CCNA Cyber Ops SECOPS 210-255 Official Cert Guide

Introduction xviiPart I Threat Analysis and Computer ForensicsChapter 1 Threat Analysis 3    \"Do I Know This Already?\" Quiz 3    Foundation Topics 6    What Is the CIA Triad: Confidentiality, Integrity, and Availability? 6        Confidentiality 6        Integrity 7        Availability 7    Threat Modeling 8    Defining and Analyzing the Attack Vector 10    Understanding the Attack Complexity 12    Privileges and User Interaction 12    The Attack Scope 13    Exam Preparation Tasks 14    Review All Key Topics 14    Complete Tables and Lists from Memory 14    Define Key Terms 14    Q&A 15Chapter 2 Forensics 17    \"Do I Know This Already?\" Quiz 17    Foundation Topics 20    Introduction to Cybersecurity Forensics 20    The Role of Attribution in a Cybersecurity Investigation 21    The Use of Digital Evidence 21        Defining Digital Forensic Evidence 22        Understanding Best, Corroborating, and Indirect or Circumstantial Evidence 22        Collecting Evidence from Endpoints and Servers 22        Collecting Evidence from Mobile Devices 24        Collecting Evidence from Network Infrastructure Devices 24        Chain of Custody 26    Fundamentals of Microsoft Windows Forensics 28        Processes, Threads, and Services 28        Memory Management 30    Windows Registry 32        The Windows File System 34        FAT 35        NTFS 36    Fundamentals of Linux Forensics 37        Linux Processes 37        Ext4 40        Journaling 41        Linux MBR and Swap File System 41    Exam Preparation Tasks 43    Review All Key Topics 43    Define Key Terms 44    Q&A 44Part II Network Intrusion AnalysisChapter 3 Fundamentals of Intrusion Analysis 49    \"Do I Know This Already?\" Quiz 49    Foundation Topics 52    Common Artifact Elements and Sources of Security Events 52        False Positives, False Negatives, True Positives, and True Negatives 58    Understanding Regular Expressions 58    Protocols, Protocol Headers, and Intrusion Analysis 61    Using Packet Captures for Intrusion Analysis 61        Mapping Security Event Types to Source Technologies 66    Exam Preparation Tasks 71    Review All Key Topics 71    Complete Tables and Lists from Memory 71    Define Key Terms 71    Q&A 72Chapter 4 NetFlow for Cybersecurity 75    \"Do I Know This Already?\" Quiz 75    Foundation Topics 78    Introduction to NetFlow 78        What Is a Flow in NetFlow? 78        The NetFlow Cache 80    NetFlow Versions 81        Cisco Flexible NetFlow 96        Flexible NetFlow Records 97        Flow Monitors 102        Flow Exporters 102        Flow Samplers 102        Flexible NetFlow Configuration 102        Configure a Flow Record 103        Configuring a Flow Monitor for IPv4 or IPv6 105        Configuring a Flow Exporter for the Flow Monitor 107        Applying a Flow Monitor to an Interface 109    IPFIX 110        IPFIX Architecture 111        IPFIX Mediators 111        IPFIX Templates 111        Option Templates 112        Introduction to the Stream Control Transmission Protocol (SCTP) 112        NetFlow and IPFIX Comparison 113    NetFlow for Cybersecurity and Incident Response 113        NetFlow as an Anomaly Detection Tool 113        Incident Response and Network Security Forensics 114        Using NetFlow for Data Leak Detection and Prevention 119    NetFlow Analysis Tools 125        Commercial NetFlow Analysis Tools 125        Cisco\'s Lancope StealthWatch Solution 126        Plixer\'s Scrutinizer 129        Open Source NetFlow Monitoring and Analysis Software Packages 129    Exam Preparation Tasks 136    Review All Key Topics 136    Define Key Terms 136    Q&A 136Part III Incident ResponseChapter 5 Introduction to Incident Response and the Incident HandlingProcess 141    \"Do I Know This Already?\" Quiz 141    Foundation Topics 144    Introduction to Incident Response 144        What Are Events and Incidents? 144    The Incident Response Plan 145    The Incident Response Process 146        The Preparation Phase 146        The Detection and Analysis Phase 146        Containment, Eradication, and Recovery 147        Post-Incident Activity (Postmortem) 148    Information Sharing and Coordination 148    Incident Response Team Structure 148    The Vocabulary for Event Recording and Incident Sharing (VERIS) 149    Exam Preparation Tasks 153    Review All Key Topics 153    Complete Tables and Lists from Memory 153    Define Key Terms 153    Q&A 153Chapter 6 Incident Response Teams 157    \"Do I Know This Already?\" Quiz 157    Foundation Topics 159    Computer Security Incident Response Teams (CSIRTs) 159    Product Security Incident Response Teams (PSIRTs) 161        Security Vulnerabilities and Their Severity 161        Vulnerability Chaining Role in Fixing Prioritization 164        Fixing Theoretical Vulnerabilities 164        Internally Versus Externally Found Vulnerabilities 165    National CSIRTs and Computer Emergency Response Teams (CERTs) 166    Coordination Centers 166    Incident Response Providers and Managed Security Service Providers (MSSPs) 167    Exam Preparation Tasks 168    Review All Key Topics 168    Define Key Terms 168    Q&A 168Chapter 7 Compliance Frameworks 171    \"Do I Know This Already?\" Quiz 172    Foundation Topics 175    Payment Card Industry Data Security Standard (PCI DSS) 175        PCI DSS Data 175    Health Insurance Portability and Accountability Act (HIPAA) 185        HIPAA Security Rule 186        HIPAA Safeguards 187    Sarbanes-Oxley (SOX) 189        Section 302 190        Section 404 190        Section 409 190    Summary 192    References 192    Exam Preparation Tasks 193    Review All Key Topics 193    Complete Tables and Lists from Memory 193    Define Key Terms 193    Review Questions 194Chapter 8 Network and Host Profiling 197    \"Do I Know This Already?\" Quiz 197    Foundation Topics 200    Network Profiling 200        Throughput 200        Used Ports 206        Session Duration 211        Critical Asset Address Space 212    Host Profiling 215        Listening Ports 216        Logged-in Users/Service Accounts 220        Running Processes 223        Applications 226    Summary 229    References 230    Exam Preparation Tasks 231    Review All Key Topics 231    Define Key Terms 231    Q&A 231Part IV Data and Event AnalysisChapter 9 The Art of Data and Event Analysis 235    \"Do I Know This Already?\" Quiz 235    Foundation Topics 238    Normalizing Data 238        Interpreting Common Data Values into a Universal Format 238    Using the 5-Tuple Correlation to Respond to Security Incidents 239    Retrospective Analysis and Identifying Malicious Files 241        Identifying a Malicious File 241    Mapping Threat Intelligence with DNS and Other Artifacts 242    Deterministic Versus Probabilistic Analysis 242    Exam Preparation Tasks 244    Review All Key Topics 244    Complete Tables and Lists from Memory 244    Define Key Terms 244    Q&A 245Part V Incident HandlingChapter 10 Intrusion Event Categories 247    \"Do I Know This Already?\" Quiz 247    Foundation Topics 250    Diamond Model of Intrusion 250    Cyber Kill Chain Model 254        Reconnaissance 256        Weaponization 259        Delivery 260        Exploitation 261        Installation 263        Command and Control 264        Action and Objectives 265    Summary 269    References 269    Exam Preparation Tasks 271    Review All Key Topics 271    Define Key Terms 271    Q&A 271Part VI Final PreparationChapter 11 Final Preparation 275    Tools for Final Preparation 275        Pearson Cert Practice Test Engine and Questions on the Website 275        Customizing Your Exams 277        Updating Your Exams 277        The Cisco Learning Network 278        Memory Tables and Lists 278        Chapter-Ending Review Tools 279    Suggested Plan for Final Review/Study 279    Summary 279Part VII AppendixAppendix A Answers to the \"Do I Know This Already?\" Quizzes and Q&A 281Glossary 295Elements Available on the Book WebsiteAppendix B Memory Tables and ListsAppendix C Memory Tables and Lists AnswersAppendix D Study Planner9781587147036, TOC, 5/4/2017