Comptia Security+ Study Guide: Exam Sy0-601

ISBN-13: 9781119736257 / Angielski / Miękka / 2021 / 672 str.

Mike Chapple; David Seidl

Spis treści

Introduction xxvAssessment Test xxxviChapter 1 Today's Security Professional 1Cybersecurity Objectives 2Data Breach Risks 3The DAD Triad 3Breach Impact 5Implementing Security Controls 7Security Control Categories 7Security Control Types 8Data Protection 9Summary 12Exam Essentials 12Review Questions 14Chapter 2 Cybersecurity Threat Landscape 19Exploring Cybersecurity Threats 20Classifying Cybersecurity Threats 20Threat Actors 22Threat Vectors 28Threat Data and Intelligence 30Open Source Intelligence 31Proprietary and Closed-Source Intelligence 33Assessing Threat Intelligence 35Threat Indicator Management and Exchange 36Public and Private Information Sharing Centers 37Conducting Your Own Research 38Summary 38Exam Essentials 39Review Questions 40Chapter 3 Malicious Code 45Malware 46Ransomware 47Trojans 47Worms 48Rootkits 48Backdoors 49Bots 50Keyloggers 52Logic Bombs 53Viruses 53Fileless Viruses 53Spyware 54Potentially Unwanted Programs (PUPs) 55Malicious Code 55Adversarial Artificial Intelligence 57Summary 58Exam Essentials 59Review Questions 61Chapter 4 Social Engineering, Physical, and Password Attacks 65Social Engineering 66Social Engineering Techniques 67Influence Campaigns 72Password Attacks 72Physical Attacks 74Summary 76Exam Essentials 76Review Questions 78Chapter 5 Security Assessment and Testing 83Vulnerability Management 84Identifying Scan Targets 84Determining Scan Frequency 86Configuring Vulnerability Scans 87Scanner Maintenance 92Vulnerability Scanning Tools 95Reviewing and Interpreting Scan Reports 96Validating Scan Results 106Security Vulnerabilities 107Patch Management 107Legacy Platforms 108Weak Configurations 109Error Messages 110Insecure Protocols 111Weak Encryption 112Penetration Testing 113Adopting the Hacker Mindset 114Reasons for Penetration Testing 115Benefits of Penetration Testing 115Penetration Test Types 116Rules of Engagement 118Reconnaissance 119Running the Test 120Cleaning Up 120Training and Exercises 120Summary 122Exam Essentials 122Review Questions 124Chapter 6 Secure Coding 129Software Assurance Best Practices 130The Software Development Life Cycle 130Software Development Phases 131Software Development Models 133DevSecOps and DevOps 136Designing and Coding for Security 138Secure Coding Practices 138API Security 139Code Review Models 139Software Security Testing 143Analyzing and Testing Code 143Injection Vulnerabilities 144SQL Injection Attacks 145Code Injection Attacks 148Command Injection Attacks 149Exploiting Authentication Vulnerabilities 150Password Authentication 150Session Attacks 151Exploiting Authorization Vulnerabilities 154Insecure Direct Object References 154Directory Traversal 155File Inclusion 156Privilege Escalation 157Exploiting Web Application Vulnerabilities 157Cross-Site Scripting (XSS) 158Request Forgery 160Application Security Controls 161Input Validation 162Web Application Firewalls 163Database Security 163Code Security 166Secure Coding Practices 168Source Code Comments 168Error Handling 168Hard-Coded Credentials 170Memory Management 170Race Conditions 171Unprotected APIs 172Driver Manipulation 172Summary 173Exam Essentials 173Review Questions 175Chapter 7 Cryptography and the Public Key Infrastructure 179An Overview of Cryptography 180Historical Cryptography 181Goals of Cryptography 186Confidentiality 187Integrity 188Authentication 188Nonrepudiation 189Cryptographic Concepts 189Cryptographic Keys 189Ciphers 190Modern Cryptography 191Cryptographic Secrecy 191Symmetric Key Algorithms 192Asymmetric Key Algorithms 193Hashing Algorithms 196Symmetric Cryptography 197Data Encryption Standard 197Triple DES 199Advanced Encryption Standard 200Symmetric Key Management 200Asymmetric Cryptography 203RSA 203Elliptic Curve 204Hash Functions 205SHA 206MD5 207Digital Signatures 207HMAC 208Digital Signature Standard 209Public Key Infrastructure 209Certificates 209Certificate Authorities 211Certificate Generation and Destruction 212Certificate Formats 215Asymmetric Key Management 216Cryptographic Attacks 217Emerging Issues in Cryptography 220Tor and the Dark Web 220Blockchain 220Lightweight Cryptography 221Homomorphic Encryption 221Quantum Computing 222Summary 222Exam Essentials 222Review Questions 224Chapter 8 Identity and Access Management 229Identity 230Authentication and Authorization 231Authentication and Authorization Technologies 232Directory Services 236Authentication Methods 237Multifactor Authentication 237One-Time Passwords 239Biometrics 241Knowledge-Based Authentication 243Managing Authentication 244Accounts 245Account Types 245Account Policies and Controls 245Access Control Schemes 248Filesystem Permissions 249Summary 251Exam Essentials 252Review Questions 253Chapter 9 Resilience and Physical Security 257Building Cybersecurity Resilience 258Storage Resiliency: Backups and Replication 260Response and Recovery Controls 266Physical Security Controls 269Site Security 269Summary 278Exam Essentials 279Review Questions 281Chapter 10 Cloud and Virtualization Security 285Exploring the Cloud 286Benefits of the Cloud 287Cloud Roles 289Cloud Service Models 289Cloud Deployment Models 293Shared Responsibility Model 295Cloud Standards and Guidelines 298Virtualization 300Hypervisors 300Cloud Infrastructure Components 302Cloud Compute Resources 302Cloud Storage Resources 304Cloud Networking 307Cloud Security Issues 311Availability 311Data Sovereignty 311Virtualization Security 312Application Security 312Governance and Auditing 313Cloud Security Controls 313Cloud Access Security Brokers 314Resource Policies 314Secrets Management 316Summary 316Exam Essentials 316Review Questions 318Chapter 11 Endpoint Security 323Protecting Endpoints 324Preserving Boot Integrity 325Endpoint Security Tools 326Hardening Endpoints and Systems 332Service Hardening 333Operating System Hardening 335Hardening the Windows Registry 336Configuration, Standards, and Schemas 336Disk Security and Sanitization 338File Manipulation and Other Useful Command-Line Tools 341Scripting, Secure Transport, and Shells 343Securing Embedded and Specialized Systems 344Embedded Systems 345SCADA and ICS 346Securing the Internet of Things 348Specialized Systems 349Communication Considerations 350Security Constraints of Embedded Systems 351Summary 352Exam Essentials 354Review Questions 356Chapter 12 Network Security 361Designing Secure Networks 363Network Segmentation 365Network Access Control 366Port Security and Port-Level Protections 367Port Spanning/Port Mirroring 369Virtual Private Network 370Network Appliances and Security Tools 371Network Security, Services, and Management 377Deception and Disruption 382Secure Protocols 383Using Secure Protocols 383Secure Protocols 384Attacking and Assessing Networks 389On-Path Attacks 389Domain Name System Attacks 391Layer 2 Attacks 393Distributed Denial-of-Service Attacks 394Network Reconnaissance and Discovery Tools and Techniques 398Summary 411Exam Essentials 412Review Questions 414Chapter 13 Wireless and Mobile Security 419Building Secure Wireless Networks 420Connectivity Methods 421Wireless Network Models 425Attacks Against Wireless Networks 426Designing a Network 430Controller and Access Point Security 432Wi-Fi Security Standards 433Wireless Authentication 434Managing Secure Mobile Devices 436Mobile Device Deployment Methods 436Mobile Device Management 438Specialized Mobile Device Security Tools 442Summary 442Exam Essentials 443Review Questions 445Chapter 14 Incident Response 449Incident Response 450The Incident Response Process 451Attack Frameworks and Identifying Attacks 457Incident Response Data and Tools 461Security Information and Event Management Systems 462Alerts and Alarms 464Correlation and Analysis 465Rules 465Mitigation and Recovery 473Summary 477Exam Essentials 478Review Questions 480Chapter 15 Digital Forensics 485Digital Forensic Concepts 486Legal Holds and e-Discovery 487Conducting Digital Forensics 488Acquiring Forensic Data 489Acquisition Tools 493Validating Forensic Data Integrity 496Data Recovery 499Forensic Suites and a Forensic Case Example 499Reporting 504Digital Forensics and Intelligence 504Summary 505Exam Essentials 505Review Questions 507Chapter 16 Security Policies, Standards, and Compliance 511Understanding Policy Documents 512Policies 512Standards 515Procedures 517Guidelines 518Exceptions and Compensating Controls 519Personnel Management 520Least Privilege 520Separation of Duties 521Job Rotation and Mandatory Vacations 521Clean Desk Space 522Onboarding and Offboarding 522Nondisclosure Agreements 522Social Media 522User Training 522Third-Party Risk Management 523Winding Down Vendor Relationships 524Complying with Laws and Regulations 524Adopting Standard Frameworks 525NIST Cybersecurity Framework 525NIST Risk Management Framework 528ISO Standards 529Benchmarks and Secure Configuration Guides 531Security Control Verification and Quality Control 531Summary 533Exam Essentials 534Review Questions 535Chapter 17 Risk Management and Privacy 539Analyzing Risk 540Risk Identification 541Risk Calculation 542Risk Assessment 543Managing Risk 547Risk Mitigation 547Risk Avoidance 549Risk Transference 549Risk Acceptance 549Risk Analysis 550Disaster Recovery Planning 552Disaster Types 552Business Impact Analysis 553Privacy 553Sensitive Information Inventory 554Information Classification 554Data Roles and Responsibilities 556Information Lifecycle 557Privacy Enhancing Technologies 557Privacy and Data Breach Notification 558Summary 559Exam Essentials 559Review Questions 560Appendix Answers to Review Questions 565Chapter 1: Today's Security Professional 566Chapter 2: Cybersecurity Threat Landscape 567Chapter 3: Malicious Code 569Chapter 4: Social Engineering, Physical, and Password Attacks 572Chapter 5: Security Assessment and Testing 574Chapter 6: Secure Coding 576Chapter 7: Cryptography and the Public Key Infrastructure 578Chapter 8: Identity and Access Management 579Chapter 9: Resilience and Physical Security 582Chapter 10: Cloud and Virtualization Security 584Chapter 11: Endpoint Security 586Chapter 12: Network Security 589Chapter 13: Wireless and Mobile Security 591Chapter 14: Incident Response 594Chapter 15: Digital Forensics 596Chapter 16: Security Policies, Standards, and Compliance 598Chapter 17: Risk Management and Privacy 600Index 603

O autorze

ABOUT THE AUTHORSMike Chapple, PhD, Security+, CySA+, CISSP, is Teaching Professor of IT, Analytics, and Operations at the University of Notre Dame. He's a cybersecurity professional and educator with over 20 years of experience. Mike provides cybersecurity certification resources at his website, CertMike.com.David Seidl, Security+, CySA+, CISSP, PenTest+, is Vice President for Information Technology and CIO at Miami University. David co-led Notre Dame's move to the cloud and has written multiple cybersecurity certification books.