Ahmed F. Sheikh
Miami, FL, USA
Any source code or other supplementary material referenced by the author in this book is available to readers on GitHub via the books product page, located at www.apress.com/9781484262337 . For more detailed information, please visit http://www.apress.com/source-code .
ISBN 978-1-4842-6233-7 e-ISBN 978-1-4842-6234-4
https://doi.org/10.1007/978-1-4842-6234-4
Ahmed F. Sheikh 2020
This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed.
The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.
The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, expressed or implied, with respect to the material contained herein or for any errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Distributed to the book trade worldwide by Springer Science+Business Media New York, 1 New York Plaza, New York, NY 10004. Phone 1-800-SPRINGER, fax (201) 348-4505, e-mail orders-ny@springer-sbm.com, or visit www.springeronline.com. Apress Media, LLC is a California LLC and the sole member (owner) is Springer Science + Business Media Finance Inc (SSBM Finance Inc). SSBM Finance Inc is a Delaware corporation.
Ahmed F. Sheikh 2020
A. F. Sheikh CompTIA Security+ Certification Study Guide https://doi.org/10.1007/978-1-4842-6234-4_1
1. General Security Concepts and Trends
In this chapter, we will review the goals of an information security program, and you will be introduced to the information security model, a three-dimensional model, which will be the foundation for learning the concepts of confidentiality, integrity, and availability.
By the end of this chapter, you will be able to
Identify the concepts of confidentiality, integrity and availability.
Perform packet-level analysis.
Information Security Model
In 1991, John McCumber created a model framework for establishing and evaluating information security (information assurance) programs, in what is now known as The McCumber Cube . This security model is depicted as a three-dimensional cube-like grid composed of information security properties or desired goals, information states, and safeguards.
Desired Goals : The first dimension of the information security model is made up of the three information security properties. The three desired goals include confidentiality, integrity, and availability. Use the acronym
CIA to help remember these three principles.
Confidentiality prevents the disclosure of information for unauthorized people, resources, and processes.
Integrity ensures that system information or processes have not been modified.
Availability ensures that information is accessible by authorized users when it is needed.
Chris Perrin, IT Security Consultant, provides insight on the importance of being familiar with the industry standard term, CIA.
Information States : Data can be stored on a hard drive and can also be transmitted across a network or the Internet. Data can also be processed through manipulation by software. The second dimension of the information security model consists of processing, storage, and transmission.
Safeguards : Technology is usually what most information technology (IT) professionals think of when contemplating solutions to the information security puzzle. Policies and procedures provide the foundation for an organization. How would you know how to configure your firewall, a technology-based solution, without the proper policies and procedures to guide you? Educating employees through security awareness training program is an absolute must so that the security measures implemented within an organization are effective.
Everything that you learn about information security can be related back to one of the cells of this three-dimensional model.
Operational Model of Computer Security
The operational model of computer security is composed of different technologies. Protection is the sum of prevention (like firewalls or encryption) plus measures that are used for detection (like an intrusion detection system, audit logs, or honeypot) and response (backup incident response or computer forensics).
Protection = Prevention + (Detection + Response)
Prevention: Access controls, firewalls, and encryption
Detection: