CompTIA Security+ SY0-601 Cert Guide

This is the eBook edition of the CompTIA Security+ SY0-601 Cert Guide. This eBook does not include access to the Pearson Test Prep practice exams that comes with the print edition. Learn, prepare, and practice for CompTIA Security+ SY0-601 exam success with this CompTIA Security+ SY0-601 Cert Guide from Pearson IT Certification, a leader in IT certification learning. CompTIA Security+ SY0-601 Cert Guide presents you with an organized test preparation routine through the use of proven series elements and techniques. "Do I Know This Already?" quizzes open each chapter and enable you to decide how much time you need to spend on each section. Exam topic lists make referencing easy. Chapter-ending Exam Preparation Tasks help you drill on key concepts you must know thoroughly. CompTIA Security+ SY0-601 Cert Guide focuses specifically on the objectives for the CompTIA Security+ SY0-601 exam. Leading security experts Omar Santos, Ron Taylor, and Joseph Mlodzianowski share preparation hints and test-taking tips, helping you identify areas of weakness and improve both your conceptual knowledge and hands-on skills. Material is presented in a concise manner, focusing on increasing your understanding and retention of exam topics. This complete study package includes * A test-preparation routine proven to help you pass the exams * Do I Know This Already? quizzes, which allow you to decide how much time you need to spend on each section * Chapter-ending exercises, which help you drill on key concepts you must know thoroughly * An online interactive Flash Cards application to help you drill on Key Terms by chapter * A final preparation chapter, which guides you through tools and resources to help you craft your review and test-taking strategies * Study plan suggestions and templates to help you organize and optimize your study time Well regarded for its level of detail, assessment features, and challenging review questions and exercises, this official study guide helps you master the concepts and techniques that ensure your exam success. This study guide helps you master all the topics on the CompTIA Security+ SY0-601 exam, including * Cyber attacks, threats, and vulnerabilities * Social engineering, wireless attacks, denial of service attacks * Threat hunting and incident response * Indicators of compromise and threat intelligence * Cloud security concepts and cryptography * Security assessments and penetration testing concepts * Governance, risk management, and cyber resilience * Authentication, Authorization, and Accounting (AAA) * IoT and Industrial Control Systems (ICS) security * Physical and administrative security controls

Table of Contents:
Introduction xliv Part I: Threats, Attacks, and Vulnerabilities Chapter 1 Comparing and Contrasting Different Types of Social Engineering Techniques 3 “Do I Know This Already?” Quiz 3 Foundation Topics 7 Social Engineering Fundamentals 7     Phishing and Spear Phishing 9     Smishing 12     Vishing 12     Spam and Spam over Internet Messaging (SPIM) 13     Dumpster Diving 13     Shoulder Surfing 14     Pharming 14     Piggybacking or Tailgating 15     Eliciting Information 15     Whaling 16     Prepending 17     Identity Fraud 17     Invoice Scams 17     Credential Harvesting 18     Reconnaissance 18     Hoaxes 19     Impersonation or Pretexting 19     Eavesdropping 19     Baiting 20     Watering Hole Attack 20     Typo Squatting 20     Influence Campaigns, Principles of Social Engineering, and Reasons for Effectiveness 21 User Security Awareness Education 22 Chapter Review Activities 24 Chapter 2 Analyzing Potential Indicators to Determine the Type of Attack 29 “Do I Know This Already?” Quiz 29 Foundation Topics 33 Malicious Software (Malware) 33     Ransomware and Cryptomalware 33     Trojans 35     Remote Access Trojans (RATs) and Rootkits 35     Worms 36     Fileless Virus 37     Command and Control, Bots, and Botnets 37     Logic Bombs 39     Potentially Unwanted Programs (PUPs) and Spyware 40     Keyloggers 42     Backdoors 43     Malware Delivery Mechanisms 43     You Can’t Save Every Computer from Malware! 45 Password Attacks 45     Dictionary-based and Brute-force Attacks 45     Password Spraying 46     Offline and Online Password Cracking 46     Rainbow Tables 47     Plaintext/Unencrypted 47 Physical Attacks 48     Malicious Flash Drives 48     Malicious Universal Serial Bus (USB) Cables 48     Card Cloning Attacks 48     Skimming 49 Adversarial Artificial Intelligence 50     Tainted Training Data for Machine Learning 50     Security of Machine Learning Algorithms 50 Supply-Chain Attacks 51 Cloud-based vs. On-premises Attacks 52     Cloud Security Threats 52     Cloud Computing Attacks 54 Cryptographic Attacks 55     Collision 55     Birthday 56     Downgrade 56 Chapter Review Activities 57 Chapter 3 Analyzing Potential Indicators Associated with Application Attacks 61 “Do I Know This Already?” Quiz 61 Foundation Topics 67 Privilege Escalation 67 Cross-Site Scripting (XSS) Attacks 68 Injection Attacks 70     Structured Query Language (SQL) Injection Attacks 70     SQL Injection Categories 73     Dynamic Link Library (DLL) Injection Attacks 74     Lightweight Directory Access Protocol (LDAP) Injection Attacks 74     Extensible Markup Language (XML) Injection Attacks 74 Pointer/Object Dereference 75 Directory Traversal 76 Buffer Overflows 77     Arbitrary Code Execution/Remote Code Execution 78 Race Conditions 79 Error Handling 79 Improper Input Handling 80     Compile-Time Errors vs. Runtime Errors 81 Replay Attacks 82 Request Forgeries 85 Application Programming Interface (API) Attacks 86 Resource Exhaustion 87 Memory Leaks 88 Secure Socket Layer (SSL) Stripping 88 Driver Manipulation 89 Pass the Hash 89 Chapter Review Activities 90 Chapter 4 Analyzing Potential Indicators Associated with Network Attacks 95 “Do I Know This Already?” Quiz 95 Foundation Topics 98 Wireless Attacks 98     Evil Twin Attacks 98     Rogue Access Points 99     Bluesnarfing Attacks 99     Bluejacking Attacks 100     Disassociation and Deauthentication Attacks 101     Jamming Attacks 102     Radio Frequency Identifier (RFID) Attacks 102     Near-Field Communication (NFC) Attacks 102     Initialization Vector (IV) Attacks 103 On-Path Attacks 103 Layer 2 Attacks 105     Address Resolution Protocol (ARP) Poisoning Attacks 105     Media Access Control (MAC) Flooding Attacks 106     MAC Cloning Attacks 106     Best Practices to Protect Against Layer 2 Attacks 106 Domain Name System (DNS) Attacks 107     Domain Hijacking Attacks 108     DNS Poisoning Attacks 108     Uniform Resource Locator (URL) Redirection Attacks 110     Domain Reputation 110 Distributed Denial-of-Service (DDoS) Attacks 111 Malicious Code or Script Execution Attacks 113 Chapter Review Activities 114 Chapter 5 Understanding Different Threat Actors, Vectors, and Intelligence Sources 117 “Do I Know This Already?” Quiz 117 Foundation Topics 120 Actors and Threats 120 Attributes of Threat Actors 122 Attack Vectors 122 Threat Intelligence and Threat Intelligence Sources 123     Structured Threat Information eXpression (STIX) and the Trusted Automated eXchange of Indicator Information (TAXII) 125 Research Sources 127     The MITRE ATT&CK Framework 128 Chapter Review Activities 129 Chapter 6 Understanding the Security Concerns Associated with Various Types of Vulnerabilities 133 “Do I Know This Already?” Quiz 133 Foundation Topics 137 Cloud-based vs. On-premises Vulnerabilities 137     Other “Cloud”-based Concerns 143     Server Defense 144 Zero-day Vulnerabilities 149 Weak Configurations 150 Third-party Risks 155 Improper or Weak Patch Management 160     Patches and Hotfixes 161     Patch Management 163 Legacy Platforms 165 The Impact of Cybersecurity Attacks and Breaches 165 Chapter Review Activities 166 Chapter 7 Summarizing the Techniques Used in Security Assessments 171 “Do I Know This Already?” Quiz 171 Foundation Topics 175 Threat Hunting 175     Security Advisories and Bulletins 177 Vulnerability Scans 180     Credentialed vs. Noncredentialed 182     Intrusive vs. Nonintrusive 182     Common Vulnerability Scoring System (CVSS) 182 Logs and Security Information and Event Management (SIEM) 186 Security Orchestration, Automation, and Response (SOAR) 188 Chapter Review Activities 189 Chapter 8 Understanding the Techniques Used in Penetration Testing 193 “Do I Know This Already?” Quiz 193 Foundation Topics 197 Penetration Testing 197     Bug Bounties vs. Penetration Testing 202 Passive and Active Reconnaissance 203 Exercise Types 205 Chapter Review Activities 206 Part II: Architecture and Design Chapter 9 Understanding the Importance of Security Concepts in an Enterprise Environment 209 “Do I Know This Already?” Quiz 209 Foundation Topics 213 Configuration Management 213 Data Sovereignty and Data Protection 214     Secure Sockets Layer (SSL)/Transport Layer Security (TLS) Inspection 215     API Considerations 216     Data Masking and Obfuscation 216     Encryption at Rest, in Transit/Motion, and in Processing 218     Hashing 218     Rights Management 219     Geographical Considerations 220     Data Breach Response and Recovery Controls 220 Site Resiliency 221 Deception and Disruption 222     Fake Telemetry 223     DNS Sinkhole 223 Chapter Review Activities 224 Chapter 10 Summarizing Virtualization and Cloud Computing Concepts 227 “Do I Know This Already?” Quiz 227 Foundation Topics 231 Cloud Models 231     Public, Private, Hybrid, and Community Clouds 232 Cloud Service Providers 233 Cloud Architecture Components 234     Fog and Edge Computing 234     Thin Clients 235     Containers 236     Microservices and APIs 240     Infrastructure as Code 241     Serverless Architecture 243     Services Integration 246     Resource Policies 246     Transit Gateway 246 Virtual Machine (VM) Sprawl Avoidance and VM Escape Protection 247     Understanding and Avoiding VM Sprawl 247     Protecting Against VM Escape Attacks 248 Chapter Review Activities 250 Chapter 11 Summarizing Secure Application Development, Deployment, and Automation Concepts 253 “Do I Know This Already?” Quiz 253 Foundation Topics 257 Software Development Environments and Methodologies 257 Application Provisioning and Deprovisioning 260 Software Integrity Measurement 261 Secure Coding Techniques 261     Core SDLC and DevOps Principles 263     Programming Testing Methods 266     Programming Vulnerabilities and Attacks 270 Open Web Application Security Project (OWASP) 276 Software Diversity 278 Automation/Scripting 278 Elasticity and Scalability 279 Chapter Review Activities 280 Chapter 12 Summarizing Authentication and Authorization Design Concepts 285 “Do I Know This Already?” Quiz 285 Foundation Topics 289 Authentication Methods 289     Directory Services 291     Federations 292     Attestation 294     Authentication Methods and Technologies 295 Biometrics 300     Fingerprints 300     Retina 301     Iris 301     Facial 301     Voice 302     Vein 302     Gait Analysis 302     Efficacy Rates 302     False Acceptance 303     False Rejection 303     Crossover Error Rate 304 Multifactor Authentication (MFA) Factors and Attributes 304 Authentication, Authorization, and Accounting (AAA) 306 Cloud vs. On-premises Requirements 306 Chapter Review Activities 308 Chapter 13 Implementing Cybersecurity Resilience 311 “Do I Know This Already?” Quiz 311 Foundation Topics 315 Redundancy 315     Geographic Dispersal 315     Disk Redundancy 315     Network Resilience 319     Power Resilience 320 Replication 323     Storage Area Network 323     Virtual Machines 324 On-premises vs. Cloud 325 Backup Types 326     Full Backup 328     Differential Backup 328     Incremental Backup 328 Non-persistence 328 High Availability 329 Restoration Order 330 Diversity 331     Technologies 331     Vendors 331     Crypto 331     Controls 332 Chapter Review Activities 332 Chapter 14 Understanding the Security Implications of Embedded and Specialized Systems 335 “Do I Know This Already?” Quiz 335 Foundation Topics 339 Embedded Systems 339 Supervisory Control and Data Acquisition (SCADA)/Industrial Control Systems (ICS) 341 Internet of Things (IoT) 344 Specialized Systems 346     Medical Systems 347     Vehicles 347     Aircraft 348     Smart Meters 350 Voice over IP (VoIP) 351 Heating, Ventilation, and Air Conditioning (HVAC) 352 Drones 353 Multifunction Printers (MFP) 354 Real-Time Operating Systems (RTOS) 355 Surveillance Systems 355 System on a Chip (SoC) 356 Communication Considerations 357     5G 357     NarrowBand 358     Baseband Radio 359     Subscriber Identity Module (SIM) Cards 360     Zigbee 360 Embedded System Constraints 361     Power 361     Compute 361     Network 362     Crypto 362     Inability to Patch 362     Authentication 363     Range 363     Cost 363     Implied Trust 363 Chapter Review Activities 364 Chapter 15 Understanding the Importance of Physical Security Controls 367 “Do I Know This Already?” Quiz 367 Foundation Topics 370 Bollards/Barricades 370 Access Control Vestibules 372 Badges 373 Alarms 374 Signage 374 Cameras 375 Closed-Circuit Television (CCTV) 376 Industrial Camouflage 377 Personnel 377 Locks 378 USB Data Blockers 379 Lighting 380 Fencing 380 Fire Suppression 381 Sensors 381 Drones 382 Visitor Logs 383 Faraday Cages 383 Air Gap 384 Screened Subnet (Previously Known as Demilitarized Zone [DMZ]) 384 Protected Cable Distribution 385 Secure Areas 385 Secure Data Destruction 386 Chapter Review Activities 387 Chapter 16 Summarizing the Basics of Cryptographic Concepts 391 “Do I Know This Already?” Quiz 391 Foundation Topics 395 Digital Signatures 395 Key Length 396 Key Stretching 397 Salting 397 Hashing 398 Key Exchange 399 Elliptic-Curve Cryptography 399 Perfect Forward Secrecy 400 Quantum 401     Communications 401     Computing 402 Post-Quantum 402 Ephemeral 403 Modes of Operation 403     Electronic Code Book Mode 404     Cipher Block Chaining Mode 405     Cipher Feedback Mode 406     Output Feedback Mode 407     Counter Mode 408 Blockchain 409 Cipher Suites 410 Symmetric vs. Asymmetric Encryption 411 Lightweight Cryptography 414 Steganography 415     Audio Steganography 415     Video Steganography 416     Image Steganography 416 Homomorphic Encryption 417 Common Use Cases 417 Limitations 418 Chapter Review Activities 420 Part III: Implementation Chapter 17 Implementing Secure Protocols 423 “Do I Know This Already?” Quiz 423 Foundation Topics 426 Protocols 426     Domain Name System Security Extensions 426     SSH 427     Secure/Multipurpose Internet Mail Extensions 428     Secure Real-Time Transport Protocol 430     Lightweight Directory Access Protocol over SSL 432     File Transfer Protocol, Secure 432     Secure (or SSH) File Transfer Protocol 434     Simple Network Management Protocol Version 3 434     Hypertext Transfer Protocol over SSL/TLS 436     IPsec 437     Post Office Protocol/Internet Message Access Protocol 438 Use Cases 439     Voice and Video 440     Time Synchronization 440     Email and Web 441     File Transfer 441     Directory Services 442     Remote Access 442     Domain Name Resolution 442     Routing and Switching 443     Network Address Allocation 443     Subscription Services 444 Chapter Review Activities 444 Chapter 18 Implementing Host or Application Security Solutions 447 “Do I Know This Already?” Quiz 447 Foundation Topics 451 Endpoint Protection 451     Antivirus 451 Antimalware 452     Endpoint Detection and Response 452     Data Loss Prevention 453 Next-Generation Firewall 453 Host-based Intrusion Prevention System 454 Host-based Intrusion Detection System 456 Host-based Firewall 457 Boot Integrity 458     Boot Security/Unified Extensible Firmware Interface 459     Measured Boot 459     Boot Attestation 460 Database 461     Tokenization 461     Salting 462     Hashing 463 Application Security 463     Input Validations 464     Secure Cookies 465     Hypertext Transfer Protocol Headers 465     Code Signing 466     Allow List 467     Block List/Deny List 467     Secure Coding Practices 468     Static Code Analysis 468     Manual Code Review 470     Dynamic Code Analysis 470     Fuzzing 471 Hardening 471     Open Ports and Services 471     Registry 472     Disk Encryption 473     Operating System 473     Patch Management 474 Self-Encrypting Drive/Full-Disk Encryption 475     OPAL 476 Hardware Root of Trust 476 Trusted Platform Module 477 Sandboxing 478 Chapter Review Activities 479 Chapter 19 Implementing Secure Network Designs 483 “Do I Know This Already?” Quiz 483 Foundation Topics 488 Load Balancing 488     Active/Active 488     Active/Passive 488     Scheduling 488     Virtual IP 488     Persistence 489 Network Segmentation 489     Application-Based Segmentation and Microsegmentation 489     Virtual Local Area Network 490     Screened Subnet 491     East-West Traffic 492     Intranets and Extranets 492     Zero Trust 494 Virtual Private Network 494     Remote Access vs. Site-to-Site 496     IPsec 497     SSL/TLS 505     HTML5 508     Layer 2 Tunneling Protocol 508 DNS 509 Network Access Control 510 Out-of-Band Management 510 Port Security 511     Broadcast Storm Prevention 512     Bridge Protocol Data Unit Guard 512     Loop Prevention 512     Dynamic Host Configuration Protocol Snooping 512     Media Access Control Filtering 513 Network Appliances 513     Jump Servers 514     Proxy Servers 514     Network-Based Intrusion Detection System/Network-Based Intrusion     Prevention System 516     Summary of NIDS vs. NIPS 519     HSM 524     Sensors 524     Collectors 525     Aggregators 526     Firewalls 526     Hardware vs. Software 534     Appliance vs. Host-based vs. Virtual 534 Access Control List 535 Route Security 535 Quality of Service 536 Implications of IPv6 536 Port Spanning/Port Mirroring 537 Monitoring Services 538     Performance Baselining 539 File Integrity Monitors 542 Chapter Review Activities 542 Chapter 20 Installing and Configuring Wireless Security Settings 547 “Do I Know This Already?” Quiz 547 Foundation Topics 551 Cryptographic Protocols 551     Wi-Fi Protected Access 2 (WPA2) 551     Wi-Fi Protected Access 3 (WPA3) 551     Counter-mode/CBC-MAC Protocol (CCMP) 552     Simultaneous Authentication of Equals 552     Wireless Cryptographic Protocol Summary 552 Authentication Protocols 553     802.1X and EAP 553     IEEE 802.1x 556     Remote Authentication Dial-In User Service (RADIUS) Federation 556 Methods 557     Wi-Fi Protected Setup 558     Captive Portals 559 Installation Considerations 559     Controller and Access Point Security 562     Wireless Access Point Vulnerabilities 563 Chapter Review Activities 564 Chapter 21 Implementing Secure Mobile Solutions 567 “Do I Know This Already?” Quiz 567 Foundation Topics 570 Connection Methods and Receivers 570     RFID and NFC 571     More Wireless Connection Methods and Receivers 572     Secure Implementation Best Practices 573 Mobile Device Management 574     MDM Security Feature Concerns: Application and Content Management 576     MDM Security Feature Concerns: Remote Wipe, Geofencing, Geolocation, Screen Locks, Passwords and PINs, Full Device Encryption 578 Mobile Device Management Enforcement and Monitoring 581 Mobile Devices 585     MDM/Unified Endpoint Management 587     SEAndroid 588 Deployment Models 588     Secure Implementation of BYOD, CYOD, and COPE 589 Chapter Review Activities 591 Chapter 22 Applying Cybersecurity Solutions to the Cloud 595 “Do I Know This Already?” Quiz 595 Foundation Topics 598 Cloud Security Controls 598     Security Assessment in the Cloud 598     Understanding the Different Cloud Security Threats 598     Cloud Computing Attacks 601     High Availability Across Zones 603     Resource Policies 603     Integration and Auditing 604     Secrets Management 604     Storage 605     Network 606     Compute 607     Summary of Cloud Security Controls 609 Solutions 611     CASB 611     Application Security 612     Next-Generation Secure Web Gateway 613     Firewall Considerations in a Cloud Environment 613     Summary of Cybersecurity Solutions to the Cloud 614 Cloud Native Controls vs. Third-Party Solutions 615 Chapter Review Activities 615 Chapter 23 Implementing Identity and Account Management Controls 619 “Do I Know This Already?” Quiz 619 Foundation Topics 623 Identity 623     Identity Provider (IdP) 623     Authentication 625     Certificates 626     Tokens 627     SSH Keys 628     Smart Cards 629 Account Types 629 Account Policies 633     Introduction to Identity and Access Management 633     Attribute-Based Access Control (ABAC) 638     Rights, Permissions, and Policies 640     Permission Inheritance and Propagation 645 Chapter Review Activities 647 Chapter 24 Implementing Authentication and Authorization Solutions 651 “Do I Know This Already?” Quiz 651 Foundation Topics 655 Authentication Management 655     Password Keys 655     Password Vaults 655     Trusted Platform Module 656     Hardware Security Modules 656     Knowledge-Based Authentication 656 Authentication/Authorization 657     Security Assertion Markup Language 659     OAuth 661     OpenID and OpenID Connect 663     Remote Authentication Technologies 670 Access Control Schemes 674     Discretionary Access Control 674     Mandatory Access Control 676     Role-Based Access Control 677     Attribute-Based Access Control 678     Rule-Based Access Control 678     Conditional Access 678     Privileged Access Management 678     Summary of Access Control Models 679     Access Control Wise Practices 680 Chapter Review Activities 681 Chapter 25 Implementing Public Key Infrastructure 685 “Do I Know This Already?” Quiz 685 Foundation Topics 688 Public Key Infrastructure 688     Key Management 688     Certificate Authorities 689     Certificate Attributes 691     Subject Alternative Name 693     Expiration 693 Types of Certificates 694     SSL Certificate Types 694     Certificate Chaining 696 Certificate Formats 697 PKI Concepts 698     Trust Model 698     Certificate Pinning 698     Stapling, Key Escrow, Certificate Chaining, Online vs. Offline CA 698 Chapter Review Activities 700 Part IV: Operations and Incident Response Chapter 26 Using the Appropriate Tool to Assess Organizational Security 703 “Do I Know This Already?” Quiz 703 Foundation Topics 707 Network Reconnaissance and Discovery 707     tracert/traceroute 707     nslookup/dig 709     ipconfig/ifconfig 710     nmap 711     ping/pathping 714     hping 717     netstat 718     netcat 720     IP Scanners 721     arp 721     route 723     curl 724     theHarvester 725     sn1per 726     scanless 727     dnsenum 728     Nessus 730     Cuckoo 731 File Manipulation 732     head 733     tail 734     cat 734     grep 735     chmod 736     Logger 737 Shell and Script Environments 738     SSH 739     PowerShell 740     Python 741     OpenSSL 741 Packet Capture and Replay 742     Tcpreplay 742     Tcpdump 742     Wireshark 743 Forensics 744     dd 744     Memdump 745     WinHex 746     FTK Imager 747     Autopsy 747 Exploitation Frameworks 747 Password Crackers 748 Data Sanitization 750 Chapter Review Activities 750 Chapter 27 Summarizing the Importance of Policies, Processes, and Procedures for Incident Response 755 “Do I Know This Already?” Quiz 755 Foundation Topics 760 Incident Response Plans 760 Incident Response Process 761     Preparation 762     Identification 763     Containment 763     Eradication 764     Recovery 764     Lessons Learned 764 Exercises 765     Tabletop 765     Walkthroughs 766     Simulations 766 Attack Frameworks 767     MITRE ATT&CK 767     The Diamond Model of Intrusion Analysis 768     Cyber Kill Chain 770 Stakeholder Management 771 Communication Plan 771 Disaster Recovery Plan 772 Business Continuity Plan 773 Continuity of Operations Planning (COOP) 774 Incident Response Team 775 Retention Policies 776 Chapter Review Activities 776 Chapter 28 Using Appropriate Data Sources to Support an Investigation 781 “Do I Know This Already?” Quiz 781 Foundation Topics 785 Vulnerability Scan Output 785 SIEM Dashboards 786     Sensors 787     Sensitivity 788     Trends 788     Alerts 788     Correlation 788 Log Files 789     Network 790     System 791     Application 792     Security 793     Web 794     DNS 795     Authentication 796     Dump Files 797     VoIP and Call Managers 799     Session Initiation Protocol Traffic 800 syslog/rsyslog/syslog-ng 800 journalctl 802 NXLog 803 Bandwidth Monitors 804 Metadata 805     Email 808     Mobile 808     Web 808     File 809 NetFlow/sFlow 809     NetFlow 809     sFlow 810     IPFIX 811 Protocol Analyzer Output 813 Chapter Review Activities 814 Chapter 29 Applying Mitigation Techniques or Controls to Secure an Environment 819 “Do I Know This Already?” Quiz 819 Foundation Topics 822 Reconfigure Endpoint Security Solutions 822     Application Approved Lists 822     Application Block List/Deny List 822     Quarantine 823 Configuration Changes 824     Firewall Rules 825     MDM 825     Data Loss Prevention 828     Content Filter/URL Filter 828     Update or Revoke Certificates 829 Isolation 830 Containment 830 Segmentation 831 SOAR 832     Runbooks 833     Playbooks 834 Chapter Review Activities 834 Chapter 30 Understanding the Key Aspects of Digital Forensics 837 “Do I Know This Already?” Quiz 837 Foundation Topics 842 Documentation/Evidence 842     Legal Hold 842     Video 842     Admissibility 843     Chain of Custody 844     Timelines of Sequence of Events 844     Tags 845     Reports 846     Event Logs 846     Interviews 846 Acquisition 847     Order of Volatility 848     Disk 848     Random-Access Memory 848     Swap/Pagefile 849     Operating System 850     Device 850     Firmware 851     Snapshot 851     Cache 852     Network 852     Artifacts 853 On-premises vs. Cloud 853     Right-to-Audit Clauses 854     Regulatory/Jurisdiction 855     Data Breach Notification Laws 855 Integrity 856     Hashing 856     Checksums 857     Provenance 857 Preservation 858 E-discovery 858 Data Recovery 859 Nonrepudiation 859 Strategic Intelligence/Counterintelligence 860 Chapter Review Activities 860 Part V: Governance, Risk, and Compliance Chapter 31 Comparing and Contrasting the Various Types of Controls 865 “Do I Know This Already?” Quiz 865 Foundation Topics 868 Control Category 868     Managerial Controls 868     Operational Controls 868     Technical Controls 868     Summary of Control Categories 869 Control Types 869     Preventative Controls 869     Detective Controls 869     Corrective Controls 870     Deterrent Controls 870     Compensating Controls 871     Physical Controls 871     Summary of Control Types 872 Chapter Review Activities 873 Chapter 32 Understanding the Importance of Applicable Regulations, Standards, or Frameworks That Impact Organizational Security Posture 875 “Do I Know This Already?” Quiz 875 Foundation Topics 878 Regulations, Standards, and Legislation 878     General Data Protection Regulation 879     National, Territory, or State Laws 879     Payment Card Industry Data Security Standard (PCI DSS) 881 Key Frameworks 881 Benchmarks and Secure Configuration Guides 885     Security Content Automation Protocol 885 Chapter Review Activities 889 Chapter 33 Understanding the Importance of Policies to Organizational Security 893 “Do I Know This Already?” Quiz 894 Foundation Topics 897 Personnel Policies 897     Privacy Policies 897     Acceptable Use 898     Separation of Duties/Job Rotation 898     Mandatory Vacations 898     Onboarding and Offboarding 899     Personnel Security Policies 900 Diversity of Training Techniques 900     User Education and Awareness Training 901 Third-Party Risk Management 902 Data Concepts 904     Understanding Classification and Governance 904     Data Retention 906 Credential Policies 906 Organizational Policies 908     Change Management and Change Control 909     Asset Management 909 Chapter Review Activities 910 Chapter 34 Summarizing Risk Management Processes and Concepts 913 “Do I Know This Already?” Quiz 913 Foundation Topics 917 Risk Types 917 Risk Management Strategies 918 Risk Analysis 919     Qualitative Risk Assessment 921     Quantitative Risk Assessment 922 Disaster Analysis 924 Business Impact Analysis 926     Disaster Recovery Planning 928 Chapter Review Activities 930 Chapter 35 Understanding Privacy and Sensitive Data Concepts in Relation to Security 935 “Do I Know This Already?” Quiz 935 Foundation Topics 940 Organizational Consequences of Privacy and Data Breaches 940 Notifications of Breaches 941 Data Types and Asset Classification 941     Personally Identifiable Information and Protected Health Information 943 Privacy Enhancing Technologies 944 Roles and Responsibilities 945 Information Lifecycle 947 Impact Assessment 948 Terms of Agreement 948 Privacy Notice 949 Chapter Review Activities 949 Part VI: Final Preparation Chapter 36 Final Preparation 953 Hands-on Activities 953 Suggested Plan for Final Review and Study 953 Summary 954 Glossary of Key Terms 955 Appendix A Answers to the “Do I Know This Already?” Quizzes and Review Questions 1023 Appendix B CompTIA Security+ (SY0-601) Cert Guide Exam Updates 1087 Online Elements: Appendix C Study Planner Glossary of Key Terms 9780136770312   TOC   6/19/2021

About the Author :
Omar Santos is an active member of the cybersecurity community, where he leads several industry-wide initiatives. He is a best-selling author and trainer. Omar is the author of more than 20 books and video courses, as well as numerous white papers, articles, and security configuration guidelines and best practices. Omar is a principal engineer of the Cisco Product Security Incident Response Team (PSIRT), Security Research and Operations, where he mentors and leads engineers and incident managers during the investigation and resolution of cybersecurity vulnerabilities. Omar co-leads the DEF CON Red Team Village, is the chair of the Common Security Advisory Framework (CSAF) technical committee, is the co-chair of the Forum of Incident Response and Security Teams (FIRST) Open Source Security working group, and has been the chair of several initiatives in the Industry Consortium for Advancement of Security on the Internet (ICASI). His active role helps businesses, academic institutions, state and local law enforcement agencies, and other participants dedicated to increasing the security of their critical infrastructures. You can find additional information about Omar's current projects at h4cker.org and can follow Omar on Twitter @santosomar. Ron Taylor has been in the information security field for more than 20 years working in various areas focusing on both offense and defense security roles. Ten of those years were spent in consulting. In 2008, he joined the Cisco Global Certification Team as an SME in information assurance. From there, he moved into a position with the Security Research and Operations group, where his focus was mostly on penetration testing of Cisco products and services. He was also involved in developing and presenting security training to internal development and test teams globally, and provided consulting support to many product teams as an SME on product security testing. His next role was incident manager for the Cisco Product Security Incident Response Team (PSIRT). Currently, Ron is a security architect specializing in the Cisco security product line. He has held a number of industry certifications, including GPEN, GWEB, GCIA, GCIH, GWAPT, RHCE, CCSP, CCNA, CISSP, PenTest+, and MCSE. Ron has also authored books and video courses, teaches, and is involved in organizing a number of cybersecurity conferences, including the BSides Raleigh, Texas Cyber Summit, Grayhat, and the Red Team Village at DEFCON. Twitter: @Gu5G0rman Linkedin: www.linkedin.com/in/-RonTaylor Joseph Mlodzianowski is an information security aficionado and adventurer; he started multiple villages at RSA Conference, DEFCON, and BLACK HAT, among others, including founding the Red Team Village with the help of great friends. He has been in the information technology security field for more than 25 years working in infrastructure, security, networks, systems, design, offense, and defense. Joseph is currently an enterprise security architect of Cisco Managed Services. He spent more than 10 years in the Department of Defense as an operator, principal security network engineer, and SME designing and deploying complex technologies and supporting missions around the world in multiple theaters. He has consulted, investigated, and provided support for multiple federal agencies over the past 15 years. Joseph continues to contribute to content, reviews, and editing in the certification testing and curriculum process. He spent almost 15 years in the energy sector supporting refineries, pipelines, and chemical plants; specializing in industrial control networks; and building data centers. Joseph holds a broad range of certifications, including the Cisco CCIE, CNE, CSNA, CNSS-4012, CISSP, ITILv4, NSA IAM, NSA IEM, OIAC1180, FEMA IS-00317, ACMA, First Responder, Hazmat Certified, Member of Bexar County Sheriff's Office CERT, MCSE, and Certified Hacking Investigator. He also is a founding contributor to the CyManII | Cybersecurity Manufacturing Innovation Institute, a member of Messaging Malware Mobile Anti-Abuse Working Group (M3aawg.org), and founder of the Texas Cyber Summit and Grayhat Conferences. He believes in giving back to the community and supporting nonprofits. Twitter: @Cedoxx Linkedin: www.linkedin.com/in/mlodzianowski/