Security fundamentals: CIA, AAA and least privilege

Why this matters

Domain 4 is 14% of the exam — the smallest domain — and objective 4.1 is the largest objective in the entire document, with 44 sub-topics. That imbalance tells you something: this material is broad and shallow. You are expected to know what each control is and is for, not to configure it.

The material also reappears constantly elsewhere. WPA3 in domain 2 is encryption. Out-of-band management in domain 3 is access control. Attacks in 4.2 are these controls failing.

The lesson

Logical security, and what it covers

Logical security is everything enforced by software and configuration rather than by locks and walls: encryption, authentication, authorization, access control, certificates. It is the counterpart to physical security, and the two are complementary — neither substitutes for the other, which is a point the exam makes by pairing them in this objective.

The short version of why both are needed: logical controls fail against someone standing at the console, and physical controls fail against someone with a valid password on the other side of the world.

Encryption: data in transit and at rest

Encryption transforms data so it is unreadable without the key. Two states, and the exam distinguishes them.

Data in transit is data moving across a network. It is protected by protocols you have already met: TLS underneath HTTPS, LDAPS, SMTPS and DoT; IPsec for VPNs; SSH for management; WPA3 over the air.

The threat is interception — anyone on the path can read unprotected traffic, which is the whole argument for replacing Telnet with SSH and HTTP with HTTPS.

Data at rest is data stored on disk. It is protected by full-disk encryption (BitLocker, LUKS, FileVault), database or file-level encryption, and encryption on backup media.

The threat is physical loss — a stolen laptop, a disposed drive, a backup tape left in a car. The decommissioning step in the previous lesson exists precisely because data at rest outlives the equipment's usefulness.

A useful third category the exam sometimes mentions is data in use — data in memory while being processed, which is the hardest to protect and the reason technologies like confidential computing exist.

Certificates and PKI

A certificate binds an identity to a public key, and is signed by an authority that vouches for that binding. It is what lets you connect to a server and know it is the right server.

Public key infrastructure (PKI) is the system that makes that trustworthy: the certificate authorities, the registration process, the distribution, and — the part people forget — revocation, through CRLs and OCSP, so a compromised certificate can be withdrawn before it expires.

Trust is a chain. A root CA signs intermediate CAs, which sign end entity certificates. Your device trusts a list of roots, and validates a certificate by walking the chain up to one of them. A "certificate not trusted" error usually means the chain is incomplete — the server is not presenting its intermediate — rather than that the certificate itself is bad.

A self-signed certificate is signed by its own subject, with no external authority involved. It provides the same encryption as any other certificate; what it does not provide is verified identity, because nothing independent vouches for it. That distinction is the examinable point — a self-signed certificate is not "weak encryption", it is unverified identity.

Self-signed is reasonable for internal test systems and lab equipment. It is wrong for anything users reach, because it trains people to click through certificate warnings, and once they do that they will click through the real one.

Certificates also expire, and an expired certificate on a production service is a self-inflicted outage that happens with dull regularity. Track expiry dates in the asset inventory from the previous lesson.

Identity and access management

Identity and access management (IAM) is the discipline covering who exists, what they may do, and how that is proven. Its parts are usually described as AAA:

Authentication — proving you are who you claim. Evidence comes in factors:

• Something you know — password, PIN.
• Something you have — token, phone, smart card.
• Something you are — fingerprint, face, iris.

Some frameworks add somewhere you are (location) and something you do (behaviour).

Multifactor authentication (MFA) requires evidence from two or more different categories. That last phrase is where exam questions live: a password plus a security question is not MFA, because both are things you know. A password plus a code from a phone app is, because the categories differ.

MFA matters more than any other single control here, because it defeats the most common attack by a wide margin: a stolen or guessed password is no longer sufficient on its own. Note that not all second factors are equal — SMS codes are vulnerable to SIM swapping, while app-based codes and hardware keys are considerably stronger.

Authorization and the access control models are covered in the next lesson.

Physical security

Controls in the physical world, protecting the equipment itself.

Cameras provide surveillance and, importantly, detection and deterrence rather than prevention. A camera does not stop anyone entering a room; it records that they did, deters those who would rather not be recorded, and provides evidence afterwards. Exam questions that ask for a preventive control want a lock, a mantrap or a guard — a camera is detective.

The categories are worth having, because CompTIA uses them across its certifications:

• Preventive — locks, fences, access badges, mantraps, bollards.
• Detective — cameras, motion sensors, alarms, log review.
• Deterrent — signage, visible cameras, lighting.

The locked cabinets from the physical installations lesson belong here: physical access to a switch is administrative access to it, because console access usually permits password recovery.

Deception technologies

Deception technologies are decoys deployed to attract and observe attackers.

A honeypot is a system deliberately made to look like a valuable, slightly vulnerable target — an unpatched server, an enticingly named file share. It has no legitimate purpose, which gives it a uniquely valuable property: any interaction with it is suspicious by definition. There are no false positives from ordinary use, because there is no ordinary use.

A honeynet is an entire decoy network of such systems.

What they give you: early warning that someone is inside, intelligence about what an attacker is looking for and what tools they use, and time — an attacker spending an hour on a decoy is not spending it on a real system.

The caution, which the exam sometimes tests: a honeypot must be isolated. A decoy that an attacker can use as a foothold to reach real systems has made things worse rather than better. There are also legal and policy considerations in deliberately inviting intrusion, which is why they are deployed under a documented decision rather than casually.