Ido Dubrawsky (CISSP, CCNA, CCDA) is the Chief Security Advisor for Microsoft’s Communication Sector North America, a division of the Mobile and Embedded Devices Group. Prior to working at Microsoft, Ido was the acting Security Consulting Practice Lead at AT&T’s Callisma subsidiary and a Senior Security Consultant. Before joining AT&T, Ido was a Network Security Architect for Cisco Systems, Inc., SAFE Architecture Team. He has worked in the systems and network administration field for almost 20 years in a variety of environments from government to academia to private enterprise. He has a wide range of experience in various networks, from small to large and relatively simple to complex. Ido is the primary author of three major SAFE white papers and has written, and spoken, extensively on security topics. He is a regular contributor to the SecurityFocus website on a variety of topics covering security issues. Previously, he worked in Cisco Systems, Inc. Secure Consulting Group, providing network security posture assessments and consulting services for a wide range of clients. In addition to providing penetration-testing consultation, he also conducted security architecture reviews and policy and process reviews. He holds a B.Sc. and a M.Sc. in Aerospace Engineering from the University of Texas at Austin.

• About the AuthorsChapter 1 Systems SecuritySystems security threatsPrivilege escalationViruses and wormsTrojanSpyware and adwareRootkits and botnetsLogic bombsHost intrusion detection systemBehavior-based vs. signature-based IDS characteristicsAnti-SPAMPop-up blockersHardware and peripheral security risksBIOSUSB devicesCell phonesRemovable storage devicesNetwork attached storageSummary of exam objectivesTop five toughest questionsAnswersChapter 2 OS HardeningGeneral OS hardeningServicesFile systemRemoving unnecessary programsHotfixes/patchesService packs/maintenance updatesPatch managementWindows group policiesSecurity templatesConfiguration baselinesServer OS hardeningEnabling and disabling services and protocolsFTP serversDNS serversNNTP serversFile and print serversDHCP serversData repositoriesWorkstation OSUser rights and groupsSummary of exam objectivesTop five toughest questionsAnswersChapter 3 Application SecurityThreats are moving “up the stack”RationaleThreat modelingApplication security threatsBrowserBuffer overflowsPacket sniffers and instant messagingInstant messagingPeer-to-peerSMTP open relaysSummary of exam objectivesTop five toughest questionsAnswersChapter 4 Virtualization TechnologiesThe purpose of virtualizationBenefits of virtualizationTypes of virtualizationDesigning a virtual environmentSystem virtualizationManagement of virtual serversApplication virtualizationApplication streamingSummary of exam objectivesTop five toughest questionsAnswersChapter 5 Network SecurityGeneral network securityNetwork services and risks associated with themNetwork design elementsNetwork security toolsNetwork ports, services, and threatsNetwork ports and protocolsNetwork threatsNetwork design elements and componentsFirewallsWhat is a DMZ?VLANsNetwork address translationNetwork access control/network access protectionTelephonyNetwork security toolsIntrusion detection and preventions systemsHoneypotsContent filtersProtocol analyzersSummary of exam objectivesTop five toughest questionsAnswersChapter 6 Wireless NetworksWireless network designWireless communicationsSpread spectrum technologyWireless network architectureCSMA/CD and CSMA/CAService set ID broadcastWireless security standardsThe failure of WEPWPA and WPA2WAPWTLSAuthenticationRogue access pointsData emanationBluetoothSummary of exam objectivesTop five toughest questionsAnswersReferencesChapter 7 Network AccessGeneral network accessAccess controlAccess control modelsAuthentication models and componentsIdentityAccess control methods and modelsSeparation of dutiesLeast privilegeJob rotationMandatory access controlDiscretionary access controlRole- and rule-based access controlAccess control organizationSecurity groupsSecurity controlsLogical access control methodsAccess control listsGroup policiesDomain policiesTime of day restrictionsAccount expirationLogical tokensPhysical access security methodsAccess lists and logsHardware locksID badgesDoor access systemsMan-trapVideo surveillanceSummary of exam objectivesTop five toughest questionsAnswersChapter 8 Network AuthenticationAuthentication methodsAccess controlAuthenticationAuditingAuthentication methodsOne-factorTwo-factorThree-factorSingle sign-onAuthentication systemsRemote access policies and authenticationBiometricsSummary of exam objectivesTop five toughest questionsAnswersChapter 9 Risk Assessment and Risk MitigationConduct risk assessments and implement risk mitigationVulnerability assessment toolsPassword crackersNetwork mapping toolsUse monitoring tools on systems and networksWorkstationsIntrusion detection systemsLogging and auditingAuditing systemsSystem LogsPerformance LogsAccess LogsAuditsSummary of exam objectivesTop five toughest questionsAnswersChapter 10 General Cryptographic ConceptsGeneral cryptographySymmetric key cryptographyAsymmetric key cryptographyHashes and applicationsDigital signaturesCertificatesCIA—For all your security needsNon-repudiationKey managementEncryption algorithmsDES3DESRSAAESElliptic curve cryptographyOne-time padsTransmission encryptionWEPTKIPProtocolsSSL/TLSHTTP vs. HTTPS vs. SHTTPOther protocols with TLSS/MIMESSHIPSecPPTPL2TPCryptography in operating systemsFile and folder encryptionE-mailWhole disk encryptionTrusted platform moduleSummary of exam objectivesTop five toughest questionsAnswersChapter 11 Public Key InfrastructurePKI overviewPKI encryptionPKI StandardsPKI solutionsComponents of PKIDigital certificatesCertification authorityCertificate revocation listRecovery agentsCertificate authorityCertificate revocation listKey escrowRegistrationRecovery agentsImplementationCertificate managementSummary of exam objectivesTop five toughest questionsAnswersChapter 12 Redundancy PlanningAlternate sitesHot siteWarm siteCold siteRedundant systemsServersConnectionsISPRAIDSpare partsBackup generatorUPSSummary of exam objectivesTop five toughest questionsAnswersChapter 13 Controls and ProceduresEnvironmental controlsFire suppressionHVACShieldingImplementing disaster recovery and incident response proceduresDisaster recoveryIncident responseDefending against social engineeringSummary of exam objectivesTop five toughest questionsAnswersChapter 14 Legislation and Organizational PoliciesSecure disposal of systemsRetention/storageDestructionAcceptable use policiesPassword complexityStrong passwordsPassword changes and restrictionsAdministrator accountsChange managementInformation classificationVacationsSeparation of dutiesPersonally identifiable informationPrivacyDue careDue processDue diligenceSLAsUser education and awareness trainingCommunicationUser awarenessEducationOnline resourcesSecurity-related HR policiesCode of EthicsSummary of exam objectivesTop five toughest questionsAnswersIndex

Ido Dubrawsky (CISSP, CCNA, CCDA) is the Chief Security Advisor for Microsoft’s Communication Sector North America, a division of the Mobile and Embedded Devices Group. Prior to working at Microsoft, Ido was the acting Security Consulting Practice Lead at AT&T’s Callisma subsidiary and a Senior Security Consultant. Before joining AT&T, Ido was a Network Security Architect for Cisco Systems, Inc., SAFE Architecture Team. He has worked in the systems and network administration field for almost 20 years in a variety of environments from government to academia to private enterprise. He has a wide range of experience in various networks, from small to large and relatively simple to complex. Ido is the primary author of three major SAFE white papers and has written, and spoken, extensively on security topics. He is a regular contributor to the SecurityFocus website on a variety of topics covering security issues. Previously, he worked in Cisco Systems, Inc. Secure Consulting Group, providing network security posture assessments and consulting services for a wide range of clients. In addition to providing penetration-testing consultation, he also conducted security architecture reviews and policy and process reviews. He holds a B.Sc. and a M.Sc. in Aerospace Engineering from the University of Texas at Austin.

• About the AuthorsChapter 1 Systems SecuritySystems security threatsPrivilege escalationViruses and wormsTrojanSpyware and adwareRootkits and botnetsLogic bombsHost intrusion detection systemBehavior-based vs. signature-based IDS characteristicsAnti-SPAMPop-up blockersHardware and peripheral security risksBIOSUSB devicesCell phonesRemovable storage devicesNetwork attached storageSummary of exam objectivesTop five toughest questionsAnswersChapter 2 OS HardeningGeneral OS hardeningServicesFile systemRemoving unnecessary programsHotfixes/patchesService packs/maintenance updatesPatch managementWindows group policiesSecurity templatesConfiguration baselinesServer OS hardeningEnabling and disabling services and protocolsFTP serversDNS serversNNTP serversFile and print serversDHCP serversData repositoriesWorkstation OSUser rights and groupsSummary of exam objectivesTop five toughest questionsAnswersChapter 3 Application SecurityThreats are moving “up the stack”RationaleThreat modelingApplication security threatsBrowserBuffer overflowsPacket sniffers and instant messagingInstant messagingPeer-to-peerSMTP open relaysSummary of exam objectivesTop five toughest questionsAnswersChapter 4 Virtualization TechnologiesThe purpose of virtualizationBenefits of virtualizationTypes of virtualizationDesigning a virtual environmentSystem virtualizationManagement of virtual serversApplication virtualizationApplication streamingSummary of exam objectivesTop five toughest questionsAnswersChapter 5 Network SecurityGeneral network securityNetwork services and risks associated with themNetwork design elementsNetwork security toolsNetwork ports, services, and threatsNetwork ports and protocolsNetwork threatsNetwork design elements and componentsFirewallsWhat is a DMZ?VLANsNetwork address translationNetwork access control/network access protectionTelephonyNetwork security toolsIntrusion detection and preventions systemsHoneypotsContent filtersProtocol analyzersSummary of exam objectivesTop five toughest questionsAnswersChapter 6 Wireless NetworksWireless network designWireless communicationsSpread spectrum technologyWireless network architectureCSMA/CD and CSMA/CAService set ID broadcastWireless security standardsThe failure of WEPWPA and WPA2WAPWTLSAuthenticationRogue access pointsData emanationBluetoothSummary of exam objectivesTop five toughest questionsAnswersReferencesChapter 7 Network AccessGeneral network accessAccess controlAccess control modelsAuthentication models and componentsIdentityAccess control methods and modelsSeparation of dutiesLeast privilegeJob rotationMandatory access controlDiscretionary access controlRole- and rule-based access controlAccess control organizationSecurity groupsSecurity controlsLogical access control methodsAccess control listsGroup policiesDomain policiesTime of day restrictionsAccount expirationLogical tokensPhysical access security methodsAccess lists and logsHardware locksID badgesDoor access systemsMan-trapVideo surveillanceSummary of exam objectivesTop five toughest questionsAnswersChapter 8 Network AuthenticationAuthentication methodsAccess controlAuthenticationAuditingAuthentication methodsOne-factorTwo-factorThree-factorSingle sign-onAuthentication systemsRemote access policies and authenticationBiometricsSummary of exam objectivesTop five toughest questionsAnswersChapter 9 Risk Assessment and Risk MitigationConduct risk assessments and implement risk mitigationVulnerability assessment toolsPassword crackersNetwork mapping toolsUse monitoring tools on systems and networksWorkstationsIntrusion detection systemsLogging and auditingAuditing systemsSystem LogsPerformance LogsAccess LogsAuditsSummary of exam objectivesTop five toughest questionsAnswersChapter 10 General Cryptographic ConceptsGeneral cryptographySymmetric key cryptographyAsymmetric key cryptographyHashes and applicationsDigital signaturesCertificatesCIA—For all your security needsNon-repudiationKey managementEncryption algorithmsDES3DESRSAAESElliptic curve cryptographyOne-time padsTransmission encryptionWEPTKIPProtocolsSSL/TLSHTTP vs. HTTPS vs. SHTTPOther protocols with TLSS/MIMESSHIPSecPPTPL2TPCryptography in operating systemsFile and folder encryptionE-mailWhole disk encryptionTrusted platform moduleSummary of exam objectivesTop five toughest questionsAnswersChapter 11 Public Key InfrastructurePKI overviewPKI encryptionPKI StandardsPKI solutionsComponents of PKIDigital certificatesCertification authorityCertificate revocation listRecovery agentsCertificate authorityCertificate revocation listKey escrowRegistrationRecovery agentsImplementationCertificate managementSummary of exam objectivesTop five toughest questionsAnswersChapter 12 Redundancy PlanningAlternate sitesHot siteWarm siteCold siteRedundant systemsServersConnectionsISPRAIDSpare partsBackup generatorUPSSummary of exam objectivesTop five toughest questionsAnswersChapter 13 Controls and ProceduresEnvironmental controlsFire suppressionHVACShieldingImplementing disaster recovery and incident response proceduresDisaster recoveryIncident responseDefending against social engineeringSummary of exam objectivesTop five toughest questionsAnswersChapter 14 Legislation and Organizational PoliciesSecure disposal of systemsRetention/storageDestructionAcceptable use policiesPassword complexityStrong passwordsPassword changes and restrictionsAdministrator accountsChange managementInformation classificationVacationsSeparation of dutiesPersonally identifiable informationPrivacyDue careDue processDue diligenceSLAsUser education and awareness trainingCommunicationUser awarenessEducationOnline resourcesSecurity-related HR policiesCode of EthicsSummary of exam objectivesTop five toughest questionsAnswersIndex

Ido Dubrawsky (CISSP, CCNA, CCDA) is the Chief Security Advisor for Microsoft’s Communication Sector North America, a division of the Mobile and Embedded Devices Group. Prior to working at Microsoft, Ido was the acting Security Consulting Practice Lead at AT&T’s Callisma subsidiary and a Senior Security Consultant. Before joining AT&T, Ido was a Network Security Architect for Cisco Systems, Inc., SAFE Architecture Team. He has worked in the systems and network administration field for almost 20 years in a variety of environments from government to academia to private enterprise. He has a wide range of experience in various networks, from small to large and relatively simple to complex. Ido is the primary author of three major SAFE white papers and has written, and spoken, extensively on security topics. He is a regular contributor to the SecurityFocus website on a variety of topics covering security issues. Previously, he worked in Cisco Systems, Inc. Secure Consulting Group, providing network security posture assessments and consulting services for a wide range of clients. In addition to providing penetration-testing consultation, he also conducted security architecture reviews and policy and process reviews. He holds a B.Sc. and a M.Sc. in Aerospace Engineering from the University of Texas at Austin.

• About the AuthorsChapter 1 Systems SecuritySystems security threatsPrivilege escalationViruses and wormsTrojanSpyware and adwareRootkits and botnetsLogic bombsHost intrusion detection systemBehavior-based vs. signature-based IDS characteristicsAnti-SPAMPop-up blockersHardware and peripheral security risksBIOSUSB devicesCell phonesRemovable storage devicesNetwork attached storageSummary of exam objectivesTop five toughest questionsAnswersChapter 2 OS HardeningGeneral OS hardeningServicesFile systemRemoving unnecessary programsHotfixes/patchesService packs/maintenance updatesPatch managementWindows group policiesSecurity templatesConfiguration baselinesServer OS hardeningEnabling and disabling services and protocolsFTP serversDNS serversNNTP serversFile and print serversDHCP serversData repositoriesWorkstation OSUser rights and groupsSummary of exam objectivesTop five toughest questionsAnswersChapter 3 Application SecurityThreats are moving “up the stack”RationaleThreat modelingApplication security threatsBrowserBuffer overflowsPacket sniffers and instant messagingInstant messagingPeer-to-peerSMTP open relaysSummary of exam objectivesTop five toughest questionsAnswersChapter 4 Virtualization TechnologiesThe purpose of virtualizationBenefits of virtualizationTypes of virtualizationDesigning a virtual environmentSystem virtualizationManagement of virtual serversApplication virtualizationApplication streamingSummary of exam objectivesTop five toughest questionsAnswersChapter 5 Network SecurityGeneral network securityNetwork services and risks associated with themNetwork design elementsNetwork security toolsNetwork ports, services, and threatsNetwork ports and protocolsNetwork threatsNetwork design elements and componentsFirewallsWhat is a DMZ?VLANsNetwork address translationNetwork access control/network access protectionTelephonyNetwork security toolsIntrusion detection and preventions systemsHoneypotsContent filtersProtocol analyzersSummary of exam objectivesTop five toughest questionsAnswersChapter 6 Wireless NetworksWireless network designWireless communicationsSpread spectrum technologyWireless network architectureCSMA/CD and CSMA/CAService set ID broadcastWireless security standardsThe failure of WEPWPA and WPA2WAPWTLSAuthenticationRogue access pointsData emanationBluetoothSummary of exam objectivesTop five toughest questionsAnswersReferencesChapter 7 Network AccessGeneral network accessAccess controlAccess control modelsAuthentication models and componentsIdentityAccess control methods and modelsSeparation of dutiesLeast privilegeJob rotationMandatory access controlDiscretionary access controlRole- and rule-based access controlAccess control organizationSecurity groupsSecurity controlsLogical access control methodsAccess control listsGroup policiesDomain policiesTime of day restrictionsAccount expirationLogical tokensPhysical access security methodsAccess lists and logsHardware locksID badgesDoor access systemsMan-trapVideo surveillanceSummary of exam objectivesTop five toughest questionsAnswersChapter 8 Network AuthenticationAuthentication methodsAccess controlAuthenticationAuditingAuthentication methodsOne-factorTwo-factorThree-factorSingle sign-onAuthentication systemsRemote access policies and authenticationBiometricsSummary of exam objectivesTop five toughest questionsAnswersChapter 9 Risk Assessment and Risk MitigationConduct risk assessments and implement risk mitigationVulnerability assessment toolsPassword crackersNetwork mapping toolsUse monitoring tools on systems and networksWorkstationsIntrusion detection systemsLogging and auditingAuditing systemsSystem LogsPerformance LogsAccess LogsAuditsSummary of exam objectivesTop five toughest questionsAnswersChapter 10 General Cryptographic ConceptsGeneral cryptographySymmetric key cryptographyAsymmetric key cryptographyHashes and applicationsDigital signaturesCertificatesCIA—For all your security needsNon-repudiationKey managementEncryption algorithmsDES3DESRSAAESElliptic curve cryptographyOne-time padsTransmission encryptionWEPTKIPProtocolsSSL/TLSHTTP vs. HTTPS vs. SHTTPOther protocols with TLSS/MIMESSHIPSecPPTPL2TPCryptography in operating systemsFile and folder encryptionE-mailWhole disk encryptionTrusted platform moduleSummary of exam objectivesTop five toughest questionsAnswersChapter 11 Public Key InfrastructurePKI overviewPKI encryptionPKI StandardsPKI solutionsComponents of PKIDigital certificatesCertification authorityCertificate revocation listRecovery agentsCertificate authorityCertificate revocation listKey escrowRegistrationRecovery agentsImplementationCertificate managementSummary of exam objectivesTop five toughest questionsAnswersChapter 12 Redundancy PlanningAlternate sitesHot siteWarm siteCold siteRedundant systemsServersConnectionsISPRAIDSpare partsBackup generatorUPSSummary of exam objectivesTop five toughest questionsAnswersChapter 13 Controls and ProceduresEnvironmental controlsFire suppressionHVACShieldingImplementing disaster recovery and incident response proceduresDisaster recoveryIncident responseDefending against social engineeringSummary of exam objectivesTop five toughest questionsAnswersChapter 14 Legislation and Organizational PoliciesSecure disposal of systemsRetention/storageDestructionAcceptable use policiesPassword complexityStrong passwordsPassword changes and restrictionsAdministrator accountsChange managementInformation classificationVacationsSeparation of dutiesPersonally identifiable informationPrivacyDue careDue processDue diligenceSLAsUser education and awareness trainingCommunicationUser awarenessEducationOnline resourcesSecurity-related HR policiesCode of EthicsSummary of exam objectivesTop five toughest questionsAnswersIndex