploit it. Vulnerabilities are cataloged through programs like CVE (Common Vulnerabilities and Exposures), which assigns unique identifiers, and scored using CVSS (Common Vulnerability Scoring System) on a scale from 0.0 to 10.0 reflecting base severity. Organizations track these in a risk register, an inventory of identified risks along with their likelihood, impact, owners, and mitigation status. When risk cannot be reduced, it can be transferred—for example, through cyber insurance or outsourcing—or formally accepted when the cost of control exceeds the potential loss.

To prioritize defenses, security teams use threat modeling, a structured process for identifying, classifying, and prioritizing threats. The popular STRIDE framework categorizes threats into Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Two closely related concepts are the attack surface and the attack vector. The attack surface is the total sum of all points where an unauthorized user could enter or extract data, while the attack vector is the specific path or method used to actually gain access. Reducing the attack surface—through techniques like the principle of least functionality—limits the paths attackers can exploit in the first place.

People are often the weakest link in any security system, and attackers exploit this through social engineering—the manipulation of human psychology to trick individuals into revealing confidential information or performing unsafe actions. Many variants target specific channels. Phishing uses fraudulent email or messages to steal credentials or install malware. Spear phishing narrows the focus to a specific individual or group, while whaling goes further by targeting senior executives, who are referred to as the "big fish." Voice phishing, called vishing, is conducted over the telephone or VoIP, and smishing delivers the same trick through SMS text messages. Pretexting fabricates a believable scenario, such as posing as IT support, to persuade victims to share data. Outside the digital realm, tailgating (also called piggybacking) occurs when an unauthorized person physically follows an authorized employee through a controlled door, and dumpster diving recovers sensitive information from discarded trash, such as printed documents or written-down credentials.

When social engineering fails or is unnecessary, attackers turn to technical password attacks. A brute-force attack tries every possible password combination until the correct one is found, while a dictionary attack narrows the search to a predefined list of common passwords. Credential stuffing uses username and password pairs leaked from one breach to attempt logins on unrelated services, exploiting password reuse across sites. Password spraying works in the opposite direction: rather than hammering one account with many passwords, it tries a small set of common passwords across many accounts to avoid triggering account lockouts. These attacks succeed because users often choose weak or reused passwords and because many organizations still rely solely on knowledge-based authentication.

Defending against these attacks requires strong password storage practices. Hashing is a one-way cryptographic function that maps data of any size to a fixed-size output called a digest. Unlike encryption, hashing is not reversible—given a hash, you cannot recover the original input. This one-way property is what makes hashing suitable for storing passwords. However, attackers can still recover weak passwords using precomputed rainbow tables, large databases of hashes for common passwords. The standard defense is salting: appending a unique random value to each password before hashing so that precomputed tables become ineffective. With proper salting and a modern, deliberately slow hash function, even leaked password databases resist practical cracking.

Modern cryptography provides the technical backbone for protecting data at rest and in transit, and it comes in two main flavors. Symmetric encryption uses a single shared key to both encrypt and decrypt, making it fast and suitable for bulk data. Common symmetric algorithms include AES (the current standard), 3DES (legacy and being phased out), and ChaCha20. Asymmetric encryption, by contrast, uses a mathematically linked public and private key pair: the public key encrypts or verifies signatures, and the private key decrypts or creates them. RSA, the most widely used asymmetric algorithm, secures communication, creates digital signatures, and performs key exchange based on the difficulty of factoring large primes. ECC (Elliptic Curve Cryptography) offers equivalent security to RSA with much smaller key sizes, making it popular in mobile and IoT environments. DSA is another asymmetric algorithm used primarily for signatures.

Digital signatures are a key application of asymmetric cryptography. To sign a message, the sender hashes it and encrypts the hash with their private key; the recipient verifies by decrypting with the sender's public key and comparing hashes. This proves both the sender's identity and the message's integrity. Public keys are distributed through digital certificates, which are signed and issued by a Certificate Authority (CA). The standard format for these certificates is X.509, used throughout PKI and TLS. Certificates vary in scope: a self-signed certificate is signed by the entity itself and is not trusted by default in browsers unless manually added, while a wildcard certificate secures a domain and all of its first-level subdomains, written as *.example.com. Applications can also use certificate pinning to hardcode a specific certificate or public key, detecting fraudulent certificates even when they are technically valid. To handle compromised certificates, CAs publish Certificate Revocation Lists (CRLs) and offer real-time lookups via the Online Certificate Status Protocol (OCSP).

All of these components together form a Public Key Infrastructure (PKI), the framework of policies, hardware, software, and people used to manage certificates and keys. Special components protect keys themselves: key escrow stores a copy of a key with a trusted third party for recovery, hardware security modules (HSMs) are tamper-resistant devices that generate, store, and manage keys, and a Trusted Platform Module (TPM) is a chip on the motherboard that stores keys and supports platform integrity measurements. Full-disk encryption (FDE), such as BitLocker or FileVault, encrypts entire storage devices so all data is unreadable without the proper key at boot. Block cipher modes of operation, such as CBC, GCM, and CTR, define how a block cipher is applied to data longer than a single block; AES-GCM is an authenticated encryption mode that provides both confidentiality and integrity in a single operation. Message Authentication Codes (MACs) and the more common HMAC (Hash-based MAC) verify both integrity and authenticity using a shared secret key.

Two parties who have never met still need a way to establish a shared secret, which is the job of key exchange protocols. Diffie-Hellman allows two parties to derive a shared secret over an insecure channel, even though an eavesdropper observes every message; RSA can also be used for key exchange, but as an encryption and signature algorithm rather than a dedicated key-agreement scheme. ECDH applies the same idea over elliptic curves. Modern protocols also aim for perfect forward secrecy (PFS), a property where session keys are ephemeral, so that compromising one long-term private key cannot decrypt previously recorded sessions. Combined with hashing, signature schemes, and certificate infrastructure, these primitives underpin nearly every secure communication protocol in use today.

Secure communication over untrusted networks relies on cryptographic tunnels and well-understood protocols. A Virtual Private Network (VPN) creates an encrypted tunnel across a public network, providing confidentiality and integrity for the traffic that passes through it. At the application layer, TLS (Transport Layer Security) is the modern successor to SSL and is what makes HTTPS, S/MIME, and countless other encrypted services possible. SSL 3.0 is now deprecated and considered insecure; current systems use TLS 1.2 or 1.3. HTTPS is simply HTTP running over TLS, providing server (and optionally client) authentication, encryption, and integrity. Standard ports reflect these conventions: HTTP uses TCP 80, HTTPS uses TCP 443, and SSH uses TCP 22. SSH provides secure remote command-line access and file transfer, replacing the unencrypted Telnet protocol. For file transfer, two secure options exist: SFTP, which tunnels FTP-like commands over SSH on port 22, and FTPS, which adds TLS directly to FTP on ports 989 and 990.

At the network perimeter, firewalls enforce access policies between zones. A stateless firewall inspects each packet independently against a rule set, while a stateful firewall tracks active connections and uses that context to make decisions. A Web Application Firewall (WAF) is specialized for HTTP traffic, filtering and monitoring requests to and from a web application. Next-generation firewalls (NGFWs) combine traditional filtering with deep packet inspection, intrusion detection and prevention, application awareness, and threat intelligence feeds. Beyond the firewall, organizations structure their networks to limit damage: network segmentation divides the network into smaller zones (VLANs and subnets) so a compromise cannot spread everywhere; a DMZ (demilitarized zone) sits between the untrusted Internet and trusted internal networks, hosting public-facing services; and a jump server (or bastion host) is a hardened host used to access and manage devices in a separate security zone. Within data centers, traffic between servers is called east-west traffic, while traffic between clients and servers is north-south—segmentation and east-west controls matter especially for the former.

Many attacks target the protocols that underpin local networks. ARP (Address Resolution Protocol) maps IPv4 addresses to MAC addresses on a local segment, and ARP poisoning sends forged ARP messages to associate an attacker's MAC with a legitimate IP, enabling man-in-the-middle attacks. DNS poisoning corrupts a resolver's cache so that users are redirected to malicious sites. A MAC flooding attack overloads a switch's MAC address table, forcing it to fail open into hub mode and broadcast traffic that can then be captured. Attackers can also deploy rogue DHCP servers handing out incorrect configuration—including a malicious default gateway—or perform VLAN hopping via switch spoofing or double-tagged 802.1Q frames to reach VLANs that should be unreachable.

A man-in-the-middle (MITM) attack occurs when an attacker secretly intercepts and possibly alters communication between two parties who believe they are talking directly to each other. TLS stripping is a specific form: a MITM downgrades a user's HTTPS connection to unencrypted HTTP, exposing session data in plaintext. Replay attacks, in which an attacker captures and maliciously re-sends a valid transmission, are a related concern; TLS counters them with nonces, sequence numbers, and short-lived session tickets that must remain unique per session. Switch-level defense is also possible: port security is a feature that limits which MAC addresses can communicate on a given port, helping prevent rogue devices from attaching to the network. Together, these controls and awareness of underlying protocols form the backbone of practical network security.

Authentication and access control in modern environments rely on a handful of well-established protocols. In Windows and Active Directory environments, Kerberos is the dominant authentication system. It is ticket-based and centered on a Key Distribution Center (KDC), which itself consists of an Authentication Server and a Ticket Granting Server. The three participants in any Kerberos exchange are the client, the application server, and the KDC. When a user authenticates, the KDC issues time-limited tickets—tokens that prove the client's identity—allowing access to services without re-sending credentials on each request. This ticket-based design avoids sending passwords over the network and supports mutual authentication between client and server.

For network access, two AAA protocols dominate. RADIUS (Remote Authentication Dial-In User Service) provides centralized authentication, authorization, and accounting, especially for VPNs, Wi-Fi, and dial-up. It runs over UDP and combines authentication and authorization while encrypting only the password. TACACS+ is a Cisco-developed AAA protocol that runs over TCP, separates authentication, authorization, and accounting, and encrypts the entire payload rather than just the password. Directory access uses a different tool: LDAP (Lightweight Directory Access Protocol), which queries and modifies directory services such as Active Directory. These protocols—Kerberos, RADIUS or TACACS+, and LDAP—form the practical foundation of identity in many enterprises.

Modern web applications rely on federated identity standards. SAML (Security Assertion Markup Language) is an XML-based standard for federated single sign-on (SSO), exchanging authentication and authorization data between identity providers and service providers. OAuth 2.0 is an authorization framework that allows third-party applications to obtain limited access to user resources without ever handling the user's credentials. OpenID Connect is an identity layer built on top of OAuth 2.0, providing authentication by issuing JSON Web Tokens that verify who the user actually is. Federation is the broader concept of trust established between two organizations' identity providers, allowing users from one to access resources in the other. Together with single sign-on—where one authentication grants access to many independent systems—these standards reduce password fatigue and centralize identity management.

To strengthen authentication beyond passwords, organizations adopt multi-factor authentication (MFA), which combines two or more independent factors. The five canonical factors are something you know (a password), something you have (a hardware token or phone), something you are (a biometric), something you do (behavioral patterns), and somewhere you are (geographic location). One-time passwords are a popular second factor. A TOTP (Time-based One-Time Password) generates a six- to eight-digit code from a shared secret and the current time, as specified in RFC 6238 and used by apps like Google Authenticator. An HMAC-based OTP (HOTP), defined in RFC 4226, generates codes from a counter value and shared secret and is often used in hardware tokens. Because each code is unique and short-lived, OTPs dramatically reduce the value of stolen passwords.

Wireless networks introduce their own set of threats that don't exist on wired infrastructure. An evil twin attack sets up a rogue Wi-Fi access point that mimics a legitimate one in name and signal, luring users to connect so that their credentials can be captured. A deauthentication attack sends forged Wi-Fi deauthentication frames to disconnect clients from a real AP, often as a step toward capturing the WPA handshake for offline cracking. Defending against these requires strong protocol design, which is why Wi-Fi security has evolved through successive generations: WEP used broken RC4 and is now obsolete; WPA was a transitional protocol using TKIP; WPA2 introduced AES-CCMP and was the long-running standard; and WPA3 replaces the PSK four-way handshake with Simultaneous Authentication of Equals (SAE), providing forward secrecy and resistance to offline dictionary attacks. Many public and guest networks also use a captive portal, a web page users must interact with—typically accepting terms or logging in—before gaining network access, which both controls access and shapes user expectations.

Denial of service attacks target availability rather than confidentiality. A DoS attack overwhelms a target with traffic or requests from a single source, while a Distributed Denial of Service (DDoS) attack uses many distributed sources—typically a botnet of compromised machines—to generate traffic. Because DDoS traffic comes from many legitimate-looking endpoints distributed across the Internet, it is much harder to filter than a single-source DoS attack. Mitigation generally involves a combination of upstream scrubbing services, rate limiting, and resilient architecture designed to absorb large volumes of traffic without becoming unreachable.

Wireless and denial-of-service defenses overlap in practice: segmented guest networks backed by captive portals isolate untrusted clients from internal resources, while rate limiting at the access point and on upstream links mitigates both isolated DoS attempts and botnet-driven DDoS traffic. Choosing WPA3 where supported closes the door on common Wi-Fi handshake captures, and maintaining client-side protections such as certificate validation prevents users from being silently redirected to evil twins.

Effective security operations depend on continuous monitoring and rapid response. A SIEM (Security Information and Event Management) system collects, correlates, and analyzes log data from multiple sources across the environment, giving analysts a single place to investigate alerts. SOAR (Security Orchestration, Automation, and Response) platforms sit one layer above SIEMs, automating security operations workflows and incident response actions so that teams can handle higher volumes with consistent processes. Together they reduce the time between detection and containment, which is often the deciding factor in limiting breach impact.

Detection is split between two closely related capabilities. An IDS (Intrusion Detection System) monitors traffic and alerts on suspicious activity, while an IPS (Intrusion Prevention System) blocks traffic in real time. Both face the challenge of false positives, where legitimate traffic is incorrectly flagged as malicious, and false negatives, where malicious traffic goes undetected. False negatives are more dangerous because they represent successful attacks that no one sees. Detection methods themselves fall into two broad categories: signature-based detection matches observed activity against known patterns of attack, such as Snort rules, while anomaly-based detection flags activity that deviates from a learned baseline of normal behavior. Anomaly-based methods can detect novel attacks but typically produce more false positives because they must distinguish unusual-but-legitimate activity from real threats.

To detect attackers who have already gotten past primary defenses, defenders use deception. A honeypot is a decoy system designed to attract attackers, study their behavior, and divert them from real assets. A canary token is a similar idea at a smaller scale: a trap file, URL, or credential that triggers an alert when accessed, providing early warning that an intruder is exploring. Data Loss Prevention (DLP) tools and policies detect and prevent sensitive data—such as credit card numbers or patient records—from leaving the organization through email, cloud storage, or removable media. These layered approaches catch attackers who would otherwise move invisibly through the environment.

Finally, host- and switch-level hardening reduces the opportunities left for attackers. The principle of least functionality dictates that systems should run only the applications, services, and protocols absolutely required for their function, minimizing the attack surface. Port security on switches limits which MAC addresses can communicate on a given port, helping prevent rogue devices. Combined with secure baselines, regular patching, and the monitoring tools above, these operational practices turn architectural principles into day-to-day protection across the network.