CompTIA Security+ Certification Study Guide (Exam SY0-601)

Cover
Title Page
Copyright Page
Dedication
About the Author
Contents at a Glance
Contents
Preface
Acknowledgments
Introduction
1 Networking Basics and Terminology
	Understanding Network Devices and Cabling
		Looking at Network Devices
		Understanding Network Cabling
		Exercise 1-1: Reviewing Networking Components
	Understanding TCP/IP
		Reviewing IP Addressing
		Exercise 1-2: Understanding Valid Addresses
		Understanding TCP/IP Protocols
		Exercise 1-3: Viewing Protocol Information with Wireshark
		Understanding Application Layer Protocols
		Understanding IPv6
		Exercise 1-4: Identifying Protocols in TCP/IP
	Network Security Best Practices
		Device Usage
		Cable and Protocol Usage
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
2 Introduction to Security Terminology
	Goals of Information Security
		Confidentiality
		Integrity
		Availability
		Accountability
		Exercise 2-1: CIA Scenarios
	Understanding Authentication and Authorization
		Identification and Authentication
		Authorization
	Understanding Security Principles and Terminology
		Types of Security
		Least Privilege, Separation of Duties, and Rotation of Duties
		Concept of Need to Know
		Layered Security and Diversity of Defense
		Due Care and Due Diligence
		Vulnerability and Exploit
		Threat Actors
		Threat Vectors
		Threat Intelligence Sources
		Research Sources
	Looking at Security Roles and Responsibilities
		System Owner and Data Owner
		Data Controller and Data Processor
		System Administrator
		User
		Privileged User
		Executive User
		Data Roles and Responsibilities
		Security Officer
		Exercise 2-2: Security Terminology
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
3 Security Policies and Standards
	Introduction to Security Policies
		Structure of a Policy
		Identifying Types of Policies
	General Security Policies
		Policies Affecting Users
		Policies Affecting Personnel Management
		Policies Affecting Administrators
		Exercise 3-1: Reviewing a Security Policy
		Policies Affecting Management
		Other Popular Policies
	Human Resources Policies
		Hiring Policy
		Termination Policy
		Mandatory Vacations
		Security-Related HR Policies
		Exercise 3-2: Creating a Security Policy
	User Education and Awareness
		General Training and Role-Based Training
		User Habits
		New Threats and Security Trends
		Use of Social Networks and P2P Programs
		Training Metrics and Follow-Up
		Exercise 3-3: Designing a Training Program
		Importance of Policies to Organization Security
		Privacy and Sensitive Data Concepts
	Regulations and Standards
		Regulations, Standards, and Legislation
		Frameworks and Security Guides
		Benchmark/Secure Configuration Guides
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
4 Types of Attacks
	Understanding Social Engineering
		Social Engineering Overview
		Popular Social Engineering Attacks
		Physical Attacks
		Adversarial Artificial Intelligence
		Supply-Chain Attacks
		Cloud-Based vs. On-Premises Attacks
		Reasons for Effectiveness
		Preventing Social Engineering Attacks
	Identifying Network Attacks
		Popular Network Attacks
		Exercise 4-1: DNS Poisoning After Exploit Using Kali Linux
		Exercise 4-2: Performing a Port Scan
		Other Network Attacks
		Malicious Code or Script Execution
		Preventing Network Attacks
	Looking at Password Attacks
		Types of Password Attacks
		Cryptographic Attacks and Concepts
		Online vs. Offline Attacks
		Other Password Attack Terms
		Preventing Password Attacks
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
5 Vulnerabilities and Threats
	Security Concerns with Vulnerabilities
		Reasons for Vulnerable Systems
		Understanding the Impact of Vulnerabilities
		Common Security Issues and Device Output
		Exercise 5-1: Removable Media Control
		Cloud-Based vs. On-Premises Vulnerabilities
	Identifying Physical Threats
		Snooping
		Theft and Loss of Assets
		Human Error
		Sabotage
	Looking at Malicious Software
		Privilege Escalation
		Viruses
		Other Malicious Software
		Protecting Against Malicious Software
	Threats Against Hardware
		BIOS Settings
		USB Devices
		Smart Phones and Tablets
		Exercise 5-2: Exploiting a Bluetooth Device
		Removable Storage
		Network Attached Storage
		PBX
		Security Risks with Embedded and Specialized Systems
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
6 Mitigating Security Threats
	Understanding Operating System Hardening
		Uninstall Unnecessary Software
		Disable Unnecessary Services
		Exercise 6-1: Disabling the Remote Desktop Services Service
		Protect Management Interfaces and Applications
		Disable Unnecessary Accounts
		Patch Management
		Password Protection
		Registry Hardening
		Disk Encryption
	System Hardening Procedures
		Network Security Hardening
		Exercise 6-2: Hardening a Network Switch
		Tools for System Hardening
		Exercise 6-3: Creating a Security Template
		Security Posture and Reporting
	Server Hardening Best Practices
		All Servers
		HTTP Servers
		DNS Servers
		Exercise 6-4: Limiting DNS Zone Transfers
		DHCP Servers
		SMTP Servers and FTP Servers
		Common Mitigation Strategies
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
7 Implementing Host-Based Security
	Host and Application Security Solutions
		Endpoint Protection
		Boot Integrity
		Database
	Implementing Host-Based Firewalls and HIDS
		Host-Based Firewalls
		Exercise 7-1: Configuring TCP Wrappers in Linux
		Host-Based IDS and Host-Based IPS
	Protecting Against Malware
		Patch Management
		Using Antivirus and Anti-Spam Software
		Spyware and Adware
		Phish Filters and Pop-Up Blockers
		Exercise 7-2: Manually Testing a Web Site for Phishing
		Practicing Good Habits
	Device Security and Data Security
		Hardware Security
		Mobile Device Security
		Data Security
		Exercise 7-3: Configuring Permissions in Windows 10
		Application Security and BYOD Concerns
		Secure System Design
		Secure Staging Deployment
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
8 Securing the Network Infrastructure
	Understanding Firewalls
		Firewalls
		Using IPTables as a Firewall
		Exercise 8-1: Configuring IPTables in Linux
		Using Firewall Features on a Home Router
		NAT and Ad Hoc Networking
		Proxy Servers
		Routers and ACLs
		Other Security Devices and Technologies
	Using Intrusion Detection Systems
		IDS Overview
		Exercise 8-2: Using Snort: A Network-Based IDS
		Deception and Disruption
		Protocol Analyzers
	Network Design and Administration Principles
		Network Segmentation
		Network Switches
		Network Address Translation
		Network Access Control
		Data Protection
		Data Sovereignty
		Mail Gateway
		Network Communication Encryption
		API Considerations
		Network Administration Principles
		Business Connectivity Considerations
		Placement of Security Devices and Network Appliances
		Configuration Management
	Securing Devices
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
9 Wireless Networking and Security
	Understanding Wireless Networking
		Standards
		Channels
		Antenna Types
		Authentication and Encryption
	Securing a Wireless Network
		Security Best Practices
		Vulnerabilities with Wireless Networks
		Exercise 9-1: Cracking WEP with Kali Linux
		Installation Considerations
	Configuring a Wireless Network
		Configuring the Access Point
		Configuring the Client
	Other Wireless Technologies
		Infrared
		Bluetooth
		Near Field Communication
		RFID
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
10 Authentication
	Identifying Authentication Models
		Authentication Terminology
		Authentication Methods and Technologies
		Multifactor Authentication Factors and Attributes
		Exercise 10-1: Configuring MFA in Outlook Web Mail
		Authentication Management
		Single Sign-On
		Cloud vs. On-Premises Requirements
	Authentication Protocols
		Windows Authentication Protocols
		Common Authentication Protocols
		Authentication Services
	Implementing Authentication
		User Accounts
		Tokens
		Looking at Biometrics
		Certificate-Based Authentication
		Claims-Based Authentication/Federation Services
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
11 Authorization and Access Control
	Introducing Access Control
		Types of Security Controls
		Implicit Deny
		Review of Security Principles/General Concepts
	Access Control Schemes
		Discretionary Access Control
		Mandatory Access Control
		Role-Based Access Control
		Exercise 11-1: Assigning a User the sysadmin Role
		Rule-Based Access Control
		Group-Based Access Control
		Attribute-Based Access Control
		Other Access Control Tools
	Implementing Access Control
		Identities
		Account Types
		Using Security Groups
		Exercise 11-2: Configuring Security Groups and Assigning Permissions
		Rights and Privileges
		Exercise 11-3: Modifying User Rights on a Windows System
		File System Security and Printer Security
		Access Control Lists
		Group Policies
		Exercise 11-4: Configuring Password Policies via Group Policies
		Database Security
		Exercise 11-5: Encrypting Sensitive Information in the Database
		Account Restrictions
		Account Policy Enforcement
		Monitoring Account Access
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
12 Introduction to Cryptography
	Introduction to Cryptography Services
		Understanding Cryptography
		Algorithms and Keys
		Exercise 12-1: Encrypting Data with the Caesar Cipher
		Other Cryptography Terms
	Symmetric Encryption
		Symmetric Encryption Concepts
		Symmetric Encryption Algorithms
		Exercise 12-2: Encrypting Data with the AES Algorithm
	Asymmetric Encryption
		Asymmetric Encryption Concepts
		Asymmetric Encryption Algorithms
		Quantum Cryptography
		In-Band vs. Out-of-Band Key Exchange
	Understanding Hashing
		Hashing Concepts
		Hashing Algorithms
		Exercise 12-3: Generating Hashes to Verify Integrity
	Identifying Encryption Uses
		Common Use Cases
		Understanding Limitations
		Encrypting Data
		Encrypting Communication
		Understanding Steganography
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
13 Managing a Public Key Infrastructure
	Introduction to Public Key Infrastructure
		Understanding PKI Terminology
		Certificate Authority and Registration Authority
		Repository
	Managing a Public Key Infrastructure
		Certificate Life Cycle
		Certificate Revocation Lists and OCSP
		Other PKI Terms
	Implementing a Public Key Infrastructure
		How SSL/TLS Works
		How Digital Signatures Work
		Creating a PKI
		Exercise 13-1: Installing a Certificate Authority
		Exercise 13-2: SSL-Enabling a Web Site
		Managing a PKI
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
14 Physical Security
	Choosing a Business Location
		Facility Concerns
		Lighting and Windows
		Doors, Windows, and Walls
		Safety Concerns
	Physical Access Controls
		Exercise 14-1: Gaining Access to a System with No Physical Security
		Fencing and Personnel
		Hardware Locks/Lock Types
		Access Systems
		Other Physical Security Controls
		Physical Access Lists and Logs
		Video Surveillance
		Types of Sensors
	Implementing Environmental Controls
		Understanding HVAC
		Shielding
		Fire Suppression
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
15 Application Attacks and Security
	Understanding Application Attacks
		Directory Traversal
		Exercise 15-1: Exploiting an IIS Web Server with Directory Traversal
		Injection Attacks
		Exercise 15-2: SQL Injection Attacks
		Buffer Overflow Attacks
		Cross-Site Scripting
		Cross-Site Request Forgery
		Pass the Hash
		Privilege Escalation
		SSL Stripping
		Driver Manipulation and Refactoring
		Other Application Attacks
		Why Application Vulnerabilities Exist
	Secure Application Development Concepts
		Secure Coding Concepts
		Application Environments
		Secure Coding Techniques
		Application Frameworks and Scripting
	Implement Host and Application Security
		Host Security
		Application Security
		Code Quality and Testing
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
16 Virtualization and Cloud Security
	Virtualization and Virtualization Security
		Introducing Virtualization
		Benefits to Virtualization
		Hypervisor
		Security Issues with Virtualization
	Cloud Computing Concepts
		Cloud Computing Overview
		Cloud Computing Considerations
		Resiliency and Automation
		Cloud Features
	Cybersecurity Solutions for the Cloud
		Cloud Security Controls
		Cloud Security Solutions
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
17 Risk Analysis
	Introduction to Risk Analysis
		Risk Analysis Overview
		Risk Analysis Process
		Tools to Help Analyze Risk
		Risk with Cloud Computing and Third Parties
	Risk Assessment Types
		Qualitative
		Exercise 17-1: Performing a Qualitative Risk Analysis
		Quantitative
		Exercise 17-2: Performing a Quantitative Risk Analysis
	Risk Mitigation Strategies
		Exercise 17-3: Identifying Mitigation Techniques
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
18 Disaster Recovery and Business Continuity
	Introduction to Business Continuity and Disaster Recovery
		Introduction to Business Continuity
		Understanding Disaster Recovery
	Backing Up and Restoring Data: Backup Concepts
		Backup Destination Media
		Security Considerations with Tapes
		Types of Backups
		Scheduling Backups
		Exercise 18-1: Backing Up and Restoring Data on a Windows Server
		Geographic Considerations
	Implementing Fault Tolerance
		Introducing Redundancy
		Nonpersistence and Diversity
		Understanding RAID
		Exercise 18-2: Configuring RAID 0 on a Windows System
		Exercise 18-3: Creating a Mirrored Volume on a Windows Server
		Exercise 18-4: Creating a RAID 5 Volume on a Windows Server
	Understanding High Availability
		Failover Clustering
		Network Load Balancing
		Redundant Hardware
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
19 Understanding Monitoring and Auditing
	Introduction to Monitoring
	Monitoring Tools
		Useful System Commands
		SNMP
		Performance Monitor
		Protocol Analyzer and Sniffer
		Exercise 19-1: Monitoring Network Traffic with Wireshark
		Understanding Syslog
		Security Information and Event Management
		Working with SOAR
	Implementing Logging and Auditing
		Understanding Auditing
		Exercise 19-2: Implementing Auditing in Windows
		Understanding Logging
		Exercise 19-3: Configuring Logging in IIS
		Exercise 19-4: Configuring Windows Firewall
		Popular Areas to Audit
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
20 Security Assessments and Audits
	Understanding Types of Assessments
		Assessment Types
		Assessment Techniques
	Performing a Security Assessment
		Threat Hunting
		Vulnerability Scans
		Exercise 20-1: Manually Searching CVE for Windows 10 Vulnerabilities
	Performing a Penetration Test
		Considerations and Techniques Used in a Penetration Test
		Understanding the Hacking Process
		Exercise 20-2: Profiling an Organization
		Exercise 20-3: Using a Port Scanner
		Steps to Perform a Penetration Test
		Performing a Vulnerability Assessment
		Exercise 20-4: Performing a Vulnerability Scan with Nessus
	Tools Used to Assess Security
		Fundamental Tools
		Network Reconnaissance and Discovery
		File Manipulation
		Shell and Script Environments
		Packet Capture and Replay
		Other Common Tools
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
21 Incident Response and Computer Forensics
	Working with Evidence
		Admissibility
		Types of Evidence
		Collecting Evidence
	Collecting Digital Evidence
		Understanding the Process
		Where to Find Evidence
		Tools Used
		Exercise 21-1: Using FTK Imager to Capture an Image of a Suspect’s Drive
		Exercise 21-2: Using FTK Imager to Create an Image of the Contents of Memory
		Exercise 21-3: Using FTK Imager to Locate Deleted Files
		Exercise 21-4: Using Autopsy to Investigate the Local Disk
		Exercise 21-5: Using FTK Imager to View File Headers
		Exercise 21-6: Performing Cell Phone Forensics
		Exercise 21-7: Looking at Exif Metadata
		On-Premises vs. Cloud
	Looking at Incident Response
		Incident Response Team
		Incident Response Plan
		Incident Response Process
		First Responders
		Damage and Loss Control
		Exercises
		Policies and Procedures for Incident Response
		Data Sources to Support an Investigation
		Mitigation Techniques as a Response to an Incident
	Certification Summary
		Two-Minute Drill
	Q&A Self Test
		Self Test Answers
A About the Online Content
	System Requirements
	Your Total Seminars Training Hub Account
		Privacy Notice
	Single User License Terms and Conditions
	TotalTester Online
		Pre-Assessment Test
	Other Book Resources
		Performance-Based Questions
		Video Training from the Author
		Downloadable Content
	Technical Support
Index