CH1: Foundations of Cybersecurity and Security Controls
Introduction
Every security decision an organization makes ties back to a small set of foundational principles. Before students can evaluate firewalls, configure access controls, or respond to incidents, they need a framework for understanding what security is, why it matters, and how organizations systematically manage risk. This chapter builds that framework from the ground up.
The chapter begins by defining cybersecurity in practical terms: what the discipline protects, who it serves, and why organizations invest in security programs. From there, it introduces the CIA triad, the single most referenced model in information security, as the lens through which every security decision can be evaluated. Additional foundational principles, including authentication, authorization, accounting, non-repudiation, defense in depth, Zero Trust, and least privilege, extend that lens into the operational concepts students will encounter throughout the course.
The second half of the chapter shifts from principles to process. Risk management answers the question every organization faces: "We cannot eliminate all risk, so how do we decide what to protect and how?" Students will walk through the complete risk management lifecycle, from identifying assets and threats through documenting risks in a register and selecting treatment strategies. The chapter closes with the security control taxonomy, the classification system that organizes every security measure into categories (what the control is) and types (what the control does). This taxonomy gives students a structured vocabulary for evaluating any control they encounter in later chapters.
By the end of this chapter, students will have the conceptual foundation on which the entire Security+ certification and all subsequent coursework are built.
Learning Objectives
Upon completing this chapter, students will be able to:
- Define confidentiality, integrity, and availability (CIA) and explain how each principle applies to real-world security decisions.
- Describe the risk management lifecycle, including risk identification, assessment, analysis, risk register documentation, and treatment options.
- Differentiate between control categories (technical, managerial, physical, operational) and control types (preventive, detective, corrective, compensating, deterring, mitigating, directive).
- Explain the concepts of defense in depth, least privilege, Zero Trust, AAA, and non-repudiation as foundational security principles.
- Apply the risk management framework to a given scenario by identifying assets, assessing threats, and recommending appropriate control responses.
1.1 What Is Cybersecurity?
Cybersecurity is the practice of protecting systems, networks, and data from digital attacks, unauthorized access, and damage. At its core, cybersecurity ensures that the technology organizations depend on works as intended and that the information stored within it remains protected.
Students entering this field often encounter three overlapping terms that describe slightly different scopes of work:
- Cybersecurity focuses on protecting digital systems and networks from attack. It encompasses defensive operations, threat detection, vulnerability management, and incident response.
- Information security (InfoSec) is broader in scope. It protects information in any form, whether digital, physical, or verbal. A locked filing cabinet is an information security control. A shredding policy for printed documents is an information security control. Cybersecurity is a subset of information security.
- IT security is an operational term that typically refers to the day-to-day protection of IT infrastructure: servers, workstations, network equipment, and cloud resources.
These distinctions matter because the Security+ certification, and the professional roles it prepares students for, span all three areas. A security analyst does not only monitor network traffic; they also evaluate policies, assess physical access, and advise on data handling procedures.
Why Organizations Invest in Security
Organizations invest in cybersecurity for reasons that fall into three categories: financial, legal, and reputational.
Financial consequences of a security breach include direct costs (incident response, forensic investigation, system restoration, ransom payments) and indirect costs (lost revenue during downtime, increased insurance premiums, customer attrition). The IBM Cost of a Data Breach Report, published annually, consistently places the average cost of a data breach in the millions of dollars.
Legal and regulatory consequences arise from frameworks that require organizations to protect certain types of data. Healthcare organizations must comply with the Health Insurance Portability and Accountability Act (HIPAA). Organizations handling payment card data must follow the Payment Card Industry Data Security Standard (PCI DSS). General Data Protection Regulation (GDPR) applies to organizations handling the personal data of European Union residents. Failure to comply with these regulations can result in fines, lawsuits, and mandatory disclosure requirements.
Reputational consequences are harder to quantify but often the most damaging in the long term. Customers, partners, and stakeholders lose trust in organizations that fail to protect sensitive data. For many organizations, especially those in healthcare, finance, and government, trust is the foundation of their business model.
Analyst Perspective
When you start a new role in cybersecurity, one of the first things you will learn is which regulations and frameworks apply to your organization. A security analyst at a hospital thinks about HIPAA daily. An analyst at a bank prioritizes PCI DSS and SOX compliance. Understanding the regulatory landscape is not optional background reading; it directly shapes what you prioritize, how you document findings, and what controls you recommend.
1.2 The CIA Triad
The CIA triad (Confidentiality, Integrity, Availability) is the foundational model for evaluating security decisions. Every security control, policy, and architecture decision can be analyzed through the question: "Does this protect confidentiality, integrity, availability, or some combination of the three?"
Confidentiality
Confidentiality ensures that information is accessible only to those authorized to access it. When confidentiality fails, sensitive data is exposed to unauthorized parties.
Controls that protect confidentiality include encryption (transforming data so that only authorized parties with the correct key can read it), access controls (restricting who can view or modify resources), and data classification (labeling data by sensitivity level so that handling procedures match the risk).
Real-world examples of confidentiality concerns include patient medical records (protected under HIPAA), financial account details (protected under PCI DSS and various banking regulations), intellectual property and trade secrets, and personally identifiable information (PII) such as Social Security numbers, addresses, and dates of birth.
Confidentiality has a direct relationship with privacy. Privacy is the right of individuals to control how their personal information is collected, used, and shared. Confidentiality controls are the technical mechanisms that enforce privacy requirements.
Integrity
Integrity ensures that data has not been altered in an unauthorized or undetected manner. When integrity fails, organizations cannot trust that the information they are acting on is accurate.
Controls that protect integrity include hashing (producing a fixed-length fingerprint of data that changes if even a single bit is modified), digital signatures (combining hashing with cryptography to verify both the content and the sender), checksums (lightweight integrity checks used during data transfer), and version control systems (tracking changes to documents and code).
Consider the importance of integrity in financial transactions. If an attacker can modify the dollar amount in a wire transfer after the sender authorizes it, the transaction cannot be trusted. Software updates depend on integrity verification as well: before installing an update, the operating system checks its digital signature to confirm that the update has not been tampered with in transit.
Warning
Students often confuse confidentiality and integrity. Confidentiality asks: "Can unauthorized people SEE this data?" Integrity asks: "Can unauthorized people CHANGE this data?" A system can have perfect confidentiality (no one unauthorized can read the data) but still fail on integrity if an insider modifies records without detection. Both principles must be addressed independently.
Availability
Availability ensures that systems and data are accessible to authorized users when needed. When availability fails, legitimate users cannot access the resources they depend on, and business operations are disrupted.
Controls that protect availability include redundancy (duplicate systems that take over if a primary system fails), failover mechanisms (automated switching to backup systems), backup and recovery procedures (restoring data after loss or corruption), and DDoS mitigation (defending against distributed denial-of-service attacks designed to overwhelm systems with traffic).
Availability is context-dependent. A hospital's electronic health record system requires near-100% availability because clinicians need patient information during emergencies. An internal knowledge base used for employee onboarding might tolerate several hours of downtime without significant impact. The required level of availability drives the cost and complexity of the controls an organization deploys.
Balancing the Triad
The three principles are interdependent, and maximizing one can create tension with the others. Encrypting every piece of data maximizes confidentiality but can slow system performance and reduce availability. Allowing broad access to ensure availability can compromise confidentiality. Effective security architecture requires balancing all three principles based on the organization's specific risk profile and mission requirements.
| Principle | Core Question | Example Threat | Example Control |
|---|---|---|---|
| Confidentiality | Can unauthorized people see this data? | Data breach exposing customer records | Encryption, access controls, data classification |
| Integrity | Can unauthorized people change this data? | Attacker modifying financial transaction amounts | Hashing, digital signatures, version control |
| Availability | Can authorized people access this when needed? | DDoS attack taking a website offline | Redundancy, failover, backups, load balancing |
1.3 Foundational Security Principles
The CIA triad provides the overarching framework, but several additional principles define how security is implemented in practice. These concepts recur throughout the Security+ exam and all subsequent security coursework.
Authentication, Authorization, and Accounting (AAA)
The AAA framework describes the three-step process for controlling access to systems and resources.
Authentication is the process of proving identity. When a user enters a username and password, they are authenticating. When a system verifies a fingerprint or a smart card, it is performing authentication. The question authentication answers is: "Are you who you claim to be?"
Authorization determines what an authenticated user is permitted to do. After a user proves their identity, the system checks their permissions to determine which resources they can access and what actions they can perform. The question authorization answers is: "What are you allowed to do?"
Accounting (sometimes called auditing) records what authenticated and authorized users actually do. Accounting creates the log entries, transaction records, and audit trails that allow organizations to detect anomalies, investigate incidents, and demonstrate compliance. The question accounting answers is: "What did you do, and when did you do it?"
Students will explore AAA in much greater depth in Chapter 7 (Identity and Access Management), where these concepts are applied to authentication protocols, access control models, and identity governance.
Non-Repudiation
Non-repudiation is the ability to prove that a specific action was performed by a specific entity, in a way that the entity cannot credibly deny. Digital signatures provide non-repudiation because they bind a cryptographic proof to the signer's private key. If a digitally signed contract exists, the signer cannot later claim they did not sign it, because only they possess the private key used to create the signature.
Non-repudiation has direct legal and forensic significance. In digital forensics investigations, non-repudiation helps establish that a specific user account performed a specific action at a specific time. Chapter 6 (Cryptographic Concepts) will cover the technical mechanisms behind digital signatures in detail.
Defense in Depth
Defense in depth is a security strategy that layers multiple controls so that if one control fails, others continue to protect the asset. The concept originates from military strategy: a castle does not rely solely on its outer wall. It has a moat, inner walls, guard towers, and a keep. Each layer must be breached independently.
In cybersecurity, defense in depth operates across multiple layers:
- Physical layer: Fences, locked doors, security cameras, and badge access systems.
- Technical layer: Firewalls, intrusion detection systems, encryption, endpoint protection.
- Administrative layer: Security policies, background checks, security awareness training, acceptable use policies.
No single control is expected to stop every threat. Defense in depth accepts that controls will occasionally fail and builds redundancy into the security architecture so that a single failure does not result in a complete compromise.
Zero Trust
Zero Trust is a security philosophy built on the principle of "never trust, always verify." Traditional network security operated on a perimeter model: devices inside the network were trusted, and devices outside were not. Zero Trust eliminates that assumption. Every access request, whether it originates from inside or outside the network, must be authenticated, authorized, and continuously validated.
Zero Trust principles include continuous verification of user identity and device health, micro-segmentation (dividing the network into small, isolated zones so that compromising one zone does not grant access to others), and least-privilege access (granting only the minimum permissions necessary for each request).
Students will encounter Zero Trust architecture in greater depth in Chapter 8 (Security Architecture and Design). Students pursuing the CompTIA CySA+ certification will explore Zero Trust Network Architecture (ZTNA) and its operational implementation in detail.
Least Privilege
The principle of least privilege states that every user, process, and system should operate with only the minimum level of access necessary to perform its function. An accountant does not need access to the engineering source code repository. A web application does not need administrator-level database permissions.
Least privilege reduces the blast radius of a compromise. If an attacker gains control of a user account that has minimal permissions, the damage they can do is limited. If that same account had administrator privileges, the attacker would have unrestricted access. Implementing least privilege requires ongoing effort: regular access reviews, role-based access control (RBAC) policies, and automated provisioning and de-provisioning of accounts. These topics are explored in Chapter 7 (Identity and Access Management).
1.4 Risk Management Fundamentals
Security exists because risk exists. Organizations cannot eliminate all risk, but they can identify, assess, and manage it through a structured process. The risk management lifecycle provides that structure.
Risk Identification
Risk identification answers the question: "What could go wrong?" This process begins by identifying three things:
- Assets: What does the organization need to protect? Assets include data (customer records, intellectual property, financial data), systems (servers, workstations, cloud infrastructure), people (employees, contractors, customers), and reputation.
- Threats: What could harm those assets? Threats include external attackers, insider threats, natural disasters, hardware failures, and human error.
- Vulnerabilities: What weaknesses exist that a threat could exploit? Vulnerabilities include unpatched software, misconfigured systems, weak passwords, and gaps in physical security.
Risk exists at the intersection of a threat, a vulnerability, and an asset. A threat without a vulnerability to exploit does not create risk. A vulnerability without an asset behind it does not require attention. Effective risk identification maps all three together.
Risk Assessment and Analysis
Once risks are identified, the organization must evaluate each one to determine how much attention and resources it deserves. Risk assessment considers two factors: the likelihood that the risk will materialize and the impact it would have if it does.
Assessment can be qualitative (using categories like High, Medium, Low based on expert judgment) or quantitative (using numerical formulas to calculate expected losses). This chapter focuses on qualitative assessment. The quantitative formulas, including Single Loss Expectancy (SLE), Annualized Rate of Occurrence (ARO), and Annualized Loss Expectancy (ALE), are covered in Chapter 15 (Governance, Risk, and Compliance) where students have the operational context to apply them meaningfully.
Key elements of a risk assessment include impact analysis (what happens if this risk materializes), likelihood estimation (how probable is this event), risk owner identification (who is responsible for managing this risk), and evaluation of existing mitigations (what controls are already in place).
The Risk Register
The risk register is the central document that tracks all identified risks and their current status. It serves as a living record that is reviewed and updated regularly.
A risk register typically includes the risk description, the risk owner, the likelihood and impact ratings, the current risk level (often expressed as likelihood multiplied by impact), the treatment strategy selected, the status of any mitigation actions, and the date of the last review.
The risk register is not a one-time deliverable. It is a communication tool that ensures all stakeholders have visibility into the organization's risk posture. Effective risk registers are reviewed regularly by management and updated as threats, vulnerabilities, and business conditions change.
Analyst Perspective
In many organizations, the risk register is one of the first documents a new security analyst is asked to review. It provides a map of what the organization is worried about, what controls are in place, and where gaps remain. If you want to understand an organization's security posture quickly, start with the risk register.
Risk Treatment Options
After assessing a risk, the organization must decide how to respond. There are four standard treatment options:
Mitigate (reduce): Implement controls to reduce the likelihood or impact of the risk. This is the most common treatment. Installing a firewall to reduce the likelihood of unauthorized network access is risk mitigation. Deploying encryption to reduce the impact of a data breach is risk mitigation.
Transfer: Shift the financial consequences of the risk to a third party. Purchasing cyber insurance is risk transfer. Outsourcing payment processing to a PCI-compliant provider transfers some of the compliance risk associated with handling payment card data.
Accept: Make an informed decision to live with the risk without additional controls. Risk acceptance is appropriate when the cost of mitigation exceeds the potential impact, or when the likelihood is sufficiently low. Risk acceptance must be a documented, conscious decision by an authorized risk owner, not a default caused by neglect.
Avoid: Eliminate the risk by eliminating the activity or technology that creates it. If an organization determines that operating a public-facing web application creates unacceptable risk, it can avoid that risk by decommissioning the application entirely. Avoidance is effective but often impractical because it requires giving up the business benefit the risky activity provides.
| Treatment | Definition | Example |
|---|---|---|
| Mitigate | Reduce likelihood or impact with controls | Deploy MFA to reduce unauthorized access risk |
| Transfer | Shift financial consequences to third party | Purchase cyber insurance policy |
| Accept | Consciously decide to live with the risk | Accept the risk of a low-probability natural disaster |
| Avoid | Eliminate the activity that creates the risk | Discontinue a legacy system with unfixable vulnerabilities |
1.5 Security Control Categories and Types
Security controls are the specific measures organizations implement to manage risk. The control taxonomy classifies controls along two dimensions: category (what the control is) and type (what the control does). Understanding this two-dimensional classification system gives students a structured vocabulary for evaluating any security measure.
Control Categories
Control categories describe the nature of the control.
Technical (Logical) controls are implemented through technology. Firewalls, encryption, access control lists (ACLs), intrusion detection systems, and antivirus software are all technical controls. These controls are enforced by hardware or software and operate without requiring human intervention for each individual decision.
Managerial (Administrative) controls are policies, procedures, and governance mechanisms. Acceptable use policies, security awareness training programs, risk assessments, and background check requirements are managerial controls. These controls establish the rules and expectations that guide human behavior.
Physical controls protect the physical environment and the hardware within it. Fences, locked doors, security cameras, badge readers, fire suppression systems, and environmental controls (HVAC monitoring, flood sensors) are physical controls.
Operational controls are day-to-day procedures carried out by people. Patch management processes, log review routines, incident response procedures, and change management workflows are operational controls. These overlap with managerial controls but are distinguished by their focus on execution rather than policy.
Control Types
Control types describe what the control is designed to accomplish.
Preventive controls stop an incident before it occurs. A firewall rule that blocks traffic from known malicious IP addresses is preventive. A locked door that prevents unauthorized physical access is preventive.
Detective controls identify an incident during or after its occurrence. An intrusion detection system (IDS) that alerts on suspicious network traffic is detective. A security camera that records who entered a server room is detective.
Corrective controls fix issues after an incident occurs. Restoring data from a backup after a ransomware attack is corrective. Patching a vulnerability that was exploited during an incident is corrective.
Compensating controls provide an alternative when a primary control is not feasible. If an organization cannot implement MFA on a legacy system, it might compensate with increased monitoring, shorter password rotation intervals, and network segmentation to isolate the system.
Deterring controls discourage threat actors from attempting an attack. Warning banners on login screens, visible security cameras, and published acceptable use policies are deterrents. They do not prevent or detect attacks directly, but they reduce the likelihood that an attacker will attempt one.
Mitigating controls reduce the impact of an incident after it occurs (distinct from corrective controls, which fix the root cause). Emergency response procedures that limit the spread of damage are mitigating. Network segmentation that contains a breach to a single subnet is mitigating.
Directive controls mandate or guide behavior through policy. Regulations, standards, and organizational policies that require specific actions (e.g., "All employees must complete security awareness training annually") are directive controls.
The Control Matrix
The control taxonomy becomes most powerful when categories and types are cross-referenced in a matrix. A single control can be classified along both dimensions simultaneously. For example, a security camera is a physical control (category) that serves a detective function (type). A firewall rule is a technical control (category) that serves a preventive function (type).
| Preventive | Detective | Corrective | Compensating | Deterring | Directive | |
|---|---|---|---|---|---|---|
| Technical | Firewall rule blocking malicious IPs | IDS alert on anomalous traffic | Antivirus quarantine of malware | Enhanced logging on legacy system | Account lockout after failed attempts | Group Policy enforcing password complexity |
| Managerial | Background check policy | Audit and compliance review | Lessons learned report after incident | Risk acceptance with documented justification | Acceptable use policy | Regulatory compliance requirement |
| Physical | Locked server room door | Security camera | Fire suppression system | Security guard when badge reader fails | "Authorized Personnel Only" signage | Building evacuation procedure |
| Operational | Change management approval process | Daily log review | System restore from backup | Manual verification when automated check fails | Published incident response penalties | Mandatory security training schedule |
Warning
The Security+ exam frequently presents scenario-based questions that require students to identify both the category AND the type of a given control. A common mistake is selecting an answer that identifies only one dimension. When you see a question about controls, ask yourself two questions: "What is this control?" (category) and "What does this control do?" (type).
Putting It Together: The New Analyst's First Risk Assessment
Maya has just started her first week as a junior security analyst at a mid-size healthcare company. Her supervisor asks her to conduct a preliminary risk assessment on the organization's electronic health records (EHR) system.
Maya begins with risk identification. The primary asset is the EHR database, which contains protected health information (PHI) for over 50,000 patients. She identifies several threats: ransomware (a growing concern in healthcare), insider access by employees who do not need full database access, and physical theft of workstations in clinical areas. She identifies vulnerabilities including an outdated VPN appliance that has not been patched in six months and the fact that all clinical staff currently have read/write access to the full EHR database regardless of their role.
Next, Maya performs a risk assessment. She rates the ransomware risk as High likelihood and High impact (healthcare is a top ransomware target, and losing access to patient records during an emergency would be life-threatening). The insider access risk is rated Medium likelihood and High impact (the broad access permissions create opportunity, and unauthorized modification of medical records could affect patient care). The physical theft risk is rated Low likelihood and Medium impact (the clinical areas are within the building, but a stolen workstation with cached credentials could expose data).
Maya documents these findings in the risk register, identifying the IT Director as the risk owner for the VPN vulnerability and the CISO as the risk owner for the access control issue.
For risk treatment, Maya recommends: mitigate the ransomware risk by patching the VPN appliance immediately and implementing network segmentation to isolate the EHR system; mitigate the insider access risk by implementing role-based access control (RBAC) so that staff members only see the records relevant to their role; and accept the physical theft risk for now while recommending cable locks for clinical workstations as a low-cost deterrent.
Her supervisor reviews the assessment and notes that each recommended control can be mapped to the taxonomy: the VPN patch is a technical/corrective control, network segmentation is a technical/preventive control, RBAC is a technical/preventive control, and cable locks are physical/deterring controls. Maya has demonstrated the complete lifecycle: identify the risk, assess it, document it, treat it, and classify the controls.
Putting It Together: Choosing Controls for a Small Business
A small accounting firm with 15 employees recently experienced a phishing attack. An employee clicked a malicious link in an email that appeared to come from a client, which installed malware on their workstation. The malware was detected by the firm's antivirus software, but the incident revealed that several employees could not distinguish phishing emails from legitimate ones, and the firm had no documented incident response procedures.
The firm's owner, working with their IT consultant, maps out a layered response using the control taxonomy:
Preventive controls: Deploy an email security gateway that scans inbound messages for malicious links and attachments (technical/preventive). Implement multi-factor authentication on all business email accounts (technical/preventive). Conduct quarterly security awareness training that includes phishing simulation exercises (managerial/preventive).
Detective controls: Enable enhanced email logging to track which messages are opened, which links are clicked, and which attachments are downloaded (technical/detective). Schedule monthly reviews of email security logs (operational/detective).
Corrective controls: Write a documented incident response plan that covers steps for isolating a compromised workstation, notifying the IT consultant, preserving evidence, and communicating with affected clients (operational/corrective).
This scenario demonstrates defense in depth in a resource-constrained environment. The firm cannot afford a full security operations center, but by layering technical, managerial, and operational controls across preventive, detective, and corrective types, they have significantly reduced their exposure to the next phishing attempt.
Chapter Summary
- Cybersecurity protects systems, networks, and data from digital attacks and unauthorized access. It is a subset of information security, which protects information in any form.
- The CIA triad (Confidentiality, Integrity, Availability) is the foundational framework for evaluating all security decisions. Confidentiality protects data from unauthorized access, integrity protects data from unauthorized modification, and availability ensures systems are accessible when needed.
- Foundational principles extend the CIA triad into operational practice: AAA (Authentication, Authorization, Accounting) controls access, non-repudiation proves actions occurred, defense in depth layers controls, Zero Trust eliminates implicit trust, and least privilege limits access to the minimum necessary.
- The risk management lifecycle provides a structured approach: identify assets, threats, and vulnerabilities; assess likelihood and impact; document findings in a risk register; and treat risks through mitigation, transfer, acceptance, or avoidance.
- The security control taxonomy classifies controls by category (technical, managerial, physical, operational) and type (preventive, detective, corrective, compensating, deterring, mitigating, directive). The control matrix cross-references both dimensions for precise classification.
- These foundational concepts appear throughout the Security+ exam and serve as the vocabulary for every subsequent chapter. Chapter 2 will apply this vocabulary to the threat landscape, examining who attacks organizations, why, and how.