CompTIA Security+ SY0-601 Cert Guide

by Omar Santos, Ron Taylor, Joseph Mlodzianowski

Overview

Learn, prepare, and practice for CompTIA Security+ SY0-601 exam success with this CompTIA Security+ SY0-601 Cert Guide from Pearson IT Certification, a leader in IT certification learning.

CompTIA Security+ SY0-601 Cert Guide presents you with an organized test preparation routine through the use of proven series elements and techniques. “Do I Know This Already?” quizzes open each chapter and enable you to decide how much time you need to spend on each section. Exam topic lists make referencing easy. Chapter-ending Exam Preparation Tasks help you drill on key concepts you must know thoroughly.

CompTIA Security+ SY0-601 Cert Guide focuses specifically on the objectives for the CompTIA Security+ SY0-601 exam. Leading security experts Omar Santos, Ron Taylor, and Joseph Mlodzianowski share preparation hints and test-taking tips, helping you identify areas of weakness and improve both your conceptual knowledge and hands-on skills. Material is presented in a concise manner, focusing on increasing your understanding and retention of exam topics.

This complete study package includes

* A test-preparation routine proven to help you pass the exams
* Do I Know This Already? quizzes, which allow you to decide how much time you need to spend on each section
* Chapter-ending exercises, which help you drill on key concepts you must know thoroughly
* An online interactive Flash Cards application to help you drill on Key Terms by chapter
* A final preparation chapter, which guides you through tools and resources to help you craft your review and test-taking strategies
* Study plan suggestions and templates to help you organize and optimize your study time

Well regarded for its level of detail, assessment features, and challenging review questions and exercises, this official study guide helps you master the concepts and techniques that ensure your exam success.

This study guide helps you master all the topics on the CompTIA Security+ SY0-601 exam, including

* Cyber attacks, threats, and vulnerabilities
* Social engineering, wireless attacks, denial of service attacks
* Threat hunting and incident response
* Indicators of compromise and threat intelligence
* Cloud security concepts and cryptography
* Security assessments and penetration testing concepts
* Governance, risk management, and cyber resilience
* Authentication, Authorization, and Accounting (AAA)
* IoT and Industrial Control Systems (ICS) security
* Physical and administrative security controls

Product Details

ISBN-13:	9780136770312
Publisher:	Pearson Education
Publication date:	10/19/2021
Series:	Certification Guide
Edition description:	5th ed.
Pages:	1216
Product dimensions:	7.40(w) x 9.20(h) x 1.70(d)

About the Author

Omar Santos is an active member of the cybersecurity community, where he leads several industry-wide initiatives. He is a best-selling author and trainer. Omar is the author of more than 20 books and video courses, as well as numerous white papers, articles, and security configuration guidelines and best practices. Omar is a principal engineer of the Cisco Product Security Incident Response Team (PSIRT), Security Research and Operations, where he mentors and leads engineers and incident managers during the investigation and resolution of cybersecurity vulnerabilities.

Omar co-leads the DEF CON Red Team Village, is the chair of the Common Security Advisory Framework (CSAF) technical committee, is the co-chair of the Forum of Incident Response and Security Teams (FIRST) Open Source Security working group, and has been the chair of several initiatives in the Industry Consortium for Advancement of Security on the Internet (ICASI). His active role helps businesses, academic institutions, state and local law enforcement agencies, and other participants dedicated to increasing the security of their critical infrastructures. You can find additional information about Omar's current projects at h4cker.org and can follow Omar on Twitter @santosomar.

Ron Taylor has been in the information security field for more than 20 years working in various areas focusing on both offense and defense security roles. Ten of those years were spent in consulting. In 2008, he joined the Cisco Global Certification Team as an SME in information assurance. From there, he moved into a position with the Security Research and Operations group, where his focus was mostly on penetration testing of Cisco products and services. He was also involved in developing and presenting security training to internal development and test teams globally, and provided consulting support to many product teams as an SME on product security testing. His next role was incident manager for the Cisco Product Security Incident Response Team (PSIRT). Currently, Ron is a security architect specializing in the Cisco security product line. He has held a number of industry certifications, including GPEN, GWEB, GCIA, GCIH, GWAPT, RHCE, CCSP, CCNA, CISSP, PenTest+, and MCSE. Ron has also authored books and video courses, teaches, and is involved in organizing a number of cybersecurity conferences, including the BSides Raleigh, Texas Cyber Summit, Grayhat, and the Red Team Village at DEFCON.

Twitter: @Gu5G0rman

Linkedin: www.linkedin.com/in/-RonTaylor

Joseph Mlodzianowski is an information security aficionado and adventurer; he started multiple villages at RSA Conference, DEFCON, and BLACK HAT, among others, including founding the Red Team Village with the help of great friends. He has been in the information technology security field for more than 25 years working in infrastructure, security, networks, systems, design, offense, and defense. Joseph is currently an enterprise security architect of Cisco Managed Services. He spent more than 10 years in the Department of Defense as an operator, principal security network engineer, and SME designing and deploying complex technologies and supporting missions around the world in multiple theaters. He has consulted, investigated, and provided support for multiple federal agencies over the past 15 years. Joseph continues to contribute to content, reviews, and editing in the certification testing and curriculum process. He spent almost 15 years in the energy sector supporting refineries, pipelines, and chemical plants; specializing in industrial control networks; and building data centers. Joseph holds a broad range of certifications, including the Cisco CCIE, CNE, CSNA, CNSS-4012, CISSP, ITILv4, NSA IAM, NSA IEM, OIAC1180, FEMA IS-00317, ACMA, First Responder, Hazmat Certified, Member of Bexar County Sheriff's Office CERT, MCSE, and Certified Hacking Investigator. He also is a founding contributor to the CyManII | Cybersecurity Manufacturing Innovation Institute, a member of Messaging Malware Mobile Anti-Abuse Working Group (M3aawg.org), and founder of the Texas Cyber Summit and Grayhat Conferences. He believes in giving back to the community and supporting nonprofits.

Twitter: @Cedoxx
Linkedin: www.linkedin.com/in/mlodzianowski/

Table of Contents

Introduction xliv
Part I: Threats, Attacks, and Vulnerabilities
Chapter 1 Comparing and Contrasting Different Types of Social Engineering Techniques 3
“Do I Know This Already?” Quiz 3
Foundation Topics 7
Social Engineering Fundamentals 7
Phishing and Spear Phishing 9
Smishing 12
Vishing 12
Spam and Spam over Internet Messaging (SPIM) 13
Dumpster Diving 13
Shoulder Surfing 14
Pharming 14
Piggybacking or Tailgating 15
Eliciting Information 15
Whaling 16
Prepending 17
Identity Fraud 17
Invoice Scams 17
Credential Harvesting 18
Reconnaissance 18
Hoaxes 19
Impersonation or Pretexting 19
Eavesdropping 19
Baiting 20
Watering Hole Attack 20
Typo Squatting 20
Influence Campaigns, Principles of Social Engineering, and Reasons for Effectiveness 21
User Security Awareness Education 22
Chapter Review Activities 24
Chapter 2 Analyzing Potential Indicators to Determine the Type of Attack 29
“Do I Know This Already?” Quiz 29
Foundation Topics 33
Malicious Software (Malware) 33
Ransomware and Cryptomalware 33
Trojans 35
Remote Access Trojans (RATs) and Rootkits 35
Worms 36
Fileless Virus 37
Command and Control, Bots, and Botnets 37
Logic Bombs 39
Potentially Unwanted Programs (PUPs) and Spyware 40
Keyloggers 42
Backdoors 43
Malware Delivery Mechanisms 43
You Can't Save Every Computer from Malware! 45
Password Attacks 45
Dictionary-based and Brute-force Attacks 45
Password Spraying 46
Offline and Online Password Cracking 46
Rainbow Tables 47
Plaintext/Unencrypted 47
Physical Attacks 48
Malicious Flash Drives 48
Malicious Universal Serial Bus (USB) Cables 48
Card Cloning Attacks 48
Skimming 49
Adversarial Artificial Intelligence 50
Tainted Training Data for Machine Learning 50
Security of Machine Learning Algorithms 50
Supply-Chain Attacks 51
Cloud-based vs. On-premises Attacks 52
Cloud Security Threats 52
Cloud Computing Attacks 54
Cryptographic Attacks 55
Collision 55
Birthday 56
Downgrade 56
Chapter Review Activities 57
Chapter 3 Analyzing Potential Indicators Associated with Application Attacks 61
“Do I Know This Already?” Quiz 61
Foundation Topics 67
Privilege Escalation 67
Cross-Site Scripting (XSS) Attacks 68
Injection Attacks 70
Structured Query Language (SQL) Injection Attacks 70
SQL Injection Categories 73
Dynamic Link Library (DLL) Injection Attacks 74
Lightweight Directory Access Protocol (LDAP) Injection Attacks 74
Extensible Markup Language (XML) Injection Attacks 74
Pointer/Object Dereference 75
Directory Traversal 76
Buffer Overflows 77
Arbitrary Code Execution/Remote Code Execution 78
Race Conditions 79
Error Handling 79
Improper Input Handling 80
Compile-Time Errors vs. Runtime Errors 81
Replay Attacks 82
Request Forgeries 85
Application Programming Interface (API) Attacks 86
Resource Exhaustion 87
Memory Leaks 88
Secure Socket Layer (SSL) Stripping 88
Driver Manipulation 89
Pass the Hash 89
Chapter Review Activities 90
Chapter 4 Analyzing Potential Indicators Associated with Network Attacks 95
“Do I Know This Already?” Quiz 95
Foundation Topics 98
Wireless Attacks 98
Evil Twin Attacks 98
Rogue Access Points 99
Bluesnarfing Attacks 99
Bluejacking Attacks 100
Disassociation and Deauthentication Attacks 101
Jamming Attacks 102
Radio Frequency Identifier (RFID) Attacks 102
Near-Field Communication (NFC) Attacks 102
Initialization Vector (IV) Attacks 103
On-Path Attacks 103
Layer 2 Attacks 105
Address Resolution Protocol (ARP) Poisoning Attacks 105
Media Access Control (MAC) Flooding Attacks 106
MAC Cloning Attacks 106
Best Practices to Protect Against Layer 2 Attacks 106
Domain Name System (DNS) Attacks 107
Domain Hijacking Attacks 108
DNS Poisoning Attacks 108
Uniform Resource Locator (URL) Redirection Attacks 110
Domain Reputation 110
Distributed Denial-of-Service (DDoS) Attacks 111
Malicious Code or Script Execution Attacks 113
Chapter Review Activities 114
Chapter 5 Understanding Different Threat Actors, Vectors, and Intelligence Sources 117
“Do I Know This Already?” Quiz 117
Foundation Topics 120
Actors and Threats 120
Attributes of Threat Actors 122
Attack Vectors 122
Threat Intelligence and Threat Intelligence Sources 123
Structured Threat Information eXpression (STIX) and the Trusted Automated eXchange of Indicator Information (TAXII) 125
Research Sources 127
The MITRE ATT&CK Framework 128
Chapter Review Activities 129
Chapter 6 Understanding the Security Concerns Associated with Various Types of Vulnerabilities 133
“Do I Know This Already?” Quiz 133
Foundation Topics 137
Cloud-based vs. On-premises Vulnerabilities 137
Other “Cloud”-based Concerns 143
Server Defense 144
Zero-day Vulnerabilities 149
Weak Configurations 150
Third-party Risks 155
Improper or Weak Patch Management 160
Patches and Hotfixes 161
Patch Management 163
Legacy Platforms 165
The Impact of Cybersecurity Attacks and Breaches 165
Chapter Review Activities 166
Chapter 7 Summarizing the Techniques Used in Security Assessments 171
“Do I Know This Already?” Quiz 171
Foundation Topics 175
Threat Hunting 175
Security Advisories and Bulletins 177
Vulnerability Scans 180
Credentialed vs. Noncredentialed 182
Intrusive vs. Nonintrusive 182
Common Vulnerability Scoring System (CVSS) 182
Logs and Security Information and Event Management (SIEM) 186
Security Orchestration, Automation, and Response (SOAR) 188
Chapter Review Activities 189
Chapter 8 Understanding the Techniques Used in Penetration Testing 193
“Do I Know This Already?” Quiz 193
Foundation Topics 197
Penetration Testing 197
Bug Bounties vs. Penetration Testing 202
Passive and Active Reconnaissance 203
Exercise Types 205
Chapter Review Activities 206
Part II: Architecture and Design
Chapter 9 Understanding the Importance of Security Concepts in an Enterprise Environment 209
“Do I Know This Already?” Quiz 209
Foundation Topics 213
Configuration Management 213
Data Sovereignty and Data Protection 214
Secure Sockets Layer (SSL)/Transport Layer Security (TLS) Inspection 215
API Considerations 216
Data Masking and Obfuscation 216
Encryption at Rest, in Transit/Motion, and in Processing 218
Hashing 218
Rights Management 219
Geographical Considerations 220
Data Breach Response and Recovery Controls 220
Site Resiliency 221
Deception and Disruption 222
Fake Telemetry 223
DNS Sinkhole 223
Chapter Review Activities 224
Chapter 10 Summarizing Virtualization and Cloud Computing Concepts 227
“Do I Know This Already?” Quiz 227
Foundation Topics 231
Cloud Models 231
Public, Private, Hybrid, and Community Clouds 232
Cloud Service Providers 233
Cloud Architecture Components 234
Fog and Edge Computing 234
Thin Clients 235
Containers 236
Microservices and APIs 240
Infrastructure as Code 241
Serverless Architecture 243
Services Integration 246
Resource Policies 246
Transit Gateway 246
Virtual Machine (VM) Sprawl Avoidance and VM Escape Protection 247
Understanding and Avoiding VM Sprawl 247
Protecting Against VM Escape Attacks 248
Chapter Review Activities 250
Chapter 11 Summarizing Secure Application Development, Deployment, and Automation Concepts 253
“Do I Know This Already?” Quiz 253
Foundation Topics 257
Software Development Environments and Methodologies 257
Application Provisioning and Deprovisioning 260
Software Integrity Measurement 261
Secure Coding Techniques 261
Core SDLC and DevOps Principles 263
Programming Testing Methods 266
Programming Vulnerabilities and Attacks 270
Open Web Application Security Project (OWASP) 276
Software Diversity 278
Automation/Scripting 278
Elasticity and Scalability 279
Chapter Review Activities 280
Chapter 12 Summarizing Authentication and Authorization Design Concepts 285
“Do I Know This Already?” Quiz 285
Foundation Topics 289
Authentication Methods 289
Directory Services 291
Federations 292
Attestation 294
Authentication Methods and Technologies 295
Biometrics 300
Fingerprints 300
Retina 301
Iris 301
Facial 301
Voice 302
Vein 302
Gait Analysis 302
Efficacy Rates 302
False Acceptance 303
False Rejection 303
Crossover Error Rate 304
Multifactor Authentication (MFA) Factors and Attributes 304
Authentication, Authorization, and Accounting (AAA) 306
Cloud vs. On-premises Requirements 306
Chapter Review Activities 308
Chapter 13 Implementing Cybersecurity Resilience 311
“Do I Know This Already?” Quiz 311
Foundation Topics 315
Redundancy 315
Geographic Dispersal 315
Disk Redundancy 315
Network Resilience 319
Power Resilience 320
Replication 323
Storage Area Network 323
Virtual Machines 324
On-premises vs. Cloud 325
Backup Types 326
Full Backup 328
Differential Backup 328
Incremental Backup 328
Non-persistence 328
High Availability 329
Restoration Order 330
Diversity 331
Technologies 331
Vendors 331
Crypto 331
Controls 332
Chapter Review Activities 332
Chapter 14 Understanding the Security Implications of Embedded and Specialized Systems 335
“Do I Know This Already?” Quiz 335
Foundation Topics 339
Embedded Systems 339
Supervisory Control and Data Acquisition (SCADA)/Industrial Control Systems (ICS) 341
Internet of Things (IoT) 344
Specialized Systems 346
Medical Systems 347
Vehicles 347
Aircraft 348
Smart Meters 350
Voice over IP (VoIP) 351
Heating, Ventilation, and Air Conditioning (HVAC) 352
Drones 353
Multifunction Printers (MFP) 354
Real-Time Operating Systems (RTOS) 355
Surveillance Systems 355
System on a Chip (SoC) 356
Communication Considerations 357
5G 357
NarrowBand 358
Baseband Radio 359
Subscriber Identity Module (SIM) Cards 360
Zigbee 360
Embedded System Constraints 361
Power 361
Compute 361
Network 362
Crypto 362
Inability to Patch 362
Authentication 363
Range 363
Cost 363
Implied Trust 363
Chapter Review Activities 364
Chapter 15 Understanding the Importance of Physical Security Controls 367
“Do I Know This Already?” Quiz 367
Foundation Topics 370
Bollards/Barricades 370
Access Control Vestibules 372
Badges 373
Alarms 374
Signage 374
Cameras 375
Closed-Circuit Television (CCTV) 376
Industrial Camouflage 377
Personnel 377
Locks 378
USB Data Blockers 379
Lighting 380
Fencing 380
Fire Suppression 381
Sensors 381
Drones 382
Visitor Logs 383
Faraday Cages 383
Air Gap 384
Screened Subnet (Previously Known as Demilitarized Zone [DMZ]) 384
Protected Cable Distribution 385
Secure Areas 385
Secure Data Destruction 386
Chapter Review Activities 387
Chapter 16 Summarizing the Basics of Cryptographic Concepts 391
“Do I Know This Already?” Quiz 391
Foundation Topics 395
Digital Signatures 395
Key Length 396
Key Stretching 397
Salting 397
Hashing 398
Key Exchange 399
Elliptic-Curve Cryptography 399
Perfect Forward Secrecy 400
Quantum 401
Communications 401
Computing 402
Post-Quantum 402
Ephemeral 403
Modes of Operation 403
Electronic Code Book Mode 404
Cipher Block Chaining Mode 405
Cipher Feedback Mode 406
Output Feedback Mode 407
Counter Mode 408
Blockchain 409
Cipher Suites 410
Symmetric vs. Asymmetric Encryption 411
Lightweight Cryptography 414
Steganography 415
Audio Steganography 415
Video Steganography 416
Image Steganography 416
Homomorphic Encryption 417
Common Use Cases 417
Limitations 418
Chapter Review Activities 420
Part III: Implementation
Chapter 17 Implementing Secure Protocols 423
“Do I Know This Already?” Quiz 423
Foundation Topics 426
Protocols 426
Domain Name System Security Extensions 426
SSH 427
Secure/Multipurpose Internet Mail Extensions 428
Secure Real-Time Transport Protocol 430
Lightweight Directory Access Protocol over SSL 432
File Transfer Protocol, Secure 432
Secure (or SSH) File Transfer Protocol 434
Simple Network Management Protocol Version 3 434
Hypertext Transfer Protocol over SSL/TLS 436
IPsec 437
Post Office Protocol/Internet Message Access Protocol 438
Use Cases 439
Voice and Video 440
Time Synchronization 440
Email and Web 441
File Transfer 441
Directory Services 442
Remote Access 442
Domain Name Resolution 442
Routing and Switching 443
Network Address Allocation 443
Subscription Services 444
Chapter Review Activities 444
Chapter 18 Implementing Host or Application Security Solutions 447
“Do I Know This Already?” Quiz 447
Foundation Topics 451
Endpoint Protection 451
Antivirus 451
Antimalware 452
Endpoint Detection and Response 452
Data Loss Prevention 453
Next-Generation Firewall 453
Host-based Intrusion Prevention System 454
Host-based Intrusion Detection System 456
Host-based Firewall 457
Boot Integrity 458
Boot Security/Unified Extensible Firmware Interface 459
Measured Boot 459
Boot Attestation 460
Database 461
Tokenization 461
Salting 462
Hashing 463
Application Security 463
Input Validations 464
Secure Cookies 465
Hypertext Transfer Protocol Headers 465
Code Signing 466
Allow List 467
Block List/Deny List 467
Secure Coding Practices 468
Static Code Analysis 468
Manual Code Review 470
Dynamic Code Analysis 470
Fuzzing 471
Hardening 471
Open Ports and Services 471
Registry 472
Disk Encryption 473
Operating System 473
Patch Management 474
Self-Encrypting Drive/Full-Disk Encryption 475
OPAL 476
Hardware Root of Trust 476
Trusted Platform Module 477
Sandboxing 478
Chapter Review Activities 479
Chapter 19 Implementing Secure Network Designs 483
“Do I Know This Already?” Quiz 483
Foundation Topics 488
Load Balancing 488
Active/Active 488
Active/Passive 488
Scheduling 488
Virtual IP 488
Persistence 489
Network Segmentation 489
Application-Based Segmentation and Microsegmentation 489
Virtual Local Area Network 490
Screened Subnet 491
East-West Traffic 492
Intranets and Extranets 492
Zero Trust 494
Virtual Private Network 494
Remote Access vs. Site-to-Site 496
IPsec 497
SSL/TLS 505
HTML5 508
Layer 2 Tunneling Protocol 508
DNS 509
Network Access Control 510
Out-of-Band Management 510
Port Security 511
Broadcast Storm Prevention 512
Bridge Protocol Data Unit Guard 512
Loop Prevention 512
Dynamic Host Configuration Protocol Snooping 512
Media Access Control Filtering 513
Network Appliances 513
Jump Servers 514
Proxy Servers 514
Network-Based Intrusion Detection System/Network-Based Intrusion
Prevention System 516
Summary of NIDS vs. NIPS 519
HSM 524
Sensors 524
Collectors 525
Aggregators 526
Firewalls 526
Hardware vs. Software 534
Appliance vs. Host-based vs. Virtual 534
Access Control List 535
Route Security 535
Quality of Service 536
Implications of IPv6 536
Port Spanning/Port Mirroring 537
Monitoring Services 538
Performance Baselining 539
File Integrity Monitors 542
Chapter Review Activities 542
Chapter 20 Installing and Configuring Wireless Security Settings 547
“Do I Know This Already?” Quiz 547
Foundation Topics 551
Cryptographic Protocols 551
Wi-Fi Protected Access 2 (WPA2) 551
Wi-Fi Protected Access 3 (WPA3) 551
Counter-mode/CBC-MAC Protocol (CCMP) 552
Simultaneous Authentication of Equals 552
Wireless Cryptographic Protocol Summary 552
Authentication Protocols 553
802.1X and EAP 553
IEEE 802.1x 556
Remote Authentication Dial-In User Service (RADIUS) Federation 556
Methods 557
Wi-Fi Protected Setup 558
Captive Portals 559
Installation Considerations 559
Controller and Access Point Security 562
Wireless Access Point Vulnerabilities 563
Chapter Review Activities 564
Chapter 21 Implementing Secure Mobile Solutions 567
“Do I Know This Already?” Quiz 567
Foundation Topics 570
Connection Methods and Receivers 570
RFID and NFC 571
More Wireless Connection Methods and Receivers 572
Secure Implementation Best Practices 573
Mobile Device Management 574
MDM Security Feature Concerns: Application and Content Management 576
MDM Security Feature Concerns: Remote Wipe, Geofencing, Geolocation, Screen Locks, Passwords and PINs, Full Device Encryption 578
Mobile Device Management Enforcement and Monitoring 581
Mobile Devices 585
MDM/Unified Endpoint Management 587
SEAndroid 588
Deployment Models 588
Secure Implementation of BYOD, CYOD, and COPE 589
Chapter Review Activities 591
Chapter 22 Applying Cybersecurity Solutions to the Cloud 595
“Do I Know This Already?” Quiz 595
Foundation Topics 598
Cloud Security Controls 598
Security Assessment in the Cloud 598
Understanding the Different Cloud Security Threats 598
Cloud Computing Attacks 601
High Availability Across Zones 603
Resource Policies 603
Integration and Auditing 604
Secrets Management 604
Storage 605
Network 606
Compute 607
Summary of Cloud Security Controls 609
Solutions 611
CASB 611
Application Security 612
Next-Generation Secure Web Gateway 613
Firewall Considerations in a Cloud Environment 613
Summary of Cybersecurity Solutions to the Cloud 614
Cloud Native Controls vs. Third-Party Solutions 615
Chapter Review Activities 615
Chapter 23 Implementing Identity and Account Management Controls 619
“Do I Know This Already?” Quiz 619
Foundation Topics 623
Identity 623
Identity Provider (IdP) 623
Authentication 625
Certificates 626
Tokens 627
SSH Keys 628
Smart Cards 629
Account Types 629
Account Policies 633
Introduction to Identity and Access Management 633
Attribute-Based Access Control (ABAC) 638
Rights, Permissions, and Policies 640
Permission Inheritance and Propagation 645
Chapter Review Activities 647
Chapter 24 Implementing Authentication and Authorization Solutions 651
“Do I Know This Already?” Quiz 651
Foundation Topics 655
Authentication Management 655
Password Keys 655
Password Vaults 655
Trusted Platform Module 656
Hardware Security Modules 656
Knowledge-Based Authentication 656
Authentication/Authorization 657
Security Assertion Markup Language 659
OAuth 661
OpenID and OpenID Connect 663
Remote Authentication Technologies 670
Access Control Schemes 674
Discretionary Access Control 674
Mandatory Access Control 676
Role-Based Access Control 677
Attribute-Based Access Control 678
Rule-Based Access Control 678
Conditional Access 678
Privileged Access Management 678
Summary of Access Control Models 679
Access Control Wise Practices 680
Chapter Review Activities 681
Chapter 25 Implementing Public Key Infrastructure 685
“Do I Know This Already?” Quiz 685
Foundation Topics 688
Public Key Infrastructure 688
Key Management 688
Certificate Authorities 689
Certificate Attributes 691
Subject Alternative Name 693
Expiration 693
Types of Certificates 694
SSL Certificate Types 694
Certificate Chaining 696
Certificate Formats 697
PKI Concepts 698
Trust Model 698
Certificate Pinning 698
Stapling, Key Escrow, Certificate Chaining, Online vs. Offline CA 698
Chapter Review Activities 700
Part IV: Operations and Incident Response
Chapter 26 Using the Appropriate Tool to Assess Organizational Security 703
“Do I Know This Already?” Quiz 703
Foundation Topics 707
Network Reconnaissance and Discovery 707
tracert/traceroute 707
nslookup/dig 709
ipconfig/ifconfig 710
nmap 711
ping/pathping 714
hping 717
netstat 718
netcat 720
IP Scanners 721
arp 721
route 723
curl 724
theHarvester 725
sn1per 726
scanless 727
dnsenum 728
Nessus 730
Cuckoo 731
File Manipulation 732
head 733
tail 734
cat 734
grep 735
chmod 736
Logger 737
Shell and Script Environments 738
SSH 739
PowerShell 740
Python 741
OpenSSL 741
Packet Capture and Replay 742
Tcpreplay 742
Tcpdump 742
Wireshark 743
Forensics 744
dd 744
Memdump 745
WinHex 746
FTK Imager 747
Autopsy 747
Exploitation Frameworks 747
Password Crackers 748
Data Sanitization 750
Chapter Review Activities 750
Chapter 27 Summarizing the Importance of Policies, Processes, and Procedures for Incident Response 755
“Do I Know This Already?” Quiz 755
Foundation Topics 760
Incident Response Plans 760
Incident Response Process 761
Preparation 762
Identification 763
Containment 763
Eradication 764
Recovery 764
Lessons Learned 764
Exercises 765
Tabletop 765
Walkthroughs 766
Simulations 766
Attack Frameworks 767
MITRE ATT&CK 767
The Diamond Model of Intrusion Analysis 768
Cyber Kill Chain 770
Stakeholder Management 771
Communication Plan 771
Disaster Recovery Plan 772
Business Continuity Plan 773
Continuity of Operations Planning (COOP) 774
Incident Response Team 775
Retention Policies 776
Chapter Review Activities 776
Chapter 28 Using Appropriate Data Sources to Support an Investigation 781
“Do I Know This Already?” Quiz 781
Foundation Topics 785
Vulnerability Scan Output 785
SIEM Dashboards 786
Sensors 787
Sensitivity 788
Trends 788
Alerts 788
Correlation 788
Log Files 789
Network 790
System 791
Application 792
Security 793
Web 794
DNS 795
Authentication 796
Dump Files 797
VoIP and Call Managers 799
Session Initiation Protocol Traffic 800
syslog/rsyslog/syslog-ng 800
journalctl 802
NXLog 803
Bandwidth Monitors 804
Metadata 805
Email 808
Mobile 808
Web 808
File 809
NetFlow/sFlow 809
NetFlow 809
sFlow 810
IPFIX 811
Protocol Analyzer Output 813
Chapter Review Activities 814
Chapter 29 Applying Mitigation Techniques or Controls to Secure an Environment 819
“Do I Know This Already?” Quiz 819
Foundation Topics 822
Reconfigure Endpoint Security Solutions 822
Application Approved Lists 822
Application Block List/Deny List 822
Quarantine 823
Configuration Changes 824
Firewall Rules 825
MDM 825
Data Loss Prevention 828
Content Filter/URL Filter 828
Update or Revoke Certificates 829
Isolation 830
Containment 830
Segmentation 831
SOAR 832
Runbooks 833
Playbooks 834
Chapter Review Activities 834
Chapter 30 Understanding the Key Aspects of Digital Forensics 837
“Do I Know This Already?” Quiz 837
Foundation Topics 842
Documentation/Evidence 842
Legal Hold 842
Video 842
Admissibility 843
Chain of Custody 844
Timelines of Sequence of Events 844
Tags 845
Reports 846
Event Logs 846
Interviews 846
Acquisition 847
Order of Volatility 848
Disk 848
Random-Access Memory 848
Swap/Pagefile 849
Operating System 850
Device 850
Firmware 851
Snapshot 851
Cache 852
Network 852
Artifacts 853
On-premises vs. Cloud 853
Right-to-Audit Clauses 854
Regulatory/Jurisdiction 855
Data Breach Notification Laws 855
Integrity 856
Hashing 856
Checksums 857
Provenance 857
Preservation 858
E-discovery 858
Data Recovery 859
Nonrepudiation 859
Strategic Intelligence/Counterintelligence 860
Chapter Review Activities 860
Part V: Governance, Risk, and Compliance
Chapter 31 Comparing and Contrasting the Various Types of Controls 865
“Do I Know This Already?” Quiz 865
Foundation Topics 868
Control Category 868
Managerial Controls 868
Operational Controls 868
Technical Controls