| Introduction |
|
xliv | |
|
Part I Threats, Attacks, and Vulnerabilities |
|
|
|
Chapter 1 Comparing and Contrasting Different Types of Social Engineering Techniques |
|
|
3 | (26) |
|
"Do I Know This Already?" Quiz |
|
|
3 | (4) |
|
|
|
7 | (1) |
|
Social Engineering Fundamentals |
|
|
7 | (2) |
|
Phishing and Spear Phishing |
|
|
9 | (3) |
|
|
|
12 | (1) |
|
|
|
12 | (1) |
|
Spam and Spam over Internet Messaging (SPIM) |
|
|
13 | (1) |
|
|
|
13 | (1) |
|
|
|
14 | (1) |
|
|
|
14 | (1) |
|
Piggybacking or Tailgating |
|
|
15 | (1) |
|
|
|
15 | (1) |
|
|
|
16 | (1) |
|
|
|
17 | (1) |
|
|
|
17 | (1) |
|
|
|
17 | (1) |
|
|
|
18 | (1) |
|
|
|
18 | (1) |
|
|
|
19 | (1) |
|
Impersonation or Pretexting |
|
|
19 | (1) |
|
|
|
19 | (1) |
|
|
|
20 | (1) |
|
|
|
20 | (1) |
|
|
|
20 | (1) |
|
Influence Campaigns, Principles of Social Engineering, and Reasons for Effectiveness |
|
|
21 | (1) |
|
User Security Awareness Education |
|
|
22 | (2) |
|
Chapter Review Activities |
|
|
24 | (1) |
|
|
|
24 | (1) |
|
|
|
25 | (1) |
|
|
|
26 | (3) |
|
Chapter 2 Analyzing Potential Indicators to Determine the Type of Attack |
|
|
29 | (32) |
|
"Do I Know This Already?" Quiz |
|
|
29 | (4) |
|
|
|
33 | (1) |
|
Malicious Software (Malware) |
|
|
33 | (1) |
|
Ransomware and Cryptomalware |
|
|
33 | (2) |
|
|
|
35 | (1) |
|
Remote Access Trojans (RATs) and Rootkits |
|
|
35 | (1) |
|
|
|
36 | (1) |
|
|
|
37 | (1) |
|
Command and Control, Bots, and Botnets |
|
|
37 | (2) |
|
|
|
39 | (1) |
|
Potentially Unwanted Programs (PUPs) and Spyware |
|
|
40 | (2) |
|
|
|
42 | (1) |
|
|
|
43 | (1) |
|
Malware Delivery Mechanisms |
|
|
43 | (2) |
|
You Can't Save Every Computer from Malware! |
|
|
45 | (1) |
|
|
|
45 | (1) |
|
Dictionary-based and Brute-force Attacks |
|
|
45 | (1) |
|
|
|
46 | (1) |
|
Offline and Online Password Cracking |
|
|
46 | (1) |
|
|
|
47 | (1) |
|
|
|
47 | (1) |
|
|
|
48 | (1) |
|
|
|
48 | (1) |
|
Malicious Universal Serial Bus (USB) Cables |
|
|
48 | (1) |
|
|
|
48 | (1) |
|
|
|
49 | (1) |
|
Adversarial Artificial Intelligence |
|
|
50 | (1) |
|
Tainted Training Data for Machine Learning |
|
|
50 | (1) |
|
Security of Machine Learning Algorithms |
|
|
50 | (1) |
|
|
|
51 | (1) |
|
Cloud-based vs. On-premises Attacks |
|
|
52 | (1) |
|
|
|
52 | (2) |
|
|
|
54 | (1) |
|
|
|
55 | (1) |
|
|
|
55 | (1) |
|
|
|
56 | (1) |
|
|
|
56 | (1) |
|
Chapter Review Activities |
|
|
57 | (1) |
|
|
|
57 | (1) |
|
|
|
58 | (1) |
|
|
|
59 | (2) |
|
Chapter 3 Analyzing Potential Indicators Associated with Application Attacks |
|
|
61 | (110) |
|
"Do I Know This Already?" Quiz |
|
|
61 | (6) |
|
|
|
67 | (1) |
|
|
|
67 | (1) |
|
Cross-Site Scripting (XSS) Attacks |
|
|
68 | (2) |
|
|
|
70 | (1) |
|
Structured Query Language (SQL) Injection Attacks |
|
|
70 | (3) |
|
|
|
73 | (1) |
|
Dynamic Link Library (DLL) Injection Attacks |
|
|
74 | (1) |
|
Lightweight Directory Access Protocol (LDAP) Injection Attacks |
|
|
74 | (1) |
|
Extensible Markup Language (XML) Injection Attacks |
|
|
74 | (1) |
|
Pointer/Object Dereference |
|
|
75 | (1) |
|
|
|
76 | (1) |
|
|
|
77 | (1) |
|
Arbitrary Code Execution/Remote Code Execution |
|
|
78 | (1) |
|
|
|
79 | (1) |
|
|
|
79 | (65) |
|
|
|
144 | (1) |
|
|
|
144 | (1) |
|
|
|
145 | (1) |
|
|
|
146 | (1) |
|
|
|
147 | (2) |
|
|
|
149 | (1) |
|
|
|
150 | (5) |
|
|
|
155 | (5) |
|
Improper or Weak Patch Management |
|
|
160 | (1) |
|
|
|
161 | (2) |
|
|
|
163 | (2) |
|
|
|
165 | (1) |
|
The Impact of Cybersecurity Attacks and Breaches |
|
|
165 | (1) |
|
Chapter Review Activities |
|
|
166 | (1) |
|
|
|
166 | (1) |
|
|
|
167 | (1) |
|
|
|
168 | (3) |
|
Chapter 7 Summarizing the Techniques Used in Security Assessments |
|
|
171 | (22) |
|
"Do I Know This Already?" Quiz |
|
|
171 | (4) |
|
|
|
175 | (1) |
|
|
|
175 | (2) |
|
Security Advisories and Bulletin |
|
|
177 | (3) |
|
|
|
180 | (2) |
|
Credentialed vs. Noncredentia |
|
|
182 | (1) |
|
Intrusive vs. Nonintrusive |
|
|
182 | (1) |
|
Common Vulnerability Scoring System (CVSS) |
|
|
182 | (4) |
|
Logs and Security Information and Event Management (SIEM) |
|
|
186 | (2) |
|
Security Orchestration, Automation, and Response (SOAR) |
|
|
188 | (1) |
|
Chapter Review Activities |
|
|
189 | (1) |
|
|
|
189 | (1) |
|
|
|
190 | (1) |
|
|
|
190 | (3) |
|
Chapter 8 Understanding the Techniques Used in Penetration Testing |
|
|
193 | (16) |
|
"Do I Know This Already?" Quiz |
|
|
193 | (4) |
|
|
|
197 | (1) |
|
|
|
197 | (5) |
|
Bug Bounties vs. Penetration Testing |
|
|
202 | (1) |
|
Passive and Active Reconnaissance |
|
|
203 | (2) |
|
|
|
205 | (1) |
|
Chapter Review Activities |
|
|
206 | (1) |
|
|
|
206 | (1) |
|
|
|
207 | (1) |
|
|
|
207 | (2) |
|
Part II Architecture and Design |
|
|
|
Chapter 9 Understanding the Importance of Security Concepts in an Enterprise Environment |
|
|
209 | (18) |
|
"Do I Know This Already?" Quiz |
|
|
209 | (4) |
|
|
|
213 | (1) |
|
|
|
213 | (1) |
|
Data Sovereignty and Data Protection |
|
|
214 | (1) |
|
Secure Sockets Layer (SSL)/Transport Layer Security (TLS) Inspection |
|
|
215 | (1) |
|
|
|
216 | (1) |
|
Data Masking and Obfuscation |
|
|
216 | (2) |
|
Encryption at Rest, in Transit/Motion, and in Processing |
|
|
218 | (1) |
|
|
|
218 | (1) |
|
|
|
219 | (1) |
|
Geographical Considerations |
|
|
220 | (1) |
|
Data Breach Response and Recovery Controls |
|
|
220 | (1) |
|
|
|
221 | (1) |
|
|
|
222 | (1) |
|
|
|
223 | (1) |
|
|
|
223 | (1) |
|
Chapter Review Activities |
|
|
224 | (1) |
|
|
|
224 | (1) |
|
|
|
225 | (1) |
|
|
|
225 | (2) |
|
Chapter 10 Summarizing Visualization and Cloud Computing Concepts |
|
|
227 | (26) |
|
"Do I Know This Already?" Quiz |
|
|
227 | (4) |
|
|
|
231 | (1) |
|
|
|
231 | (1) |
|
Public, Private, Hybrid, and Community Clouds |
|
|
232 | (1) |
|
|
|
233 | (1) |
|
Cloud Architecture Components |
|
|
234 | (1) |
|
|
|
234 | (1) |
|
|
|
235 | (1) |
|
|
|
236 | (4) |
|
|
|
240 | (1) |
|
|
|
241 | (2) |
|
|
|
243 | (3) |
|
|
|
246 | (1) |
|
|
|
246 | (1) |
|
|
|
246 | (1) |
|
Virtual Machine (VM) Sprawl Avoidance and VM Escape Protection |
|
|
247 | (1) |
|
Understanding and Avoiding VM Sprawl |
|
|
247 | (1) |
|
Protecting Against VM Escape Attacks |
|
|
248 | (2) |
|
Chapter Review Activities |
|
|
250 | (1) |
|
|
|
250 | (1) |
|
|
|
251 | (1) |
|
|
|
251 | (2) |
|
Chapter 11 Summarizing Secure Application Development, Deployment, and Automation Concepts |
|
|
253 | (32) |
|
"Do I Know This Already?" Quiz |
|
|
253 | (4) |
|
|
|
257 | (1) |
|
Software Development Environments and Methodologies |
|
|
257 | (3) |
|
Application Provisioning and Deprovisioning |
|
|
260 | (1) |
|
Software Integrity Measurement |
|
|
261 | (1) |
|
|
|
261 | (2) |
|
Core SDLC and DevOps Principles |
|
|
263 | (3) |
|
Programming Testing Methods |
|
|
266 | (1) |
|
Compile-Time Errors vs. Runtime Errors |
|
|
266 | (1) |
|
|
|
267 | (2) |
|
Static and Dynamic Code Analysis |
|
|
269 | (1) |
|
|
|
269 | (1) |
|
Programming Vulnerabilities and Attacks |
|
|
270 | (1) |
|
|
|
271 | (1) |
|
Memory/Buffer Vulnerabilities |
|
|
271 | (1) |
|
|
|
272 | (1) |
|
More Code Injection Examples |
|
|
273 | (1) |
|
|
|
274 | (1) |
|
|
|
275 | (1) |
|
Open Web Application Security Project (OWASP) |
|
|
276 | (2) |
|
|
|
278 | (1) |
|
|
|
278 | (1) |
|
Elasticity and Scalability |
|
|
279 | (1) |
|
Chapter Review Activities |
|
|
280 | (1) |
|
|
|
280 | (1) |
|
|
|
281 | (1) |
|
|
|
281 | (4) |
|
Chapter 12 Summarizing Authentication and Authorization Design Concepts |
|
|
285 | (26) |
|
"Do I Know This Already?" Quiz |
|
|
285 | (4) |
|
|
|
289 | (1) |
|
|
|
289 | (2) |
|
|
|
291 | (1) |
|
|
|
292 | (2) |
|
|
|
294 | (1) |
|
Authentication Methods and Technologies |
|
|
295 | (1) |
|
Time-Based One-Time Password (TOTP) |
|
|
295 | (1) |
|
HMAC-Based One-Time Password (HOTP) |
|
|
295 | (1) |
|
Short Message Service (SMS) |
|
|
296 | (1) |
|
|
|
297 | (1) |
|
|
|
298 | (1) |
|
Authentication Applications |
|
|
298 | (1) |
|
|
|
299 | (1) |
|
Phone Call Authentication |
|
|
299 | (1) |
|
Smart Card Authentication |
|
|
300 | (1) |
|
|
|
300 | (1) |
|
|
|
300 | (1) |
|
|
|
301 | (1) |
|
|
|
301 | (1) |
|
|
|
301 | (1) |
|
|
|
302 | (1) |
|
|
|
302 | (1) |
|
|
|
302 | (1) |
|
|
|
302 | (1) |
|
|
|
303 | (1) |
|
|
|
303 | (1) |
|
|
|
304 | (1) |
|
Multifactor Authentication (MFA) Factors and Attributes |
|
|
304 | (2) |
|
Authentication, Authorization, and Accounting (AAA) |
|
|
306 | (1) |
|
Cloud vs. On-premises Requirements |
|
|
306 | (2) |
|
Chapter Review Activities |
|
|
308 | (1) |
|
|
|
308 | (1) |
|
|
|
308 | (1) |
|
|
|
308 | (3) |
|
Chapter 13 Implementing Cybersecurity Resilience |
|
|
311 | (24) |
|
"Do I Know This Already?" Quiz |
|
|
311 | (4) |
|
|
|
315 | (1) |
|
|
|
315 | (1) |
|
|
|
315 | (1) |
|
|
|
315 | (1) |
|
Redundant Array of Inexpensive Disks |
|
|
316 | (3) |
|
|
|
319 | (1) |
|
|
|
319 | (1) |
|
|
|
319 | (1) |
|
Network Interface Card (NIC) Teaming |
|
|
320 | (1) |
|
|
|
320 | (1) |
|
Uninterruptible Power Supply (UPS) |
|
|
320 | (1) |
|
|
|
321 | (1) |
|
|
|
321 | (1) |
|
Managed Power Distribution Units (PDUs) |
|
|
322 | (1) |
|
|
|
323 | (1) |
|
|
|
323 | (1) |
|
|
|
324 | (1) |
|
|
|
325 | (1) |
|
|
|
326 | (2) |
|
|
|
328 | (1) |
|
|
|
328 | (1) |
|
|
|
328 | (1) |
|
|
|
328 | (1) |
|
|
|
329 | (1) |
|
|
|
330 | (1) |
|
|
|
331 | (1) |
|
|
|
331 | (1) |
|
|
|
331 | (1) |
|
|
|
331 | (1) |
|
|
|
332 | (1) |
|
Chapter Review Activities |
|
|
332 | (1) |
|
|
|
332 | (1) |
|
|
|
333 | (1) |
|
|
|
333 | (2) |
|
Chapter 14 Understanding the Security Implications of Embedded and Specialized Systems |
|
|
335 | (32) |
|
"Do I Know This Already?" Quiz |
|
|
335 | (4) |
|
|
|
339 | (1) |
|
|
|
339 | (2) |
|
Supervisory Control and Data Acquisition (SCADA)/Industrial Control Systems (ICS) |
|
|
341 | (3) |
|
|
|
344 | (2) |
|
|
|
346 | (1) |
|
|
|
347 | (1) |
|
|
|
347 | (1) |
|
|
|
348 | (2) |
|
|
|
350 | (1) |
|
|
|
351 | (1) |
|
Heating, Ventilation, and Air Conditioning (HVAC) |
|
|
352 | (1) |
|
|
|
353 | (1) |
|
Multifunction Printers (MFP) |
|
|
354 | (1) |
|
Real-Time Operating Systems (RTOS) |
|
|
355 | (1) |
|
|
|
355 | (1) |
|
|
|
356 | (1) |
|
Communication Considerations |
|
|
357 | (1) |
|
|
|
357 | (1) |
|
|
|
358 | (1) |
|
|
|
359 | (1) |
|
Subscriber Identity Module (SIM) Cards |
|
|
360 | (1) |
|
|
|
360 | (1) |
|
Embedded System Constraints |
|
|
361 | (1) |
|
|
|
361 | (1) |
|
|
|
361 | (1) |
|
|
|
362 | (1) |
|
|
|
362 | (1) |
|
|
|
362 | (1) |
|
|
|
363 | (1) |
|
|
|
363 | (1) |
|
|
|
363 | (1) |
|
|
|
363 | (1) |
|
Chapter Review Activities |
|
|
364 | (1) |
|
|
|
364 | (1) |
|
|
|
365 | (1) |
|
|
|
365 | (2) |
|
Chapter 15 Understanding the Importance of Physical Security Controls |
|
|
367 | (24) |
|
"Do I Know This Already?" Quiz |
|
|
367 | (3) |
|
|
|
370 | (1) |
|
|
|
370 | (2) |
|
Access Control Vestibules |
|
|
372 | (1) |
|
|
|
373 | (1) |
|
|
|
374 | (1) |
|
|
|
374 | (1) |
|
|
|
375 | (1) |
|
Closed-Circuit Television (CCTV) |
|
|
376 | (1) |
|
|
|
377 | (1) |
|
|
|
377 | (1) |
|
|
|
378 | (1) |
|
|
|
379 | (1) |
|
|
|
380 | (1) |
|
|
|
380 | (1) |
|
|
|
381 | (1) |
|
|
|
381 | (1) |
|
|
|
382 | (1) |
|
|
|
383 | (1) |
|
|
|
383 | (1) |
|
|
|
384 | (1) |
|
Screened Subnet (Previously Known as Demilitarized Zone [ DMZ]) |
|
|
384 | (1) |
|
Protected Cable Distribution |
|
|
385 | (1) |
|
|
|
385 | (1) |
|
|
|
386 | (1) |
|
Chapter Review Activities |
|
|
387 | (1) |
|
|
|
387 | (1) |
|
|
|
388 | (1) |
|
|
|
389 | (2) |
|
Chapter 16 Summarizing the Basics of Cryptographic Concepts |
|
|
391 | (32) |
|
"Do I Know This Already?" Quiz |
|
|
391 | (4) |
|
|
|
395 | (1) |
|
|
|
395 | (1) |
|
|
|
396 | (1) |
|
|
|
397 | (1) |
|
|
|
397 | (1) |
|
|
|
398 | (1) |
|
|
|
399 | (1) |
|
Elliptic-Curve Cryptography |
|
|
399 | (1) |
|
|
|
400 | (1) |
|
|
|
401 | (1) |
|
|
|
401 | (1) |
|
|
|
402 | (1) |
|
|
|
402 | (1) |
|
|
|
403 | (1) |
|
|
|
403 | (1) |
|
Electronic Code Book Mode |
|
|
404 | (1) |
|
Cipher Block Chaining Mode |
|
|
405 | (1) |
|
|
|
406 | (1) |
|
|
|
407 | (1) |
|
|
|
408 | (1) |
|
|
|
409 | (1) |
|
|
|
410 | (1) |
|
Symmetric vs. Asymmetric Encryption |
|
|
411 | (3) |
|
|
|
414 | (1) |
|
|
|
415 | (1) |
|
|
|
415 | (1) |
|
|
|
416 | (1) |
|
|
|
416 | (1) |
|
|
|
417 | (1) |
|
|
|
417 | (1) |
|
|
|
418 | (2) |
|
Chapter Review Activities |
|
|
420 | (1) |
|
|
|
420 | (1) |
|
|
|
421 | (1) |
|
|
|
421 | (2) |
|
|
|
|
Chapter 17 Implementing Secure Protocols |
|
|
423 | (24) |
|
"Do I Know This Already?" Quiz |
|
|
423 | (3) |
|
|
|
426 | (1) |
|
|
|
426 | (1) |
|
Domain Name System Security Extensions |
|
|
426 | (1) |
|
|
|
427 | (1) |
|
Secure/Multipurpose Internet Mail Extensions |
|
|
428 | (2) |
|
Secure Real-Time Transport Protocol |
|
|
430 | (2) |
|
Lightweight Directory Access Protocol over SSL |
|
|
432 | (1) |
|
File Transfer Protocol, Secure |
|
|
432 | (2) |
|
Secure (or SSH) File Transfer Protocol |
|
|
434 | (1) |
|
Simple Network Management Protocol Version 3 |
|
|
434 | (2) |
|
Hypertext Transfer Protocol over SSL/TLS |
|
|
436 | (1) |
|
|
|
437 | (1) |
|
Authentication Header/Encapsulating Security Payloads |
|
|
437 | (1) |
|
|
|
438 | (1) |
|
Post Office Protocol/Internet Message Access Protocol |
|
|
438 | (1) |
|
|
|
439 | (1) |
|
|
|
440 | (1) |
|
|
|
440 | (1) |
|
|
|
441 | (1) |
|
|
|
441 | (1) |
|
|
|
442 | (1) |
|
|
|
442 | (1) |
|
|
|
442 | (1) |
|
|
|
443 | (1) |
|
Network Address Allocation |
|
|
443 | (1) |
|
|
|
444 | (1) |
|
Chapter Review Activities |
|
|
444 | (1) |
|
|
|
444 | (1) |
|
|
|
445 | (1) |
|
|
|
445 | (2) |
|
Chapter 18 Implementing Host or Application Security Solutions |
|
|
447 | (36) |
|
"Do I Know This Already?" Quiz |
|
|
447 | (4) |
|
|
|
451 | (1) |
|
|
|
451 | (1) |
|
|
|
451 | (1) |
|
|
|
452 | (1) |
|
Endpoint Detection and Response |
|
|
452 | (1) |
|
|
|
453 | (1) |
|
|
|
453 | (1) |
|
Host-based Intrusion Prevention System |
|
|
454 | (2) |
|
Host-based Intrusion Detection System |
|
|
456 | (1) |
|
|
|
457 | (1) |
|
|
|
458 | (1) |
|
Boot Security/Unified Extensible Firmware Interface |
|
|
459 | (1) |
|
|
|
459 | (1) |
|
|
|
460 | (1) |
|
|
|
461 | (1) |
|
|
|
461 | (1) |
|
|
|
462 | (1) |
|
|
|
463 | (1) |
|
|
|
463 | (1) |
|
|
|
464 | (1) |
|
|
|
465 | (1) |
|
Hypertext Transfer Protocol Headers |
|
|
465 | (1) |
|
|
|
466 | (1) |
|
|
|
466 | (1) |
|
|
|
466 | (1) |
|
|
|
467 | (1) |
|
|
|
467 | (1) |
|
|
|
468 | (1) |
|
|
|
468 | (2) |
|
|
|
470 | (1) |
|
|
|
470 | (1) |
|
|
|
471 | (1) |
|
|
|
471 | (1) |
|
|
|
471 | (1) |
|
|
|
472 | (1) |
|
|
|
473 | (1) |
|
|
|
473 | (1) |
|
|
|
474 | (1) |
|
Self-Encrypting Drive/Full-Disk Encryption |
|
|
475 | (1) |
|
|
|
476 | (1) |
|
|
|
476 | (1) |
|
|
|
477 | (1) |
|
|
|
478 | (1) |
|
Chapter Review Activities |
|
|
479 | (1) |
|
|
|
479 | (2) |
|
|
|
481 | (1) |
|
|
|
481 | (2) |
|
Chapter 19 Implementing Secure Network Designs |
|
|
483 | (64) |
|
"Do I Know This Already?" Quiz |
|
|
483 | (5) |
|
|
|
488 | (1) |
|
|
|
488 | (1) |
|
|
|
488 | (1) |
|
|
|
488 | (1) |
|
|
|
488 | (1) |
|
|
|
488 | (1) |
|
|
|
489 | (1) |
|
|
|
489 | (1) |
|
Application-Based Segmentation and Microsegmentation |
|
|
489 | (1) |
|
Virtual Local Area Network |
|
|
490 | (1) |
|
|
|
491 | (1) |
|
|
|
492 | (1) |
|
|
|
492 | (2) |
|
|
|
494 | (1) |
|
|
|
494 | (2) |
|
Remote Access vs. Site-to-Site |
|
|
496 | (1) |
|
|
|
497 | (1) |
|
|
|
498 | (3) |
|
|
|
501 | (3) |
|
|
|
504 | (1) |
|
|
|
505 | (3) |
|
|
|
508 | (1) |
|
Layer 2 Tunneling Protocol |
|
|
508 | (1) |
|
|
|
509 | (1) |
|
|
|
510 | (1) |
|
|
|
510 | (1) |
|
|
|
511 | (1) |
|
Broadcast Storm Prevention |
|
|
512 | (1) |
|
Bridge Protocol Data Unit Guard |
|
|
512 | (1) |
|
|
|
512 | (1) |
|
Dynamic Host Configuration Protocol Snooping |
|
|
512 | (1) |
|
Media Access Control Filtering |
|
|
513 | (1) |
|
|
|
513 | (1) |
|
|
|
514 | (1) |
|
|
|
514 | (2) |
|
Network-Based Intrusion Detection System/Network-Based Intrusion Prevention System |
|
|
516 | (1) |
|
|
|
517 | (1) |
|
|
|
518 | (1) |
|
|
|
519 | (1) |
|
|
|
520 | (1) |
|
|
|
521 | (1) |
|
|
|
521 | (2) |
|
|
|
523 | (1) |
|
|
|
524 | (1) |
|
|
|
524 | (1) |
|
|
|
525 | (1) |
|
|
|
526 | (1) |
|
|
|
526 | (8) |
|
|
|
534 | (1) |
|
Appliance vs. Host-based vs. Virtual |
|
|
534 | (1) |
|
|
|
535 | (1) |
|
|
|
535 | (1) |
|
|
|
536 | (1) |
|
|
|
536 | (1) |
|
Port Spanning/Port Mirroring |
|
|
537 | (1) |
|
|
|
538 | (1) |
|
|
|
539 | (3) |
|
|
|
542 | (1) |
|
Chapter Review Activities |
|
|
542 | (1) |
|
|
|
542 | (1) |
|
|
|
543 | (1) |
|
|
|
544 | (3) |
|
Chapter 20 Installing and Configuring Wireless Security Settings |
|
|
547 | (20) |
|
"Do I Know This Already?" Quiz |
|
|
547 | (4) |
|
|
|
551 | (1) |
|
|
|
551 | (1) |
|
Wi-Fi Protected Access 2 (WPA2) |
|
|
551 | (1) |
|
Wi-Fi Protected Access 3 (WPA3) |
|
|
551 | (1) |
|
Counter-mode/CBC-MAC Protocol (CCMP) |
|
|
552 | (1) |
|
Simultaneous Authentication of Equals |
|
|
552 | (1) |
|
Wireless Cryptographic Protocol Summary |
|
|
552 | (1) |
|
|
|
553 | (1) |
|
|
|
553 | (3) |
|
|
|
556 | (1) |
|
Remote Authentication Dial-In User Service (RADIUS) Federation |
|
|
556 | (1) |
|
|
|
557 | (1) |
|
|
|
558 | (1) |
|
|
|
559 | (1) |
|
Installation Considerations |
|
|
559 | (3) |
|
Controller and Access Point Security |
|
|
562 | (1) |
|
Wireless Access Point Vulnerabilities |
|
|
563 | (1) |
|
Chapter Review Activities |
|
|
564 | (1) |
|
|
|
564 | (1) |
|
|
|
564 | (1) |
|
|
|
565 | (2) |
|
Chapter 21 Implementing Secure Mobile Solutions |
|
|
567 | (28) |
|
"Do I Know This Already?" Quiz |
|
|
567 | (3) |
|
|
|
570 | (1) |
|
Connection Methods and Receivers |
|
|
570 | (1) |
|
|
|
571 | (1) |
|
More Wireless Connection Methods and Receivers |
|
|
572 | (1) |
|
Secure Implementation Best Practices |
|
|
573 | (1) |
|
|
|
574 | (2) |
|
MDM Security Feature Concerns: Application and Content Management |
|
|
576 | (2) |
|
MDM Security Feature Concerns: Remote Wipe, Geofencing, Geolocation, Screen Locks, Passwords and PINs, Full Device Encryption |
|
|
578 | (3) |
|
Mobile Device Management Enforcement and Monitoring |
|
|
581 | (4) |
|
|
|
585 | (2) |
|
MDM/Unified Endpoint Management |
|
|
587 | (1) |
|
|
|
588 | (1) |
|
|
|
588 | (1) |
|
Secure Implementation of BYOD, CYOD, and COPE |
|
|
589 | (2) |
|
Chapter Review Activities |
|
|
591 | (1) |
|
|
|
591 | (1) |
|
|
|
592 | (1) |
|
|
|
592 | (3) |
|
Chapter 22 Applying Cybersecurity Solutions to the Cloud |
|
|
595 | (24) |
|
"Do I Know This Already?" Quiz |
|
|
595 | (3) |
|
|
|
598 | (1) |
|
|
|
598 | (1) |
|
Security Assessment in the Cloud |
|
|
598 | (1) |
|
Understanding the Different Cloud Security Threats |
|
|
598 | (3) |
|
|
|
601 | (2) |
|
High Availability Across Zones |
|
|
603 | (1) |
|
|
|
603 | (1) |
|
|
|
604 | (1) |
|
|
|
604 | (1) |
|
|
|
605 | (1) |
|
|
|
605 | (1) |
|
|
|
605 | (1) |
|
|
|
605 | (1) |
|
|
|
606 | (1) |
|
|
|
606 | (1) |
|
|
|
606 | (1) |
|
Public and Private Subnets |
|
|
606 | (1) |
|
|
|
607 | (1) |
|
API Inspection and Integration |
|
|
607 | (1) |
|
|
|
607 | (1) |
|
|
|
607 | (1) |
|
Dynamic Resource Allocation |
|
|
607 | (1) |
|
|
|
608 | (1) |
|
Virtual Private Cloud Endpoint |
|
|
608 | (1) |
|
|
|
608 | (1) |
|
Summary of Cloud Security Controls |
|
|
609 | (2) |
|
|
|
611 | (1) |
|
|
|
611 | (1) |
|
|
|
612 | (1) |
|
Next-Generation Secure Web Gateway |
|
|
613 | (1) |
|
Firewall Considerations in a Cloud Environment |
|
|
613 | (1) |
|
|
|
613 | (1) |
|
|
|
613 | (1) |
|
Open Systems Interconnection Layers |
|
|
614 | (1) |
|
Summary of Cybersecurity Solutions to the Cloud |
|
|
614 | (1) |
|
Cloud Native Controls vs. Third-Party Solutions |
|
|
615 | (1) |
|
Chapter Review Activities |
|
|
615 | (1) |
|
|
|
615 | (1) |
|
|
|
616 | (1) |
|
|
|
616 | (3) |
|
Chapter 23 Implementing Identity and Account Management Controls |
|
|
619 | (32) |
|
"Do I Know This Already?" Quiz |
|
|
619 | (4) |
|
|
|
623 | (1) |
|
|
|
623 | (1) |
|
|
|
623 | (2) |
|
|
|
625 | (1) |
|
Authentication by Knowledge |
|
|
625 | (1) |
|
Authentication by Ownership |
|
|
625 | (1) |
|
Authentication by Characteristic Attributes |
|
|
625 | (1) |
|
|
|
626 | (1) |
|
|
|
627 | (1) |
|
|
|
628 | (1) |
|
|
|
629 | (1) |
|
|
|
629 | (4) |
|
|
|
633 | (1) |
|
Introduction to Identity and Access Management |
|
|
633 | (1) |
|
Phases of the Identity and Access Lifecycle |
|
|
633 | (1) |
|
Registration and Identity Validation |
|
|
634 | (1) |
|
|
|
635 | (1) |
|
|
|
635 | (1) |
|
|
|
635 | (1) |
|
|
|
636 | (1) |
|
|
|
636 | (2) |
|
Attribute-Based Access Control (ABAC) |
|
|
638 | (2) |
|
Rights, Permissions, and Policies |
|
|
640 | (1) |
|
Users, Groups, and Account Permissions |
|
|
640 | (5) |
|
Permission Inheritance and Propagation |
|
|
645 | (2) |
|
Chapter Review Activities |
|
|
647 | (1) |
|
|
|
647 | (1) |
|
|
|
647 | (1) |
|
|
|
648 | (3) |
|
Chapter 24 Implementing Authentication and Authorization Solutions |
|
|
651 | (34) |
|
"Do I Know This Already?" Quiz |
|
|
651 | (4) |
|
|
|
655 | (1) |
|
Authentication Management |
|
|
655 | (1) |
|
|
|
655 | (1) |
|
|
|
655 | (1) |
|
|
|
656 | (1) |
|
Hardware Security Modules |
|
|
656 | (1) |
|
Knowledge-Based Authentication |
|
|
656 | (1) |
|
Authentication/Authorization |
|
|
657 | (2) |
|
Security Assertion Markup Language |
|
|
659 | (2) |
|
|
|
661 | (2) |
|
OpenID and OpenID Connect |
|
|
663 | (1) |
|
|
|
664 | (3) |
|
|
|
667 | (1) |
|
Kerberos and Mutual Authentication |
|
|
668 | (2) |
|
Remote Authentication Technologies |
|
|
670 | (1) |
|
|
|
670 | (2) |
|
|
|
672 | (2) |
|
|
|
674 | (1) |
|
Discretionary Access Control |
|
|
674 | (2) |
|
|
|
676 | (1) |
|
Role-Based Access Control |
|
|
677 | (1) |
|
Attribute-Based Access Control |
|
|
678 | (1) |
|
Rule-Based Access Control |
|
|
678 | (1) |
|
|
|
678 | (1) |
|
Privileged Access Management |
|
|
678 | (1) |
|
Summary of Access Control Models |
|
|
679 | (1) |
|
Access Control Wise Practices |
|
|
680 | (1) |
|
Chapter Review Activities |
|
|
681 | (1) |
|
|
|
681 | (1) |
|
|
|
682 | (1) |
|
|
|
682 | (3) |
|
Chapter 25 Implementing Public Key Infrastructure |
|
|
685 | (18) |
|
"Do I Know This Already?" Quiz |
|
|
685 | (3) |
|
|
|
688 | (1) |
|
Public Key Infrastructure |
|
|
688 | (1) |
|
|
|
688 | (1) |
|
|
|
689 | (2) |
|
|
|
691 | (2) |
|
|
|
693 | (1) |
|
|
|
693 | (1) |
|
|
|
694 | (1) |
|
|
|
694 | (2) |
|
|
|
696 | (1) |
|
|
|
697 | (1) |
|
|
|
698 | (1) |
|
|
|
698 | (1) |
|
|
|
698 | (1) |
|
Stapling, Key Escrow, Certificate Chaining, Online vs. Offline CA |
|
|
698 | (2) |
|
Chapter Review Activities |
|
|
700 | (1) |
|
|
|
700 | (1) |
|
|
|
700 | (1) |
|
|
|
701 | (2) |
|
Part IV Operations and Incident Response |
|
|
|
Chapter 26 Using the Appropriate Tool to Assess Organizational Security |
|
|
703 | (52) |
|
"Do I Know This Already?" Quiz |
|
|
703 | (4) |
|
|
|
707 | (1) |
|
Network Reconnaissance and Discovery |
|
|
707 | (1) |
|
|
|
707 | (2) |
|
|
|
709 | (1) |
|
|
|
710 | (1) |
|
|
|
711 | (3) |
|
|
|
714 | (3) |
|
|
|
717 | (1) |
|
|
|
718 | (2) |
|
|
|
720 | (1) |
|
|
|
721 | (1) |
|
|
|
721 | (2) |
|
|
|
723 | (1) |
|
|
|
724 | (1) |
|
|
|
725 | (1) |
|
|
|
726 | (1) |
|
|
|
727 | (1) |
|
|
|
728 | (2) |
|
|
|
730 | (1) |
|
|
|
731 | (1) |
|
|
|
732 | (1) |
|
|
|
733 | (1) |
|
|
|
734 | (1) |
|
|
|
734 | (1) |
|
|
|
735 | (1) |
|
|
|
736 | (1) |
|
|
|
737 | (1) |
|
Shell and Script Environments |
|
|
738 | (1) |
|
|
|
739 | (1) |
|
|
|
740 | (1) |
|
|
|
741 | (1) |
|
|
|
741 | (1) |
|
Packet Capture and Replay |
|
|
742 | (1) |
|
|
|
742 | (1) |
|
|
|
742 | (1) |
|
|
|
743 | (1) |
|
|
|
744 | (1) |
|
|
|
744 | (1) |
|
|
|
745 | (1) |
|
|
|
746 | (1) |
|
|
|
747 | (1) |
|
|
|
747 | (1) |
|
|
|
747 | (1) |
|
|
|
748 | (2) |
|
|
|
750 | (1) |
|
Chapter Review Activities |
|
|
750 | (1) |
|
|
|
750 | (2) |
|
|
|
752 | (1) |
|
|
|
752 | (3) |
|
Chapter 27 Summarizing the Importance of Policies, Processes, and Procedures for Incident Response |
|
|
755 | (26) |
|
"Do I Know This Already?" Quiz |
|
|
755 | (5) |
|
|
|
760 | (1) |
|
|
|
760 | (1) |
|
Incident Response Process |
|
|
761 | (1) |
|
|
|
762 | (1) |
|
|
|
763 | (1) |
|
|
|
763 | (1) |
|
|
|
764 | (1) |
|
|
|
764 | (1) |
|
|
|
764 | (1) |
|
|
|
765 | (1) |
|
|
|
765 | (1) |
|
|
|
766 | (1) |
|
|
|
766 | (1) |
|
|
|
767 | (1) |
|
|
|
767 | (1) |
|
The Diamond Model of Intrusion Analysis |
|
|
768 | (2) |
|
|
|
770 | (1) |
|
|
|
771 | (1) |
|
|
|
771 | (1) |
|
|
|
772 | (1) |
|
|
|
773 | (1) |
|
Continuity of Operations Planning (COOP) |
|
|
774 | (1) |
|
|
|
775 | (1) |
|
|
|
776 | (1) |
|
Chapter Review Activities |
|
|
776 | (1) |
|
|
|
776 | (1) |
|
|
|
777 | (1) |
|
|
|
778 | (3) |
|
Chapter 28 Using Appropriate Data Sources to Support an Investigation |
|
|
781 | (38) |
|
"Do I Know This Already?" Quiz |
|
|
781 | (4) |
|
|
|
785 | (1) |
|
Vulnerability Scan Output |
|
|
785 | (1) |
|
|
|
786 | (1) |
|
|
|
787 | (1) |
|
|
|
788 | (1) |
|
|
|
788 | (1) |
|
|
|
788 | (1) |
|
|
|
788 | (1) |
|
|
|
789 | (1) |
|
|
|
790 | (1) |
|
|
|
791 | (1) |
|
|
|
792 | (1) |
|
|
|
793 | (1) |
|
|
|
794 | (1) |
|
|
|
795 | (1) |
|
|
|
796 | (1) |
|
|
|
797 | (2) |
|
|
|
799 | (1) |
|
Session Initiation Protocol Traffic |
|
|
800 | (1) |
|
|
|
800 | (2) |
|
|
|
802 | (1) |
|
|
|
803 | (1) |
|
|
|
804 | (1) |
|
|
|
805 | (3) |
|
|
|
808 | (1) |
|
|
|
808 | (1) |
|
|
|
808 | (1) |
|
|
|
809 | (1) |
|
|
|
809 | (1) |
|
|
|
809 | (1) |
|
|
|
810 | (1) |
|
|
|
811 | (2) |
|
|
|
813 | (1) |
|
Chapter Review Activities |
|
|
814 | (1) |
|
|
|
814 | (2) |
|
|
|
816 | (1) |
|
|
|
816 | (3) |
|
Chapter 29 Applying Mitigation Techniques or Controls to Secure an Environment |
|
|
819 | (18) |
|
"Do I Know This Already?" Quiz |
|
|
819 | (3) |
|
|
|
822 | (1) |
|
Reconfigure Endpoint Security Solutions |
|
|
822 | (1) |
|
Application Approved Lists |
|
|
822 | (1) |
|
Application Block List/Deny List |
|
|
822 | (1) |
|
|
|
823 | (1) |
|
|
|
824 | (1) |
|
|
|
825 | (1) |
|
|
|
825 | (3) |
|
|
|
828 | (1) |
|
Content Filter/URL Filter |
|
|
828 | (1) |
|
Update or Revoke Certificates |
|
|
829 | (1) |
|
|
|
830 | (1) |
|
|
|
830 | (1) |
|
|
|
831 | (1) |
|
|
|
832 | (1) |
|
|
|
833 | (1) |
|
|
|
834 | (1) |
|
Chapter Review Activities |
|
|
834 | (1) |
|
|
|
834 | (1) |
|
|
|
835 | (1) |
|
|
|
835 | (2) |
|
Chapter 30 Understanding the Key Aspects of Digital Forensics |
|
|
837 | (76) |
|
"Do I Know This Already?" Quiz |
|
|
837 | (5) |
|
|
|
842 | (1) |
|
|
|
842 | (1) |
|
|
|
842 | (1) |
|
|
|
842 | (1) |
|
|
|
843 | (1) |
|
|
|
844 | (1) |
|
Timelines of Sequence of Events |
|
|
844 | (1) |
|
|
|
844 | (1) |
|
|
|
845 | (1) |
|
|
|
845 | (1) |
|
|
|
846 | (1) |
|
|
|
846 | (1) |
|
|
|
846 | (1) |
|
|
|
847 | (1) |
|
|
|
848 | (1) |
|
|
|
848 | (1) |
|
|
|
848 | (1) |
|
|
|
849 | (1) |
|
|
|
850 | (1) |
|
|
|
850 | (1) |
|
|
|
851 | (1) |
|
|
|
851 | (1) |
|
|
|
852 | (48) |
|
Diversity of Training Techniques |
|
|
900 | (1) |
|
User Education and Awareness Training |
|
|
901 | (1) |
|
Third-Party Risk Management |
|
|
902 | (2) |
|
|
|
904 | (1) |
|
Understanding Classification and Governance |
|
|
904 | (2) |
|
|
|
906 | (1) |
|
|
|
906 | (2) |
|
|
|
908 | (1) |
|
Change Management and Change Control |
|
|
909 | (1) |
|
|
|
909 | (1) |
|
Chapter Review Activities |
|
|
910 | (1) |
|
|
|
910 | (1) |
|
|
|
910 | (1) |
|
|
|
911 | (2) |
|
Chapter 34 Summarizing Risk Management Processes and Concepts |
|
|
913 | (22) |
|
"Do I Know This Already?" Quiz |
|
|
913 | (4) |
|
|
|
917 | (1) |
|
|
|
917 | (1) |
|
Risk Management Strategies |
|
|
918 | (1) |
|
|
|
919 | (2) |
|
Qualitative Risk Assessment |
|
|
921 | (1) |
|
Quantitative Risk Assessment |
|
|
922 | (2) |
|
|
|
924 | (2) |
|
|
|
926 | (2) |
|
Disaster Recovery Planning |
|
|
928 | (2) |
|
Chapter Review Activities |
|
|
930 | (1) |
|
|
|
930 | (1) |
|
|
|
931 | (1) |
|
|
|
931 | (4) |
|
Chapter 35 Understanding Privacy and Sensitive Data Concepts in Relation to Security |
|
|
935 | (18) |
|
"Do I Know This Already?" Quiz |
|
|
935 | (5) |
|
|
|
940 | (1) |
|
Organizational Consequences of Privacy and Data Breaches |
|
|
940 | (1) |
|
Notifications of Breaches |
|
|
941 | (1) |
|
Data Types and Asset Classification |
|
|
941 | (2) |
|
Personally Identifiable Information and Protected Health Information |
|
|
943 | (1) |
|
|
|
943 | (1) |
|
|
|
944 | (1) |
|
Privacy Enhancing Technologies |
|
|
944 | (1) |
|
Roles and Responsibilities |
|
|
945 | (2) |
|
|
|
947 | (1) |
|
|
|
948 | (1) |
|
|
|
948 | (1) |
|
|
|
949 | (1) |
|
Chapter Review Activities |
|
|
949 | (1) |
|
|
|
949 | (1) |
|
|
|
949 | (1) |
|
|
|
950 | (3) |
|
Part VI Final Preparation |
|
|
|
Chapter 36 Final Preparation |
|
|
953 | (70) |
|
|
|
953 | (1) |
|
Suggested Plan for Final Review and Study |
|
|
953 | (1) |
|
|
|
954 | (1) |
|
|
|
955 | (68) |
| Appendix A Answers to the "Do I Know This Already?" Quizzes and Review Questions |
|
1023 | (64) |
| Appendix B CompTIA Security+ (SYO-601) Cert Guide Exam Updates |
|
1087 | (2) |
| Index |
|
1089 | |
Lisainfo e-raamatute kohta