Part III Research and Analysis
by Dwayne Williams, Gregory White, Arthur Conklin
CASP CompTIA Advanced Security Practitioner Certification Study Guide (Exam CAS-001)
- Cover Page
- CASP™ CompTIA® Advanced Security Practitioner Certification Study Guide (Exam CAS-001)
- Copyright Page
- Dedication
- About the Authors
- Contents
- Preface
- Acknowledgments
- Introduction
- Part I Enterprise Security
- 1 Cryptographic Tools
- Determine Appropriate Tools and Techniques
- Advanced PKI Concepts
- Hashing
- Cryptographic Applications
- Digital Signatures
- Code Signing
- Nonrepudiation
- Transport Encryption
- Implications of Cryptographic Methods and Design
- Entropy
- Pseudorandom Number Generation
- Perfect Forward Secrecy
- Confusion
- Diffusion
- ✔ Two-Minute Drill
- Q&A Self Test
- 2 Computing Platforms
- Advantages and Disadvantages of Virtualizing Servers and Minimizing Physical Space Requirements
- VLAN
- Securing Virtual Environments, Appliances, and Equipment
- Vulnerabilities Associated with a Single Physical Server Hosting Multiple Companies’ Virtual Machines
- Vulnerabilities Associated with a Single Platform Hosting Multiple Companies’ Virtual Machines
- Secure Use of On-demand/Elastic Cloud Computing
- Vulnerabilities Associated with Co-mingling of Hosts with Different Security Requirements
- Virtual Desktop Infrastructure (VDI)
- Terminal Services
- ✔ Two-Minute Drill
- Q&A Self Test
- 3 Enterprise Storage
- 4 Infrastructure
- Advanced Network Design
- Complex Network Security Solutions for Data Flow
- Secure Data Flows to Meet Changing Business Needs
- Secure DNS
- Secure Directory Services
- Network Design Consideration
- Multitier Networking Data Design Considerations
- Logical Deployment Diagram and Corresponding Physical Deployment Diagram of All Relevant Devices
- Secure Infrastructure Design
- Storage Integration
- Advanced Configuration of Routers, Switches, and Other Network Devices
- ESB
- SOA
- SIEM
- Database Access Monitor (DAM)
- Service Enabled
- WS-Security
- ✔ Two-Minute Drill
- Q&A Self Test
- 5 Host Security Controls
- 6 Application Security
- Web Application Security Design Considerations
- Specific Application Issues
- Application Sandboxing
- Application Security Frameworks
- Secure Coding Standards
- Exploits Resulting from Improper Error and Exception Handling
- Privilege Escalation
- Improper Storage of Sensitive Data
- Fuzzing/False Injection
- Secure Cookie Storage and Transmission
- Client-Side Processing vs. Server-Side Processing
- Buffer Overflow
- Integer Overflows
- Memory Leaks
- Race Conditions
- Time of Use
- Resource Exhaustion
- ✔ Two-Minute Drill
- Q&A Self Test
- 7 Security Assessments
- 1 Cryptographic Tools
- Part II Risk Management, Policy/Procedure, and Legal
- 8 Analyze Risk Implications
- 9 Risk Management Strategy and Controls
- Classify Information Types into Levels of CIA Based on Organization/Industry
- Determine the Aggregate Score of CIA
- Determine the Minimum Required Security Controls Based on Aggregate Score
- Conduct System-Specific Risk Analysis
- Make Risk Determination
- Decide Which Security Controls Should Be Applied Based on Minimum Requirements
- Implement Controls
- Enterprise Security Architecture (ESA) Frameworks
- Continuous Monitoring
- ✔ Two-Minute Drill
- Q&A Self Test
- 10 E-discovery, Data Breaches, and Incident Response
- 11 Security and Privacy Policies
- Policy Development and Updates in Light of New Business, Technology, and Environment Changes
- Process/Procedure Development and Updates in Light of Policy, Environment, and Business Changes
- Support Legal Compliance and Advocacy by Partnering with HR, Legal, Management, and Other Entities
- Use Common Business Documents to Support Security
- Use General Privacy Principles for PII/Sensitive PII
- Support the Development of Policies
- ✔ Two-Minute Drill
- Q&A Self Test
- Part III Research and Analysis
- 12 Industry Trends
- 13 Enterprise Security
- Benchmark
- Prototype and Test Multiple Solutions
- Cost Benefit Analysis (ROI, TCO)
- Analyze and Interpret Trend Data to Anticipate Cyber Defense Aids
- Review Effectiveness of Existing Security
- Reverse-Engineer/Deconstruct Existing Solutions
- Analyze Security Solutions to Ensure They Meet Business Needs
- Conduct a Lessons-Learned/After-Action Review
- Use Judgment to Solve Difficult Problems That Do Not Have a Best Solution
- Conduct Network Traffic Analysis
- ✔ Two-Minute Drill
- Q&A Self Test
- Lab Question
- Part IV Integration of Computing, Communications and Business Disciplines
- 14 People and Security
- 15 Change Control
- 16 Security Controls for Communication and Collaboration
- 17 Advanced Authentication Tools, Techniques, and Concepts
- 18 Security Activities Across the Technology Life Cycle
- Appendix About the Download
- Glossary
- Index
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.