CompTIA Tech+ (FC0-U71): Security Concepts and Device Security

The CIA triad is the three goals every security control protects: confidentiality (only authorized people can read the data), integrity (the data is accurate and has not been changed without permission) and availability (authorized people can reach the data and systems when they need them). When something goes wrong, the quickest way to name the goal affected is to ask what happened to the data: was it seen, changed or made unreachable?

One incident can touch more than one goal. An intruder who gets into a team's shared spreadsheet and reads the salary column has broken confidentiality; if they then change the totals, that change is an integrity breach. When a question asks which goal was most directly affected by a specific action, match the action, not the whole story: reading is confidentiality, changing is integrity, blocking access is availability. Note that authentication and non-repudiation are related security concepts but are not part of the triad itself.

Privacy is a person's control over who sees information about them, and on everyday platforms it is set mainly by the platform's own sharing settings plus the user's habits. The browser cannot decide who sees a social media post or a shared file — the service hosting it does.

Social networking sites

Each social networking site has privacy settings that control who sees posts, photos and profile details: public, friends or connections only, or custom lists. Review them after joining and after major app updates. Good habits: limit what is public, avoid posting home address, birthday, travel dates or live location (useful to burglars and identity thieves), and accept requests only from people you know. Browser-side tools and stronger sign-in protect your device or your account, not your audience: only the site's own privacy settings change who can see what you have already posted.

Email

The To and CC (carbon copy) fields show every recipient's address to everyone else on the message. BCC (blind carbon copy) hides each recipient's address from the others, so use BCC when mailing a group of people who do not know each other, such as customers or club members. Standard email is not a private channel: messages can be forwarded, and sensitive details such as ID numbers or passwords should not be sent in plain email.

File sharing

Cloud storage links come with access options. "Anyone with the link" means anyone who obtains the link — even forwarded or leaked — can open the file. For sensitive files, share with specific named people, give view-only access unless editing is needed, and remove access when it is no longer needed. Extra restrictions on an open link reduce some risk, but while the link works for anyone, the files are only as private as the link.

Instant messaging

Instant messages feel informal but can be screenshotted, forwarded, backed up to the cloud or read by anyone holding the unlocked phone. Prefer apps with end-to-end encryption for private conversations, use disappearing messages where sensible, confirm unexpected requests from "friends" through another channel (accounts get hijacked) and do not share personal details with strangers.

Personally identifiable information (PII) is any data that can identify a specific person, alone or combined with other data. Examples include full name, home address, date of birth, email address, phone number, passport or driver's licence number, national ID or Social Security number, bank card numbers, and biometric data such as fingerprints. Aggregated or anonymous data — statistics that describe a group rather than a person — is not PII because it cannot single out one individual. By contrast, an identifier such as a gym membership number is PII, because it links to one member's record. The test is simple: could this, alone or with other data, point to one individual?

Government regulations

Governments regulate how organizations collect, store and share personal data. The exam names the General Data Protection Regulation (GDPR), the European Union law that protects the personal data of people in the EU. GDPR applies to organizations established in the EU and to organizations anywhere in the world that offer goods or services to people in the EU or monitor their behaviour — so a Canadian app with users in Spain must follow GDPR for those users' data. GDPR requires a lawful basis (such as consent) for processing, gives people rights to access and erase their data, and requires breaches to be reported.

Which law applies depends on whose data it is and what kind of data it is, not only on where the company is based.

Cookie consent

Cookies are small files a website stores in the browser. Cookie consent is the practice — required in the EU by privacy law — of asking visitors to accept or reject non-essential cookies before the site sets them, usually through a banner on the first visit. Strictly necessary cookies — those the site needs to work or to provide something the visitor explicitly asked for, such as keeping you signed in, holding what you are in the middle of buying, or security and load balancing — do not need consent and are still set after "Reject all". Analytics, advertising and social media tracking cookies do need consent, so rejecting them blocks them. The consent banner is a privacy control — the site asking permission for optional cookies — not a security warning about the site or the connection.

These four concepts describe the steps of controlling access. Authentication proves who you are; authorization decides what you are allowed to do; accounting records what you did; non-repudiation means you cannot later deny that you did it. Authentication, authorization and accounting together are often called AAA.

Authorization always comes after authentication: the system must know who you are before it can apply your permissions. Accounting can only name a person when authentication is per person: a log records the account that signed in, not the human at the keyboard. If several people share one login, every entry shows the same account and no action can be traced to an individual. Making that shared sign-in stronger — adding multifactor authentication, for example — keeps outsiders out but still leaves the log unable to tell the sharers apart; the fix is to give each person their own account. Non-repudiation goes a step further than accounting by giving proof that will stand up later, typically through digital signatures (only the signer holds the private key used to sign) combined with logs and timestamps. Integrity shows a document was not changed; non-repudiation shows who created or approved it.

Authentication factors are categories of proof, and the number of different categories used — not the number of prompts — decides whether a sign-in is single-factor or multifactor.

• Single-factor authentication uses one category. A password alone is single-factor; so is a password plus a memorized PIN, because both are something you know.
• Multifactor authentication (MFA) requires two or more different categories, such as a password plus a one-time code sent to your phone, or a fingerprint plus a PIN. A stolen password alone is then not enough. Two-step verification with a code sent to your phone is a common form.
• Single sign-on (SSO) lets a user sign in once and then open several connected applications (for example a cloud console, a ticketing system and a company wiki) without signing in again. SSO is about convenience and central control, not about the number of factors — an SSO sign-in can itself be single-factor or multifactor. Tools that only store or fill in your credentials still sign you in to each site separately; SSO uses one trusted sign-in that the other apps accept.

Biometric authentication describes the type of factor (something you are), not how many are used.

Authorization is enforced through permissions — rules attached to files, folders, apps and settings that say which accounts may read, change, run or delete them. (File and folder permission types such as read, write and execute are covered in the Tech+ lesson on operating system files and folders.)

Administrator vs user accounts

A standard user account can run programs and change its own settings but cannot install most software, change system settings or alter other users' files. An administrator account can change anything on the system. Malware runs with the rights of the account that launched it, so browsing and reading email from an administrator account lets a single bad click change the whole system. Best practice:

• Use a standard account for everyday work, and switch to administrator rights only for the task that needs them (operating systems prompt for admin credentials when needed).
• Tie administrator rights to individual people, so the logs still show who made each change — the accounting principle applies to admins too.
• Protections on how an account signs in do not limit what malware can do once it runs under that account; only reducing the account's rights does that.

Least privilege model

The least privilege model gives each user, account and program only the access needed to do its job — nothing more — and removes access when it is no longer needed. It limits the damage from mistakes, malware and misuse. Least privilege is about how much access is given; rules about when access is allowed or who must approve it are separate controls that do not by themselves restrict the amount of access.

Security awareness is the knowledge that lets people recognize and resist attacks that target them rather than the technology. Social engineering is manipulating people into giving away information, access or money, usually by pretending to be someone trusted and creating pressure.

Warning signs are urgency ("your account will be closed today"), authority, a request for credentials or payment, mismatched sender addresses or links, and unexpected attachments. Phishing differs from spam (unwanted bulk advertising), spyware (software that secretly collects data) and ransomware (malware that encrypts files and demands payment), though a phishing message may be how those are delivered.

The defence is to verify through a channel you already trust: call back on the number in the company directory, or type the bank's address yourself rather than using the link. Anything the requester supplies themselves — details that can be looked up, or contact information they choose — is not proof of identity, because an attacker can find or control it.

Malicious or compromised content

Malware also arrives through content: email attachments (especially documents asking you to enable macros), links to fake or hacked websites, pop-ups claiming your computer is infected, malicious ads, fake download buttons, QR codes and unknown USB drives. Even a legitimate website can be compromised and serve malware. Do not open unexpected attachments, plug in found USB drives or follow links in unsolicited messages; report suspicious messages to IT.

Securing a device means layering controls so that each covers a different risk; no single tool replaces the others.

Patching deserves special emphasis: once a vendor publishes a fix, attackers study it and target devices that have not installed it. A fix only protects a device after it is installed, so turn on automatic updates and install pending security updates promptly. Because each layer covers a different gap, adding more of a layer the device already has does not cover a layer it lacks; assess a device by checking each layer in turn.

Physical device security

A privacy screen filter stops people nearby reading the screen, and an automatic screen lock stops someone using an unattended device; neither stops theft or USB access.

Device use best practices

• Lock the screen whenever you step away (Windows key + L on Windows) and set a short automatic lock.
• Never leave devices unattended in public; enable remote locate-and-wipe on phones and laptops.
• Use a standard account day to day, and install software only from legitimate sources.
• Do not plug in unknown USB drives or charge from unknown USB ports.
• Be careful on public Wi-Fi: use a VPN and avoid sensitive tasks if unsure (securing your own wireless network is covered in the Passwords, Encryption and Wireless Security lesson).

A software license is the legal agreement that says how you may use a piece of software — how many devices, for how long and whether you may see or change the code. Using software outside its license is a legal and security risk.

One-time purchase describes how you pay; perpetual describes how long the right lasts. A need to pay once and keep using the software indefinitely points to a perpetual license; a need for always-current features with a predictable monthly cost points to a subscription. Other terms you may meet: a trial license expires after a set period, and volume licensing covers many installations for an organization. Software preinstalled by a PC maker is known as OEM software.

Product keys and serial numbers

A product key (also called a license key or activation code) is the code entered during installation or setup to activate licensed software and prove it was purchased. A serial number uniquely identifies a specific copy of software or a specific physical device, and is used for registration, warranty and support. Some publishers also call the activation code itself a serial number, so for software a serial number can be the proof of a licensed copy. Don't confuse either with a model number (identifies a product line shared by many units), a version number (identifies a software release) or a checksum (verifies a file was not altered). Keep product keys and proof of purchase with your records — you may need them to reinstall.

The safest place to get software is the source that made it or a store that vets it: the original equipment manufacturer (OEM) or developer's own website, or the device's official application store. Third-party download sites, mirrors and links shared by strangers may bundle extra programs or deliver modified, malicious copies.

Drivers and firmware should come from the device maker's (OEM's) support website, chosen by your exact model. On phones and tablets, the official app store is the vetted source and keeps apps updated. Installing a mobile app from outside the store (sideloading) skips that screening and leaves updates to you.

Researching and validating a source

• Reach the developer directly — type the address or follow a link from a page you already trust — because search listings and ads can lead to look-alike domains.
• HTTPS (the padlock) only means the connection is encrypted; it says nothing about who runs the site or whether its files are genuine.
• Popularity signals displayed by the download site itself are controlled by that site and prove nothing.
• Check the publisher name in the app store or installer, and where the developer publishes one, compare the file's checksum.
• During installation, choose custom or advanced setup and untick bundled offers.

Removal of unwanted software

Unwanted software includes programs you no longer use, trial "bloatware" and potentially unwanted programs (PUPs) — extras that arrive bundled with other software. Remove software properly:

• Use the operating system's uninstaller: Settings > Apps (or Control Panel > Programs and Features) on Windows, the app's uninstaller or moving it to the Trash on macOS, and long-press > uninstall on mobile devices.
• Every installed program is its own entry in the uninstaller and must be removed by its own entry.
• Shortcuts that only hide or pause a program — deleting its files by hand, or stopping it from launching — leave it installed, along with its services, settings and extensions.
• After removing suspicious extras, run a full anti-malware scan and check the browser's extensions and home page settings for leftovers.