CONTENTS
Foreword
Preface
Introduction
Instructor Web Site
Chapter 1
Introduction and Security Trends
The Computer Security Problem
Definition of Computer Security
Historical Security Incidents
The Current Threat Environment
Ukraine Electric Grid
Ransomware
Threats to Security
Viruses and Worms
Intruders
Insiders
Criminal Organizations
Nation-States, Terrorists, and Information Warfare
Brand-Name Attacks
Attributes of Actors
Internal/External
Level of Sophistication
Resources/Funding
Intent/Motivation
Security Trends
Targets and Attacks
Specific Target
Opportunistic Target
Minimizing Possible Avenues of Attack
Approaches to Computer Security
Cyberattack Kill Chain
Threat Intelligence
Open Source Intelligence
Ethics
Additional References
Chapter 1 Review
Chapter 2
General Security Concepts
Basic Security Terminology
Security Basics
Security Tenets
Security Approaches
Security Principles
Security Models
Confidentiality Models
Integrity Models
Additional References
Chapter 2 Review
Chapter 3
Operational and Organizational Security
Policies, Procedures, Standards, and Guidelines
Security Policies
Change Management Policy
Data Policies
Password and Account Policies
Human Resources Policies
Due Care and Due Diligence
Due Process
Incident Response Policies and Procedures
Security Awareness and Training
Security Policy Training and Procedures
Role-Based Training
Continuing Education
Compliance with Laws, Best Practices, and Standards
User Habits
Training Metrics and Compliance
Standard Operating Procedure
Interoperability Agreements
Service Level Agreements
Business Partnership Agreement
Memorandum of Understanding
Interconnection Security Agreement
NDA
The Security Perimeter
Chapter 3 Review
Chapter 4
The Role of People in Security
People—A Security Problem
Social Engineering
Tools
Poor Security Practices
People as a Security Tool
Security Awareness
Security Policy Training and Procedures
Chapter 4 Review
Chapter 5
Cryptography
Cryptography in Practice
Fundamental Methods
Comparative Strengths and Performance of Algorithms
Cryptographic Objectives
Diffusion
Confusion
Obfuscation
Perfect Forward Secrecy
Security Through Obscurity
Historical Perspectives
Algorithms
Substitution Ciphers
One-Time Pads
Key Management
Random Numbers
Hashing Functions
Message Digest
SHA
RIPEMD
Hashing Summary
Symmetric Encryption
DES
3DES
AES
CAST
RC
Blowfish
Twofish
IDEA
Cipher Modes
Block vs. Stream
Symmetric Encryption Summary
Asymmetric Encryption
Diffie-Hellman
RSA Algorithm
ElGamal
ECC
Asymmetric Encryption Summary
Symmetric vs. Asymmetric
Quantum Cryptography
For More Information
Chapter 5 Review
Chapter 6
Applied Cryptography
Cryptography Use
Confidentiality
Integrity
Authentication
Nonrepudiation
Digital Signatures
Digital Rights Management
Cryptographic Applications
Use of Proven Technologies
Cipher Suites
Secret Algorithms
Key Exchange
Key Escrow
Session Keys
Ephemeral Keys
Key Stretching
Transport Encryption
Data in Transit
Data at Rest
Data in Use
Implementation vs. Algorithm Selection
Common Use Cases
HMAC
S/MIME
IETF S/MIME History
IETF S/MIME v3 Specifications
PGP
How PGP Works
HTTPS
IPsec
Steganography
Secure Protocols
DNSSEC
SSH
S/MIME
SRTP
LDAPS
FTPS
SFTP
SNMPv3
SSL/TLS
HTTPS
Secure POP/IMAP
Secure Protocol Use Cases
Voice and Video
Time Synchronization
E-mail and Web
File Transfer
Directory Services
Remote Access
Domain Name Resolution
Routing and Switching
Network Address Allocation
Subscription Services
Cryptographic Attacks
Birthday
Known Plaintext/Ciphertext
Meet-in-the-Middle Attacks
Password Attacks
Collision
Downgrade
Replay
Weak Implementations
Other Standards
FIPS
Common Criteria
ISO/IEC 27002 (Formerly ISO 17799)
Chapter 6 Review
Chapter 7
Public Key Infrastructure
The Basics of Public Key Infrastructures
Certificate Authorities
Registration Authorities
Local Registration Authorities
Public Certificate Authorities
In-house Certificate Authorities
Choosing Between a Public CA and an In-house CA
Outsourced Certificate Authorities
Online vs. Offline CA
Stapling
Pinning
Trust Models
Certificate Chaining
Hierarchical Trust Model
Peer-to-Peer Model
Hybrid Trust Model
Walking the Certificate Path
Digital Certificates
Certificate Classes
Certificate Extensions
Certificate Attributes
Certificate Formats
Certificate Lifecycles
Registration and Generation
CSR
Renewal
Suspension
Revocation
Key Destruction
Certificate Repositories
Sharing Key Stores
Trust and Certificate Verification
Centralized and Decentralized Infrastructures
Hardware Security Modules
Private Key Protection
Key Recovery
Key Escrow
Certificate-Based Threats
Stolen Certificates
PKIX and PKCS
PKIX Standards
PKCS
Why You Need to Know the PKIX and PKCS Standards
ISAKMP
CMP
XKMS
CEP
Chapter 7 Review
Chapter 8
Physical Security
The Security Problem
Physical Security Safeguards
Walls and Guards
Physical Access Controls and Monitoring
Electronic Access Control Systems
Policies and Procedures
Environmental Controls
Fire Suppression
Water-Based Fire Suppression Systems
Halon-Based Fire Suppression Systems
Clean-Agent Fire Suppression Systems
Handheld Fire Extinguishers
Fire Detection Devices
Electromagnetic Environment
Power Protection
UPS
Backup Power and Cable Shielding
Chapter 8 Review
Chapter 9
Network Fundamentals
Network Architectures
Network Topology
Wireless
Ad Hoc
Network Protocols
Protocols
Packets
Internet Protocol
IP Packets
TCP vs. UDP
ICMP
IPv4 vs. IPv6
Expanded Address Space
Neighbor Discovery
Benefits of IPv6
Packet Delivery
Ethernet
Local Packet Delivery
ARP Attacks
Remote Packet Delivery
IP Addresses and Subnetting
Network Address Translation
SDN
Security Zones
DMZ
Internet
Intranet
Extranet
Wireless
Guest
Honeynets
Flat Networks
Segregation/Segmentation/Isolation
Physical
Enclaves
Logical (VLAN)
Virtualization
Airgaps
Zones and Conduits
Tunneling/VPN
Site-to-Site
Remote Access
Security Device/Technology Placement
Sensors
Collectors
Correlation Engines
Filters
Proxies
Firewalls
VPN Concentrators
SSL Accelerators
Load Balancers
DDoS Mitigator
Aggregation Switches
TAPs and Port Mirror
Storage Area Networks
iSCSI
Fibre Channel
FCoE
For More Information
Chapter 9 Review
Chapter 10
Infrastructure Security
Devices
Workstations
Servers
Mobile Devices
Device Security, Common Concerns
Network-Attached Storage
Removable Storage
Virtualization
Hypervisor
Application Cells/Containers
VM Sprawl Avoidance
VM Escape Protection
Snapshots
Patch Compatibility
Host Availability/Elasticity
Security Control Testing
Sandboxing
Networking
Network Interface Cards
Hubs
Bridges
Switches
Routers
Firewalls
How Do Firewalls Work?
Next-Generation Firewalls
Web Application Firewalls vs. Network Firewalls
Concentrators
Wireless Devices
Modems
Telephony
VPN Concentrator
Security Devices
Intrusion Detection Systems
Network Access Control
Network Monitoring/Diagnostic
Load Balancers
Proxies
Web Security Gateways
Internet Content Filters
Data Loss Prevention
Unified Threat Management
Media
Coaxial Cable
UTP/STP
Fiber
Unguided Media
Removable Media
Magnetic Media
Optical Media
Electronic Media
Security Concerns for Transmission Media
Physical Security Concerns
Cloud Computing
Cloud Types
Cloud Computing Service Models
VDI/VDE
On-premises vs. Hosted vs. Cloud
Security as a Service
Cloud Access Security Broker
Chapter 10 Review
Chapter 11
Authentication and Remote Access
User, Group, and Role Management
User
Shared and Generic Accounts/Credentials
Guest Accounts
Service Accounts
Privileged Accounts
Group
Role
Domain Passwords
Single Sign-On
Security Controls and Permissions
Access Control Lists
Mandatory Access Control (MAC)
Discretionary Access Control (DAC)
Role-Based Access Control (RBAC)
Rule-Based Access Control
Attribute-Based Access Control (ABAC)
Account Policies
Account Policy Enforcement
Credential Management
Group Policy
Standard Naming Convention
Account Maintenance
Usage Auditing and Review
Time-of-Day Restrictions
Account Expiration
Preventing Data Loss or Theft
The Remote Access Process
Identification
Authentication
Multifactor Authentication
Transitive Trust
Biometric Factors
Authorization
Remote Access Methods
IEEE 802.1X
LDAP
RADIUS
TACACS+
Authentication Protocols
FTP/FTPS/SFTP
VPNs
Vulnerabilities of Remote Access Methods
File System Security
Database Security
Connection Summary
For More Information
Chapter 11 Review
Chapter 12
Wireless Security and Mobile Devices
Introduction to Wireless Networking
Mobile Phones
Wireless Application Protocol
3G Mobile Networks
4G Mobile Networks
SATCOM
Bluetooth
Bluetooth Attacks
Near Field Communication
Other Forms of Connection
ANT
Infrared
USB
IEEE 802.11 Series
802.11: Individual Standards
Attacking 802.11
WEP
Current Security Methods
Authentication Protocols
Wireless Systems Configuration
Access Point
Fat vs. Thin
Controller Based vs. Standalone
SSID
Signal Strength
Band Selection/Width
Antenna Types and Placement
Power Level Controls
Site Surveys
MAC Filtering
Captive Portals
Securing Public Wi-Fi
Wireless Attacks
Replay
IV
Evil Twin
Rogue AP
Jamming
Bluejacking
Bluesnarfing
Bluebugging
RFID
Disassociation
Mobile Device Management Concepts
Application Management
Full Device Encryption (FDE)
Content Management
Remote Wipe
Geofencing
Geolocation
Geo-Tagging
Screen Locks
Push Notification Services
Passwords and Pins
Biometrics
Context-Aware Authentication
Containerization
Storage Segmentation
Asset Control
Device Access Control
Removable Storage
Disabling Unused Features
Mobile Application Security
Application Control
Key and Credential Management
Authentication
Application Whitelisting
Encryption
Transitive Trust/Authentication
Policies for Enforcement and Monitoring
Third-Party App Stores
Rooting/Jailbreaking
Sideloading
Custom Firmware
Carrier Unlocking
Firmware OTA Updates
Camera Use
SMS/MMS
External Media
USB OTG
Recording Microphone
GPS Tagging
Wi-Fi Direct/Ad Hoc
Tethering
Payment Methods
Deployment Models
CYOD
COPE
Corporate Owned
BYOD
VDI
Chapter 12 Review
Chapter 13
Intrusion Detection Systems and Network Security
History of Intrusion Detection Systems
IDS Overview
IDS Models
Signatures
False Positives and False Negatives
Network-Based IDSs
Advantages of an NIDS
Disadvantages of an NIDS
Active vs. Passive NIDSs
NIDS Tools
Host-Based IDSs
Advantages of HIDSs
Disadvantages of HIDSs
Active vs. Passive HIDSs
Resurgence and Advancement of HIDSs
Intrusion Prevention Systems
Network Security Monitoring
Honeypots and Honeynets
Analytics
SIEM
Aggregation
Correlation
Automated Alerting and Triggers
Time Synchronization
Event Deduplication
Logs/WORM
DLP
USB Blocking
Cloud-Based DLP
E-mail
Tools
Protocol Analyzer
Network Placement
In-Band vs. Out-of-Band NIDS/NIPS
Switched Port Analyzer
Port Scanner
Passive vs. Active Tools
Banner Grabbing
Indicators of Compromise
Advanced Malware Tools
For More Information
Chapter 13 Review
Chapter 14
System Hardening and Baselines
Overview of Baselines
Hardware/Firmware Security
FDE/SED
TPM
Hardware Root of Trust
HSM
UEFI/BIOS
Secure Boot and Attestation
Integrity Measurement
Firmware Version Control
EMI/EMP
Supply Chain
Operating System and Network Operating System Hardening
Protection Rings
OS Security
OS Types
Trusted Operating System
Patch Management
Disabling Unnecessary Ports and Services
Secure Configurations
Disable Default Accounts/Passwords
Application Whitelisting/Blacklisting
Sandboxing
Secure Baseline
Machine Hardening
Hardening Microsoft Operating Systems
Hardening UNIX- or Linux-Based Operating Systems
Antimalware
Whitelisting vs. Blacklisting Applications
AppLocker
Host-Based Firewalls
Hardware Security
Network Hardening
Software Updates
Device Configuration
Securing Management Interfaces
VLAN Management
Network Segmentation
IPv4 vs. IPv6
Application Hardening
Application Configuration Baseline
Application Patches
Patch Management
Host Software Baselining
Vulnerability Scanner
Data-Based Security Controls
Data Security
Data Encryption
Handling Big Data
Cloud Storage
Storage Area Network
Permissions/ACL
Environment
Development
Test
Staging
Production
Automation/Scripting
Automated Courses of Action
Continuous Monitoring
Configuration Validation
Templates
Master Image
Nonpersistence
Wrappers
Elasticity
Scalability
Distributive Allocation
Alternative Environments
Alternative Environment Methods
Peripherals
Phones and Mobile Devices
Embedded Systems
Camera Systems
Game Consoles
Mainframes
SCADA/ICS
HVAC
Smart Devices/IoT
Special-Purpose Systems
Industry-Standard Frameworks and Reference Architectures
Regulatory
Non-regulatory
National vs. International
Industry-Specific Frameworks
Benchmarks/Secure Configuration Guides
Platform/Vendor-Specific Guides
General-Purpose guides
For More Information
Chapter 14 Review
Chapter 15
Types of Attacks and Malicious Software
Avenues of Attack
Minimizing Possible Avenues of Attack
Malicious Code
Viruses
Worms
Polymorphic Malware
Trojan Horses
RAT
Rootkits
Logic Bombs
Spyware
Adware
Botnets
Backdoors and Trapdoors
Crypto-Malware
Ransomware
Malware Defenses
Application-Level Attacks
Attacking Computer Systems and Networks
Denial-of-Service Attacks
Social Engineering
Null Sessions
Sniffing
Spoofing
MAC Spoofing
TCP/IP Hijacking
Man-in-the-Middle Attacks
Man-in-the-Browser
Replay Attacks
Transitive Access
Spam
Spim
Phishing
Spear Phishing
Vishing
Pharming
Scanning Attacks
Attacks on Encryption
Address System Attacks
Cache Poisoning
Amplification
Domain Hijacking
Password Guessing
Pass-the-Hash Attacks
Software Exploitation
Client-Side Attacks
Driver Manipulation
Advanced Persistent Threat
Tools
Metasploit
BackTrack/Kali
Social-Engineering Toolkit
Cobalt Strike
Core Impact
Burp Suite
Auditing
Performing Routine Audits
Chapter 15 Review
Chapter 16
E-mail and Instant Messaging
How E-mail Works
E-mail Structure
MIME
Security of E-mail
Spam
Malicious Code
Hoax E-mails
Mail Gateway
Spam Filter
Mail Relaying
Greylisting
Spam URI Real-time Block Lists
Sender Policy Framework (SPF)
Sender ID Framework
DomainKeys Identified Mail
DLP
Mail Encryption
S/MIME
PGP
Instant Messaging
Modern Instant Messaging Systems
Chapter 16 Review
Chapter 17
Web Components
Current Web Components and Concerns
Web Protocols
Encryption (SSL and TLS)
How SSL/TLS Works
The Web (HTTP and HTTPS)
HTTPS Everywhere
HTTP Strict Transport Security
Directory Services (DAP and LDAP)
File Transfer (FTP and SFTP)
Vulnerabilities
Code-Based Vulnerabilities
Buffer Overflows
Java
JavaScript
ActiveX
Securing the Browser
CGI
Server-Side Scripts
Cookies
Browser Plug-Ins
Malicious Add-Ons
Signed Applets
Application-Based Weaknesses
Session Hijacking
Client-Side Attacks
Web 2.0 and Security
Chapter 17 Review
Chapter 18
Secure Software Development
The Software Engineering Process
Process Models
Secure Development Lifecycle
Secure Coding Concepts
Error and Exception Handling
Input and Output Validation
Normalization
Bug Tracking
Application Attacks
Cross-Site Scripting
Injections
Directory Traversal/Command Injection
Buffer Overflow
Integer Overflow
Cross-Site Request Forgery
Zero Day
Attachments
Locally Shared Objects
Client-Side Attacks
Arbitrary/Remote Code Execution
Open Vulnerability and Assessment Language
Application Hardening
Application Configuration Baseline
Application Patch Management
NoSQL Databases vs. SQL Databases
Server-Side vs. Client-Side Validation
Code Signing
Encryption
Obfuscation/Camouflage
Code Reuse/Dead Code
Memory Management
Use of Third-Party Libraries and SDKs
Data Exposure
Code Quality and Testing
Static Code Analyzers
Dynamic Analysis (Fuzzing)
Stress Testing
Sandboxing
Model Verification
Compiled vs. Runtime Code
Secure DevOps
Security Automation
Continuous Integration
Baselining
Immutable Systems
Infrastructure as Code
Version Control and Change Management
Provisioning and Deprovisioning
For More Information
Chapter 18 Review
Chapter 19
Business Continuity, Disaster Recovery, and Organizational Policies
Disaster Recovery
Disaster Recovery Plans/Process
Categories of Business Functions
IT Contingency Planning
Test, Exercise, and Rehearse
Recovery Time Objective and Recovery Point Objective
Backups
What Needs to Be Backed Up
Strategies for Backups
Full
Differential
Delta
Snapshots
Backup Frequency and Retention
Storage of Backups
Geographic Considerations
Business Continuity
Business Continuity Plans
Business Impact Analysis
Identification of Critical Systems and Components
Removing Single Points of Failure
Risk Assessment
Succession Planning
Continuity of Operations
Exercises/Tabletop
After-Action Reports
Failover
Alternative Sites
Order of Restoration
Utilities
Secure Recovery
Cloud Computing
Redundancy
Fault Tolerance
High Availability
Clustering
Load Balancing
Single Point of Failure
Failure and Recovery Timing
Backout Planning
RAID
Spare Parts and Redundancy
Chapter 19 Review
Chapter 20
Risk Management
An Overview of Risk Management
Example of Risk Management at the International Banking Level
Risk Management Vocabulary
What Is Risk Management?
Risk Management Culture
Risk Response Techniques
Security Controls
Business Risks
Examples of Business Risks
Examples of Technology Risks
Business Impact Analysis
Mission-Essential Functions
Identification of Critical Systems
Single Point of Failure
Impact
Risk Mitigation Strategies
Change Management
Incident Management
User Rights and Permissions Reviews
Data Loss or Theft
Risk Management Models
General Risk Management Model
Software Engineering Institute Model
NIST Risk Models
Model Application
Qualitatively Assessing Risk
Quantitatively Assessing Risk
Adding Objectivity to a Qualitative Assessment
Risk Calculation
Qualitative vs. Quantitative Risk Assessment
Testing
Penetration Testing Authorization
Vulnerability Testing Authorization
Vulnerability Scanning Concepts
System Testing
Penetration Testing
Tools
Cost-Effectiveness Modeling
Risk Management Best Practices
System Vulnerabilities
Threat Vectors
Probability/Threat Likelihood
Risks Associated with Cloud Computing and Virtualization
Chapter 20 Review
Chapter 21
Change Management
Why Change Management?
The Key Concept: Separation of Duties
Elements of Change Management
Implementing Change Management
Backout Plan
The Purpose of a Change Control Board
Code Integrity
The Capability Maturity Model Integration
Environment
Development
Test
Staging
Production
Secure Baseline
Sandboxing
Integrity Measurement
Chapter 21 Review
Chapter 22
Incident Response
Foundations of Incident Response
Incident Management
Goals of Incident Response
Anatomy of an Attack
Incident Response Process
Preparation
Incident Response Plan
Incident Identification/Detection
Identification
Initial Response
Containment/Incident Isolation
Strategy Formulation
Investigation
Eradication
Recovery
Reporting
Lessons Learned
Standards and Best Practices
State of Compromise
NIST
Department of Justice
Indicators of Compromise
Security Measure Implementation
Making Security Measurable
For More Information
Chapter 22 Review
Chapter 23
Computer Forensics
Evidence
Types of Evidence
Standards for Evidence
Three Rules Regarding Evidence
Forensic Process
Acquiring Evidence
Identifying Evidence
Protecting Evidence
Transporting Evidence
Storing Evidence
Conducting the Investigation
Analysis
Recovery
Strategic Intelligence/Counterintelligence Gathering
Active Logging
Track Man-Hours
Chain of Custody
Message Digest and Hash
Host Forensics
File Systems
Windows Metadata
Linux Metadata
Device Forensics
Network Forensics
Legal Hold
E-discovery
Reference Model
Big Data
Cloud
Chapter 23 Review
Chapter 24
Legal Issues and Ethics
Cybercrime
Common Internet Crime Schemes
Sources of Laws
Computer Trespass
Convention on Cybercrime
Significant U.S. Laws
Payment Card Industry Data Security Standard (PCI DSS)
Import/Export Encryption Restrictions
Digital Signature Laws
Digital Rights Management
Ethics
Chapter 24 Review
Chapter 25
Privacy
Anonymity and Pseudonymity
Data Sensitivity Labeling and Handling
Confidential
Private
Public
Proprietary
Data Roles
Owner
Steward/Custodian
Privacy Officer
Data Destruction and Media Sanitization
Burning
Shredding
Pulping
Pulverizing
Degaussing
Purging
Wiping
Personally Identifiable Information (PII)
Sensitive PII
Notice, Choice, and Consent
Fair Information Practice Principles (FIPPs)
U.S. Privacy Laws
Privacy Act of 1974
Freedom of Information Act (FOIA)
Family Education Records and Privacy Act (FERPA)
U.S. Computer Fraud and Abuse Act (CFAA)
U.S. Children’s Online Privacy Protection Act (COPPA)
Video Privacy Protection Act (VPPA)
Health Insurance Portability and Accountability Act (HIPAA)
Gramm-Leach-Bliley Act (GLBA)
California Senate Bill (SB)
U.S. Banking Rules and Regulations
Payment Card Industry Data Security Standard (PCI DSS)
Fair Credit Reporting Act (FCRA)
Fair and Accurate Credit Transactions Act (FACTA)
International Privacy Laws
OECD Fair Information Practices
European Laws
Canadian Law
Asian Laws
Privacy-Enhancing Technologies
Privacy Policies
Privacy Impact Assessment
Web Privacy Issues
Cookies
Privacy in Practice
User Actions
Data Breaches
For More Information
Chapter 25 Review
Appendix A
CompTIA Security+ Exam Objectives: SY0-501
Appendix B
Command Line Tools
nmap
ping
netstat
tracert
nslookup/dig
ipconfig/ip/ifconfig
tcpdump
netcat
Appendix C
About the Online Content
System Requirements
About the Total Tester
Installing and Running Total Tester for Desktop
Total Tester Online
Single User License Terms and Conditions
Technical Support
Glossary
Index
