CoreQ Academy1.2 Summarize fundamental security concepts.
These are the ideas every other security topic is built on: what we protect (CIA), how we prove who did what (AAA and non-repudiation), how we find what is missing (gap analysis), how modern architectures avoid assuming trust (Zero Trust), and how we protect and fool attackers in the physical and digital world.
Core principles
- Confidentiality
- Only authorized people can read the data. Protected by encryption, access control and classification.
- Integrity
- Data is accurate and has not been altered without authorization. Protected by hashing, digital signatures, change control.
- Availability
- Systems and data are usable when needed. Protected by redundancy, backups, DDoS protection, patching for stability.
- Non-repudiation
- A person cannot credibly deny an action they took, because there is proof bound to their identity. Digital signatures provide this: only the private-key holder could have signed.
Authentication, Authorization and Accounting (AAA)
- Authenticating people
- Proving a user is who they claim using factors: something you know, have, are or somewhere you are.
- Authenticating systems
- Proving a device or service identity, often with certificates, device attestation or machine credentials (for example 802.1X with device certificates).
- Authorization models
- Deciding what an authenticated identity may do: role-based, attribute-based, rule-based, mandatory and discretionary models (covered in 4.6).
- Accounting
- Recording what identities did and when: logs, session records, RADIUS accounting. It supports audits and investigations.
Gap analysis
- Gap analysis
- Comparing the current security state against a target (a framework, a policy or a regulation) to list what is missing, then planning work to close each gap.
Zero Trust: control plane
- Zero Trust
- A model that never grants trust based on network location. Every request is authenticated, authorized and evaluated continuously.
- Control Plane
- The decision-making side of Zero Trust: it evaluates policy and decides whether access should be granted.
- Adaptive identity
- Authentication that adjusts to context (location, device health, behaviour, risk score), for example requiring MFA for an unusual login.
- Threat scope reduction
- Shrinking what an attacker could reach: least privilege, micro-segmentation, short sessions.
- Policy-driven access control
- Access decisions come from centrally defined policies rather than ad hoc rules on each system.
- Policy Engine
- The component that evaluates a request against policy and threat intelligence and reaches the grant/deny decision.
- Policy Administrator
- The component that carries out the Policy Engine decision by setting up or tearing down the session, for example issuing a token or session credentials.
Zero Trust: data plane
- Data Plane
- Where traffic actually flows and the decision is enforced.
- Implicit trust zones
- Areas where traffic is trusted once it passes a checkpoint. Zero Trust aims to make these as small as possible.
- Subject/System
- The user, device or workload requesting access to a resource.
- Policy Enforcement Point (PEP)
- The gateway that allows, monitors or terminates the connection between subject and resource, based on the control plane decision.
Physical security
- Bollards
- Short sturdy posts that stop vehicles from reaching doors or windows while still letting people through.
- Access control vestibule
- Two-door entry space where only one door opens at a time, stopping tailgating. Formerly called a mantrap.
- Fencing
- Defines the perimeter and delays or deters intruders.
- Video surveillance
- Cameras (CCTV) that deter and record activity; can include motion detection and object recognition.
- Security guard
- Trained people who can make judgment calls, verify identity and respond, unlike automated controls.
- Access badge
- A card or token (often RFID/NFC) that grants and logs entry; should include photo ID and be revoked promptly.
- Lighting
- Removes hiding places and improves camera quality; a strong deterrent.
- Sensors
- Detect presence or changes in an area.
- Infrared
- Detects heat signatures from bodies moving through a space.
- Pressure
- Detects weight on floors or force against a surface.
- Microwave
- Emits microwave pulses and detects movement by changes in the reflected signal; covers a large area.
- Ultrasonic
- Emits high-frequency sound and detects movement by changes in the echo.
Deception and disruption technology
- Honeypot
- A decoy system that looks valuable to attackers. Any interaction is suspicious, so it gives high-quality alerts and intelligence.
- Honeynet
- A network of honeypots that simulates a realistic environment.
- Honeyfile
- A decoy file with an attractive name (for example passwords.xlsx) that alerts when opened.
- Honeytoken
- Fake data such as a dummy credential or API key placed somewhere it should never be used. If it shows up in a log, you know data was taken.
An attacker steals a database export. A week later, a fake AWS key that was planted in the export is used in an API call. What deception control fired, and what does it tell you?
Show answer
A honeytoken. It confirms the export was exfiltrated and is being used, and the API call gives you the attacker source to investigate.
Check your understanding
Knowledge quiz · pass mark 80%
- Zero Trust grants access to any device already inside the corporate network.
- A file named payroll_2026.xlsx that alerts security when opened is a:
- In Zero Trust, which component makes the allow or deny decision?
- Which concept ensures a sender cannot deny having sent a signed message?
- Which physical control best prevents tailgating into a data center?
- A team compares current controls with the NIST CSF to see what is missing. This is a:
- Which belong to the AAA framework? (choose all)
Original CoreQ Academy material, mapped to objective 1.2 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.