6 Core 2: Security

Security goals and principles

Security protects people, devices, networks, and data from unauthorized access, misuse, disruption, or loss. Effective controls address the risks without making legitimate work impossible.

Confidentiality, integrity, and availability

The CIA triad describes three goals for protecting information and systems:

• Confidentiality: Only authorized people or systems can view information. Access permissions and encryption help protect it.

• Integrity: Information remains accurate and is changed only in authorized ways. Permissions, checksums, and audit logs can help protect it.

• Availability: Authorized users can access systems and information when needed. Backups, updates, and protection against denial-of-service attacks help maintain it.

Defense in depth combines safeguards so one failed safeguard does not automatically expose a system. For example, a strong password, multifactor authentication, endpoint protection, and a firewall can provide multiple layers.

Least privilege limits each user or process to the permissions needed for its work. Use a standard account for everyday tasks and elevate access only when necessary. Zero Trust means access should be verified and limited according to the user, device, and request; connection to an internal network alone does not make every request trustworthy.

Identity and access management

Authentication proves identity, such as by checking a password or security key. Authorization determines what an authenticated identity is allowed to do, while accounting or auditing records activity so it can be reviewed.

Authentication factors are commonly grouped into three types:

• Something you know: A password or PIN.

• Something you have: A security key or token.

• Something you are: A biometric.

Multifactor authentication (MFA) uses at least two different factor types. A password plus another password is not MFA. A security key or authenticator can add protection if a password is stolen. Phishing-resistant authenticators, such as FIDO security keys, are a strong choice for sensitive or privileged accounts.

Single sign-on (SSO) lets a user authenticate once to access multiple authorized services. It can simplify sign-in, but protecting the identity account is especially important because its compromise may affect several services. Role-based access control (RBAC) assigns permissions according to job roles. Review access when someone changes roles or leaves, and remove permissions that are no longer needed.

Threats and vulnerabilities

A threat is a possible cause of harm. A vulnerability is a weakness that could be exploited, and an exploit is a method of taking advantage of one. Unpatched, unsupported, noncompliant, or unprotected devices can increase risk.

Malware

• Virus: Attaches to a file or program and spreads when that host is run.

• Worm: Spreads between systems, often across a network, without needing to attach to another file.

• Trojan: Appears legitimate but performs unwanted or harmful actions.

• Ransomware: Blocks access to data or systems, commonly by encrypting files, and demands payment.

• Spyware or keylogger: Secretly observes activity or captures keystrokes and information.

• Rootkit: Hides malicious activity and may provide privileged access.

• Cryptominer: Uses a device’s resources to mine cryptocurrency without authorization.

• Adware or a potentially unwanted program (PUP): May display unwanted advertising or install unwanted functions.

Social engineering

Social engineering manipulates people rather than relying solely on a technical flaw. Phishing uses deceptive messages to steal information or prompt unsafe actions. Spear phishing targets a specific person or group, while whaling targets senior executives. Smishing uses text messages, vishing uses voice calls, and QR-code phishing uses deceptive QR codes. Business email compromise (BEC) impersonates or compromises a business account to persuade someone to send money or disclose information. Verify unusual requests through a separate, trusted communication channel.

Other attacks

• Brute-force or dictionary attack: Repeatedly tries passwords, either broadly or by using likely words and combinations.

• Spoofing: Fakes an identity, address, or other identifying information.

• Evil twin: A malicious wireless access point imitates a legitimate network.

• On-path attack: An attacker positions themselves between communicating parties to observe or alter traffic.

• DoS/DDoS: Floods a service with traffic or requests to disrupt availability; DDoS uses multiple sources.

• Zero-day attack: Exploits a vulnerability before a fix is available or widely applied.

• Insider threat: Risk caused intentionally or accidentally by someone with authorized access.

• Tailgating: An unauthorized person follows an authorized person through a controlled entrance.

• Shoulder surfing: Someone observes another person’s screen or keystrokes.

Account and permission security

Use unique accounts rather than shared credentials so actions can be attributed to individuals. Assign access through appropriate user or security groups, and use file permissions to control who can read, modify, or execute resources.

On Windows, NTFS permissions apply to files and folders on an NTFS volume. When a folder is shared over a network, both share and NTFS permissions apply; the more restrictive effective access governs the result.

Good account practices include:

• Use a standard account for routine work and elevate only when necessary. Review administrator access carefully.

• Use MFA where available, especially for administrator and sensitive accounts.

• Use unique passwords and a reputable password manager; do not reuse passwords across services.

• Lock the screen when stepping away, disable or restrict unnecessary guest access, and apply failed-login protections where appropriate.

• Remove or change default credentials. Do not share accounts or authentication codes.

• Review permissions periodically and promptly disable access that is no longer needed.

Password guidance depends on the system’s applicable policy. Current NIST guidance emphasizes adequate length, avoiding routine forced changes unless there is evidence of compromise, and supporting password managers. Follow organizational requirements rather than relying on outdated rules that require frequent changes or arbitrary character combinations.

Endpoint protection and malware response

An endpoint is a device such as a workstation, laptop, or phone that connects to a network. Protect endpoints with layered controls:

1. Keep the operating system, applications, and security definitions updated.

2. Use reputable antivirus or antimalware protection and keep the host firewall enabled.

3. Encrypt data at rest, particularly on portable devices. Windows BitLocker protects supported drives, and BitLocker To Go can protect removable drives. Encryption helps protect data if a device or drive is lost, but it does not replace access control or backups.

4. Limit user permissions, use screen locks, and disable unnecessary services and automatic execution features when appropriate.

5. Use supported devices and approved applications; avoid untrusted downloads and extensions.

6. For managed mobile devices, use organizational configuration profiles or mobile device management (MDM) as directed. Features may include device encryption, updates, remote location, backup, and remote wipe.

A firewall filters network traffic according to rules. Antivirus and antimalware tools detect or block malicious software. They address different risks and should not be treated as substitutes for one another. Endpoint detection and response (EDR) tools help identify and investigate suspicious endpoint activity.

Responding to suspected malware

Follow organizational policy and preserve evidence when required. In basic small office or home office (SOHO) troubleshooting, verify symptoms, isolate or quarantine the infected device to limit spread, and use updated security tools to scan and remediate. If necessary, use a trusted recovery environment or reimage or reinstall the system. Then apply updates, restore only known-good data, verify protection is enabled, and explain prevention steps to the user. Avoid connecting suspected infected systems to shared networks or backups until the risk is assessed.

Network and wireless security

A router forwards traffic between networks, while a firewall allows or blocks traffic according to rules. Many SOHO routers combine these functions. A network access control list (ACL) can permit or deny traffic based on defined criteria. A screened subnet, often called a DMZ, places public-facing services in a network segment separated from the trusted internal network.

For a SOHO router or access point:

• Change the default administrator password and use a strong, unique management credential.

• Install trusted firmware updates and restrict management access to trusted local connections when possible.

• Use WPA3 when supported by the access point and client devices. WPA2 with AES is a strong compatibility option. Avoid obsolete WEP and WPA/TKIP configurations.

• Choose a unique Wi-Fi passphrase and configure a separate guest network when visitors need access. Keep guest devices isolated from trusted devices where the router supports it.

• Disable unused services and ports. Avoid unnecessary port forwarding, and understand which internal device is exposed when a port is forwarded.

• Disable UPnP if it is not needed, since it can allow devices or applications to request automatic port mappings.

• Place networking equipment where unauthorized people cannot easily reset, disconnect, or tamper with it.

Changing the network name (SSID) can make a network easier to identify, but hiding its broadcast is not a substitute for encryption or a strong passphrase. A hidden network can still be discovered.

In business environments, RADIUS commonly supports centralized network authentication, including enterprise wireless access. TACACS+ is used for centralized administrative access control, often for network equipment. These services help manage authentication and authorization but do not replace strong credentials or appropriate network configuration.

Safe browser configuration

Browsers can expose devices to malicious downloads, deceptive websites, and unsafe extensions. Keep the browser and its extensions updated, install software and extensions only from trusted, approved sources, and remove those no longer needed.

Treat certificate warnings seriously. A valid certificate helps authenticate a site and protect an encrypted connection, but it does not prove that the site itself is honest. Do not enter credentials after following an unexpected link unless the destination has been independently verified. If a warning appears, stop and verify the address and connection through a trusted route before proceeding.

Use a password manager and MFA. Use pop-up blocking, and consider ad blocking according to organizational policy. Clear browsing data or cache when troubleshooting or when policy requires it.

Private-browsing mode mainly limits local storage of browsing history and session data. It does not make a user anonymous to websites, employers, internet providers, or network operators. Configure proxy and secure DNS settings only as directed by a trusted organization or service provider; unexpected proxy or DNS changes may redirect or monitor traffic.

Applying security controls to scenarios

When choosing a security response, match the control to the stated risk while avoiding unnecessary weakening of other protections. For example, perform a needed printer-driver installation using an approved elevation method, then leave the user with a standard account rather than permanent administrator access or a shared administrator password.

Recognize that a help-desk request for a one-time code sent by text is smishing. For a modern SOHO wireless network, WPA3 with a strong unique passphrase is preferable among options such as WEP, WPA/TKIP, or an open network with hidden SSID broadcast. To expose a public web server without placing it directly on the trusted internal LAN, use a screened subnet.

For a stolen laptop that was powered off, full-disk encryption most directly protects files stored on its drive. If a browser reports a certificate warning on a banking site, do not ignore it or enter credentials; verify the address and connection through a trusted route. If ransomware is suspected, isolate the desktop from the network and follow the organization’s incident-response procedure rather than connecting it to shared storage or forwarding suspicious files to coworkers.