Session type: Tutor-led learning
Topic: Security+ Session 1: security concepts, controls and roles
Previous entry: Session 6: Networking Fundamentals — Part 2.
Session overview
This was the first session of the programme’s CompTIA Security+ preparation, following the earlier networking and governance sessions. It was a concepts session, taught from slides and discussion. It covered the CIA triad (confidentiality, integrity and availability) and non-repudiation; the Cybersecurity Framework published by NIST, the United States National Institute of Standards and Technology, and gap analysis; access control; security controls; and the roles, competencies and teams involved in security work.
The tutor also downloaded the NIST Cybersecurity Framework document and walked the class through it, and the session ended with a set of review questions, which I completed. The exam version has not been confirmed, and this entry makes no claim about specific exam objectives.
Taught and demonstrated
Each heading below records what the tutor covered. The polished beginner definitions, memory aids and worked examples in my notes were developed afterwards, while I wrote the session up. They appear only in boxes labelled Supplementary explanation, together with the accuracy qualifications, and are not the tutor’s words. Full explanations are in the Study Guide lessons linked at the end.
The CIA triad
- The tutor opened by asking: “What is something that you would not want strangers to see?”
- This introduced confidentiality, and then the CIA triad: confidentiality, integrity and availability.
Confidentiality means only authorised people or systems can access information; integrity means information stays accurate, complete and protected from unauthorised modification; availability means authorised users can access systems and data when required. A medical record shows all three: strangers should not read it, a diagnosis or medication should not be changed without authorisation, and authorised medical staff need access when required.
Non-repudiation
- The tutor discussed information-security properties including confidentiality, integrity, availability and non-repudiation.
Non-repudiation provides evidence that an action or communication occurred, so that a party cannot credibly deny having performed it; depending on context, digital signatures, certificates, timestamps and audit records can provide it. Integrity asks “Has the data changed?”, while non-repudiation asks “Who performed the action, and can they credibly deny it?”
Non-repudiation is not part of the CIA triad: it is an additional security property. It provides evidence of who acted and does not itself prevent modification.
Security properties at a water-treatment plant
- The tutor related the security properties to a water-treatment centre.
Confidentiality covers plant diagrams, administrator credentials, chemical-setting information and security procedures; integrity covers sensor readings and control settings, where altered dosing or falsified readings could cause physical harm; availability covers the monitoring and control systems; and for non-repudiation, authenticated actions, audit logs and digital records can show who changed settings or approved actions. In operational technology environments, integrity and availability can be especially important, because a cybersecurity incident may affect physical processes and public safety.
The NIST Cybersecurity Framework
- The tutor showed a cybersecurity-framework diagram containing five functions: Identify, Protect, Detect, Respond and Recover.
- The discussion covered internal threats, external threats, identifying assets and risks, safeguards and protection, detection and monitoring, incident response and recovery.
- The tutor downloaded the NIST Cybersecurity Framework (CSF) document and walked the class through it. Which version of the document was shown, and which parts of it were covered, are not recorded.
The diagram resembles the earlier five-function model. NIST CSF 2.0, the current version, has six Functions, Govern, Identify, Protect, Detect, Respond and Recover, which operate together and continuously, not as a one-time sequence.
Gap analysis
- The tutor covered gap analysis.
- The tutor’s slide showed an example with a score for each area:
| Area | Score on the slide |
|---|---|
| Identify | 10/16 = 62.5% |
| Asset Management | 4/6 = 66.7% |
| Governance | 3/4 = 75% |
| Risk Assessment | 3/6 = 50% |
| Protect | 8/16 = 50% |
| Identity and Access Management | 5/8 = 62.5% |
| Data Security | 3/8 = 37.5% |
- What each point in a score stood for is not recorded.
Gap analysis compares the current state with the target, or desired, state to identify gaps, and then determines the improvements or remediation needed.
The lowest raw percentage is not automatically the highest-priority risk. Priority also depends on business impact, system criticality, likelihood and context.
Identification, authentication, authorisation and accounting
- The tutor presented identification, authentication, authorisation and accounting as the access-control flow, in that order. The session material used the spelling “authorization”.
- The tutor discussed the distinction between identity and authentication.
- An access-control example was covered: a user may authenticate successfully and still have only read permission, with write denied.
Each step answers a question: identification, “Who do you claim to be?”; authentication, “Prove it”; authorisation, “What are you allowed to do?”; accounting, “What did you do?”; and identity is the account, person or entity being claimed, with authentication as proof of that claim. IAM, identity and access management, is the broader discipline covering identities, accounts, roles, permissions, authentication and the access lifecycle.
AAA strictly stands for authentication, authorisation and accounting: identification commonly comes first but is not one of the three As. Authentication is not limited to comparing password hashes; its factors include something you know, something you have and something you are.
What a security control is
- The tutor defined a control, approximately, as something used to mitigate a vulnerability or threat. The exact wording is not recorded.
More precisely, a security control is a safeguard or measure that reduces risk by preventing, detecting, correcting, deterring or otherwise addressing threats and vulnerabilities. It normally reduces likelihood, impact or both, and does not necessarily remove the threat or vulnerability.
Security control categories
- The tutor covered four categories: managerial, operational, technical and physical.
- The tutor explained managerial controls in terms of management and board oversight.
- The tutor used a football club and stadium analogy. Managerial: executives and management set policies and rules. Operational: stewards and staff carry out procedures. Technical: technology performs or enforces functions. Physical: gates, barriers, turnstiles and locked areas.
- The tutor mentioned VAR, football’s video assistant referee, as an analogy for technical controls.
Managerial controls are governance, oversight, policy and risk-management mechanisms, such as policies and risk assessments; operational controls work through people and processes, such as security awareness training and incident-response procedures. Technical controls are implemented or enforced through technology, such as multi-factor authentication (MFA), encryption and firewalls; physical controls protect buildings, equipment and physical access, such as locks, barriers, CCTV (closed-circuit television) cameras and badge-controlled doors.
The managerial category means governance, policies, oversight and related mechanisms, not the managers themselves. VAR is only an analogy and is not a cybersecurity control.
Security control functional types
- The tutor covered six functional types: preventive, detective, corrective, directive, deterrent and compensating.
Preventive is before, detective is during and discovers, and corrective is after and fixes; a directive control “tells you”, a deterrent control “makes you think twice” and a compensating control is a “substitute control”. Examples of each type, including a legacy system that cannot support MFA, are in Security Controls.
Category asks how or where a control is implemented; function asks what it does. A compensating control is not simply extra security: it provides an alternative way of achieving a similar security objective.
Information security roles and responsibilities
- The tutor’s slide listed the CIO (Chief Information Officer) and the CSO (Chief Security Officer) under overall responsibility, and the ISSO (Information Systems Security Officer) under technical.
- Its other headings included Managerial, Non-technical, and Due care / liability. What was said under those headings is not recorded.
Job titles are not identical across organisations. The CISO, Chief Information Security Officer, was introduced in Session 4 and typically leads information security; a CSO may have a broader remit that includes physical and corporate security.
Due diligence and due care
- The tutor explained the difference between due diligence and due care.
Due diligence is investigating, assessing and understanding the risks (“find out what could go wrong”); due care is taking reasonable action to address them (“do something sensible about it”). A ransomware example is worked through in Security Roles and Responsibilities.
Information security competencies
The tutor covered seven competencies:
- Risk assessments and testing
- Access control and user privileges
- Incident response and reporting
- Security training and education programmes
- Specifying, sourcing, installing and configuring secure devices and software
- Auditing logs and events
- Business continuity and disaster recovery
Security business units
- The tutor covered three security business units: the SOC, Security Operations Centre; DevSecOps, Development, Security and Operations; and the CIRT, Computer Incident Response Team.
- During exam-style scenario questions, the ISSO was also discussed, as a role.
The SOC watches, the CIRT (also seen as CERT, Computer Emergency Response Team) responds, and DevSecOps builds securely. The ISSO is an individual role, not a business unit.
Administrative (management) controls
- Later in the session, the tutor used the term “Administrative (Management) Controls”.
Terminology varies between frameworks. “Administrative”, “managerial” and “management” overlap, but they are not always defined identically.
Least privilege
- The review questions included least privilege, which the existing Least Privilege lesson teaches.
Practical activity and evidence
- Demonstrated by the tutor: downloading the NIST Cybersecurity Framework document and walking the class through it.
- Completed by me: the end-of-session review questions. My results are recorded below.
- Discussed but not performed: gap analysis. I saw a scored example; I did not assess an organisation. There was no lab, configuration or testing work in this session.
- Not recorded: the exact wording and answer options of the review questions, which version and which parts of the NIST document were shown, and the wording of the slides.
Review questions and my results
The session ended with review questions based on the material covered, in the styles used for performance-based questions (PBQs): drag-and-classify, matching, ordering, single-answer, multi-select and identifying items on a floor plan.
| No. | Subject | Type | My result |
|---|---|---|---|
| 1 | CIA Triad Classification | Drag-classify | 1/3 |
| 2 | Non-repudiation | Single | Wrong |
| 3 | NIST CSF: High-Level Functions — Order | Order | Correct |
| 4 | Gap Analysis Concept | Single | Correct |
| 5 | AAA/Access Control Flow | Order | Correct |
| 6 | Security Control Categories | Drag-classify | 2/4 |
| 7 | Functional Types → Description (1) | Match | Correct |
| 8 | Functional Types → Description (2) | Match | Correct |
| 9 | Information Security Roles → Responsibility | Match | Correct |
| 10 | Core Security Competencies (Select ALL) | Multi | Correct |
| 11 | Security Business Units → Focus | Match | Correct |
| 12 | Framework Mapping | Single | Correct |
| 13 | Administrative (Management) Controls (Select ALL) | Multi | 2/3 |
| 14 | Least Privilege | Single | Correct |
| 15 | Identify Controls on the Company Floor Plan | Hotspot | Correct |
Eleven of the fifteen were fully correct, three were partly correct and one was wrong. The four that were not fully correct show my weaker areas from this session:
- CIA triad classification
- Non-repudiation
- Security control categories
- Administrative (management) controls
These were the tutor’s review questions for the session. The Study Guide’s revision questions are original practice items written afterwards; they are not copies of these questions and they are not official exam questions.
Key takeaways
- The CIA triad has three parts. Non-repudiation is a separate, additional property about evidence of who did what.
- Every control has a category, meaning how it is implemented, and a functional type, meaning what it does. They are two different questions.
- AAA is authentication, authorisation and accounting. Identification comes first and is not one of the three.
- NIST CSF 2.0 has six Functions. A five-function diagram shows the earlier model.
- A gap-analysis score shows how much of a target is met, not what to fix first.
Reflection
The review activity showed that I need more practice with CIA triad classification, non-repudiation, security control categories, and administrative or management controls. I answered correctly on the NIST CSF functions, gap analysis, the AAA access-control flow, security control functional types, roles and responsibilities, security competencies, business units, framework mapping, least privilege and the floor-plan control question. I will use the Study Guide and revision questions to reinforce the areas where I lost marks.
Related Study Guide lessons
- CIA Triad: the three objectives, the medical-record example and how to classify an impact.
- Non-Repudiation: the fourth property, how it differs from integrity, and the water-treatment example as a diagram.
- The NIST Cybersecurity Framework: the six Functions of CSF 2.0, the earlier five-function model, and where identity and access management fits.
- Gap Analysis: current state, target state, how the scores are calculated and why priority follows risk.
- Identity and Access Management: Identification and AAA: the access-control flow, authentication factors and IAM.
- Security Controls: Categories and Functions: what a control is, the four categories, the six functional types and the terminology note on administrative controls.
- Security Roles and Responsibilities: the CIO, the CISO or CSO and the ISSO, and due diligence and due care.
- Security Teams and Competencies: the seven competency areas, the SOC, the CIRT and DevSecOps.
- Least Privilege: the existing lesson on the principle that appeared in the review questions.
How this entry was put together
- Sources: my notes from the session, which was taught from the tutor’s slides and verbal explanation, and my recorded results for the review questions.
- Wording: the points under Taught and demonstrated say what the tutor covered. They are recorded in my own words, not copied from the slides, and the only words quoted from the tutor are the opening question and the term “Administrative (Management) Controls”.
- Supplementary explanation: everything in the boxes labelled Supplementary explanation is mine and is not attributed to the tutor. The beginner definitions, the question for each access-control step, the memory aids, the medical-record and ransomware examples, the mapping of water-treatment items to each property and the description of IAM were developed afterwards, while I wrote up my notes. So were every accuracy qualification, the operational technology note, and the notes on job titles and on the ISSO as a role.
- Not recorded: the exact wording and answer options of the review questions, the version and parts of the NIST document shown, what each point in the gap-analysis scores stood for, and what was said under the Managerial, Non-technical and Due care / liability headings.
- Diagrams: none in this entry. The linked lessons contain original diagrams; none reproduces the tutor’s slides.
- No practical work: this entry records classroom teaching and a classroom review activity. It is not evidence of a lab, a configuration, a gap analysis or any assessment of a real organisation, and it does not record a qualification.
Next entry: Session 8: Threat Actors, Attack Surfaces and Social Engineering.