Chapter 2 of 425% of exam
Security
Security is about protecting systems, data, and people from threats. A technician must recognize the common forms of malware and social engineering, apply authentication and access controls correctly, and harden devices against attack. This chapter walks through the threats you will encounter, the defenses that stop them, and the everyday practices that keep both hardware and data safe.
Malware Types
Malware is malicious software with many forms, each behaving differently and requiring different defenses. Understanding how each category works helps a technician recognize symptoms and choose the right remediation. From self-replicating worms to stealthy rootkits, naming the threat is the first step to removing it.
Ransomware extorts victims
Ransomware encrypts a victim's files and demands payment for the decryption key, often with a deadline.
Trojans hide in disguise
A Trojan horse masquerades as legitimate software to get installed, then carries a hidden malicious payload.
Rootkits conceal access
A rootkit hides its presence and maintains privileged control, sometimes loading before the operating system fully starts.
Worms self-replicate
A worm spreads across networks on its own, while adware and spyware focus on showing ads or collecting data.
Social Engineering
Social engineering attacks target people rather than technology, manipulating victims into revealing information or granting access. Because they bypass technical defenses, awareness is the primary countermeasure. A technician should recognize these tactics and educate users to resist them.
Phishing uses fraudulent messages
Phishing impersonates a trusted party in email or text to trick users into revealing credentials or clicking malicious links.
Vishing uses phone calls
Vishing is voice phishing where an attacker poses as IT or another authority to extract sensitive information over the phone.
Tailgating bypasses doors
Tailgating is following an authorized person through a secured entrance without presenting valid credentials.
Shoulder surfing watches entry
Shoulder surfing observes someone typing a password or PIN, defeated by privacy screens and shielding the keyboard.
Authentication and Access Control
Strong authentication verifies who a user is, and access control limits what they can do. Layering factors and granting only necessary permissions dramatically reduces risk. These principles underpin nearly every secure system.
Combine factors with MFA
Multifactor authentication requires two or more independent factors such as a password plus an app code, so a stolen password alone is not enough.
Know the factor categories
Factors are something you know, something you have, and something you are; a fingerprint is a biometric 'something you are'.
Apply least privilege
The principle of least privilege grants each user only the access their role requires, shrinking the impact of a compromised account.
Use role-based access control
RBAC assigns permissions based on job function or group rather than individually, simplifying and standardizing access.
Hardening and Encryption
Hardening reduces a system's attack surface, and encryption protects data even if a device is lost. Together with timely patching and strong wireless security, these controls form a solid defensive baseline. A technician applies them to keep systems resilient.
Encrypt data at rest
Full-disk encryption such as BitLocker renders stored data unreadable without the key, protecting it if hardware is lost or stolen.
Patch to close vulnerabilities
Keeping the OS and applications updated remediates known vulnerabilities before attackers can exploit them.
Choose WPA3 for Wi-Fi
WPA3 is the strongest current wireless standard; avoid outdated WEP and original WPA, and be cautious with WPS.
Filter traffic with a firewall
A firewall permits or blocks network traffic by rule, helping stop unauthorized inbound and outbound connections.
Data Protection and Disposal
Protecting data extends to its entire lifecycle, including secure disposal and the handling of lost devices. Improper disposal can leak sensitive information long after a drive leaves service. A technician must know how to erase and destroy data reliably and how to respond to lost hardware.
Destroy drives to prevent recovery
Physical destruction such as shredding or drilling reliably prevents recovery from a hard drive, unlike a quick format or Recycle Bin deletion.
Enable remote wipe on mobile
Remote wipe lets an administrator or user erase a lost or stolen device's data over the network.
Disable accounts at offboarding
Promptly disabling accounts when employees leave removes lingering access that attackers could exploit.
Verify sites before entering credentials
Checking the exact domain and a valid HTTPS certificate helps users detect lookalike phishing sites.
Test your knowledge
Practice questions on Security