CompTIA Security+ SY0-501 Cert Guide

David L. Prowse is an author, technologist, and technical trainer. He has penned a dozen books for Pearson Education, including the well-received CompTIA A+ Exam Cram. He also develops video content, including the CompTIA A+ LiveLessons video course. Over the past two decades he has taught CompTIA A+, Network+, and Security+ certification courses, both in the classroom and via the Internet. David has 20 years of experience in the IT field and loves to share that experience with his readers, watchers, and students.He runs the website www.davidlprowse.com in support of his books and videos.

• Introduction xxivChapter 1 Introduction to Security 3Foundation Topics 4Security 101 4The CIA of Computer Security 4The Basics of Information Security 6Think Like a Hacker 9Threat Actor Types and Attributes 10Chapter Review Activities 12Review Key Topics 12Define Key Terms 12Review Questions 13Answers and Explanations 15Chapter 2 Computer Systems Security Part I 19Foundation Topics 19Malicious Software Types 19Viruses 20Worms 21Trojan Horses 22Ransomware 22Spyware 23Rootkits 24Spam 25Summary of Malware Threats 25Delivery of Malware 26Via Software, Messaging, and Media 26Botnets and Zombies 28Active Interception 28Privilege Escalation 29Backdoors 29Logic Bombs 29Preventing and Troubleshooting Malware 30Preventing and Troubleshooting Viruses 31Preventing and Troubleshooting Worms and Trojans 35Preventing and Troubleshooting Spyware 35Preventing and Troubleshooting Rootkits 38Preventing and Troubleshooting Spam 38You Can't Save Every Computer from Malware! 40Summary of Malware Prevention Techniques 40Chapter Summary 41Chapter Review Activities 42Review Key Topics 42Define Key Terms 42Complete the Real-World Scenarios 43Review Questions 43Answers and Explanations 48Chapter 3 Computer Systems Security Part II 53Foundation Topics 53Implementing Security Applications 53Personal Software Firewalls 53Host-Based Intrusion Detection Systems 55Pop-Up Blockers 57Data Loss Prevention Systems 59Securing Computer Hardware and Peripherals 59Securing the BIOS 60Securing Storage Devices 62Removable Storage 62Network Attached Storage 63Whole Disk Encryption 64Hardware Security Modules 65Securing Wireless Peripherals 66Securing Mobile Devices 66Malware 67Botnet Activity 68SIM Cloning and Carrier Unlocking 68Wireless Attacks 69Theft 70Application Security 71BYOD Concerns 74Chapter Summary 78Chapter Review Activities 79Review Key Topics 79Define Key Terms 79Complete the Real-World Scenarios 80Review Questions 80Answers and Explanations 83Chapter 4 OS Hardening and Virtualization 89Foundation Topics 89Hardening Operating Systems 89Removing Unnecessary Applications and Services 90Windows Update, Patches, and Hotfixes 97Patches and Hotfixes 99Patch Management 101Group Policies, Security Templates, and Configuration Baselines 102Hardening File Systems and Hard Drives 105Virtualization Technology 109Types of Virtualization and Their Purposes 110Hypervisor 111Securing Virtual Machines 113Chapter Summary 115Chapter Review Activities 117Review Key Topics 117Define Key Terms 118Complete the Real-World Scenarios 118Review Questions 118Answers and Explanations 122Chapter 5 Application Security 127Foundation Topics 127Securing the Browser 127General Browser Security Procedures 129Implement Policies 129Train Your Users 133Use a Proxy and Content Filter 133Secure Against Malicious Code 135Web Browser Concerns and Security Methods 135Basic Browser Security 135Cookies 136LSOs 137Add-ons 137Advanced Browser Security 138Securing Other Applications 140Secure Programming 144Software Development Life Cycle 145Core SDLC and DevOps Principles 146Programming Testing Methods 149White-box and Black-box Testing 149Compile-Time Errors Versus Runtime Errors 150Input Validation 150Static and Dynamic Code Analysis 151Fuzz Testing 152Programming Vulnerabilities and Attacks 152Backdoors 153Memory/Buffer Vulnerabilities 153Arbitrary Code Execution/Remote Code Execution 155XSS and XSRF 155More Code Injection Examples 156Directory Traversal 158Zero Day Attack 158Chapter Summary 160Chapter Review Activities 161Review Key Topics 161Define Key Terms 162Complete the Real-World Scenarios 162Review Questions 162Answers and Explanations 167Chapter 6 Network Design Elements 173Foundation Topics 173Network Design 173The OSI Model 173Network Devices 175Switch 175Bridge 178Router 178Network Address Translation, and Private Versus Public IP 180Network Zones and Interconnections 182LAN Versus WAN 182Internet 183Demilitarized Zone (DMZ) 183Intranets and Extranets 184Network Access Control (NAC) 185Subnetting 186Virtual Local Area Network (VLAN) 188Telephony 190Modems 190PBX Equipment 191VoIP 191Cloud Security and Server Defense 192Cloud Computing 192Cloud Security 195Server Defense 198File Servers 198Network Controllers 199E-mail Servers 199Web Servers 200FTP Server 202Chapter Summary 203Chapter Review Activities 205Review Key Topics 205Define Key Terms 205Complete the Real-World Scenarios 205Review Questions 206Answers and Explanations 210Chapter 7 Networking Protocols and Threats 217Foundation Topics 217Ports and Protocols 217Port Ranges, Inbound Versus Outbound, and Common Ports 217Protocols That Can Cause Anxiety on the Exam 225Malicious Attacks 226DoS 226DDoS 229Sinkholes and Blackholes 230Spoofing 231Session Hijacking 232Replay 234Null Sessions 235Transitive Access and Client-Side Attacks 236DNS Poisoning and Other DNS Attacks 236ARP Poisoning 238Summary of Network Attacks 238Chapter Summary 242Chapter Review Activities 243Review Key Topics 243Define Key Terms 243Complete the Real-World Scenarios 243Review Questions 244Answers and Explanations 250Chapter 8 Network Perimeter Security 255Foundation Topics 256Firewalls and Network Security 256Firewalls 256Proxy Servers 263Honeypots and Honeynets 266Data Loss Prevention (DLP) 267NIDS Versus NIPS 268NIDS 268NIPS 269Summary of NIDS Versus NIPS 271The Protocol Analyzer's Role in NIDS and NIPS 271Unified Threat Management 272Chapter Summary 273Chapter Review Activities 274Review Key Topics 274Define Key Terms 274Complete the Real-World Scenarios 274Review Questions 275Answers and Explanations 280Chapter 9 Securing Network Media and Devices 285Foundation Topics 285Securing Wired Networks and Devices 285Network Device Vulnerabilities 285Default Accounts 286Weak Passwords 286Privilege Escalation 287Back Doors 288Network Attacks 289Other Network Device Considerations 289Cable Media Vulnerabilities 289Interference 290Crosstalk 291Data Emanation 292Tapping into Data and Conversations 293Securing Wireless Networks 295Wireless Access Point Vulnerabilities 295The Administration Interface 295SSID Broadcast 296Rogue Access Points 296Evil Twin 297Weak Encryption 297Wi-Fi Protected Setup 299Ad Hoc Networks 299VPN over Open Wireless 300Wireless Access Point Security Strategies 300Wireless Transmission Vulnerabilities 304Bluetooth and Other Wireless Technology Vulnerabilities 305Bluejacking 306Bluesnarfing 306RFID and NFC 307More Wireless Technologies 308Chapter Summary 310Chapter Review Activities 312Review Key Topics 312Define Key Terms 312Complete the Real-World Scenarios 312Review Questions 313Answers and Explanations 317Chapter 10 Physical Security and Authentication Models 321Foundation Topics 322Physical Security 322General Building and Server Room Security 323Door Access 324Biometric Readers 326Authentication Models and Components 327Authentication Models 327Localized Authentication Technologies 329802.1X and EAP 330LDAP 333Kerberos and Mutual Authentication 334Remote Desktop Services 336Remote Authentication Technologies 337Remote Access Service 337Virtual Private Networks 340RADIUS Versus TACACS 343Chapter Summary 345Chapter Review Activities 346Review Key Topics 346Define Key Terms 347Complete the Real-World Scenarios 347Review Questions 347Answers and Explanations 355Chapter 11 Access Control Methods and Models 361Foundation Topic 361Access Control Models Defined 361Discretionary Access Control 361Mandatory Access Control 363Role-Based Access Control (RBAC) 364Attribute-based Access Control (ABAC) 365Access Control Wise Practices 366Rights, Permissions, and Policies 369Users, Groups, and Permissions 369Permission Inheritance and Propagation 374Moving and Copying Folders and Files 376Usernames and Passwords 376Policies 379User Account Control (UAC) 383Chapter Summary 384Chapter Review Activities 385Review Key Topics 385Define Key Terms 386Complete the Real-World Scenarios 386Review Questions 386Answers and Explanations 392Chapter 12 Vulnerability and Risk Assessment 397Foundation Topics 397Conducting Risk Assessments 397Qualitative Risk Assessment 399Quantitative Risk Assessment 400Security Analysis Methodologies 402Security Controls 404Vulnerability Management 405Penetration Testing 407OVAL 408Additional Vulnerabilities 409Assessing Vulnerability with Security Tools 410Network Mapping 411Vulnerability Scanning 412Network Sniffing 415Password Analysis 417Chapter Summary 420Chapter Review Activities 421Review Key Topics 421Define Key Terms 422Complete the Real-World Scenarios 422Review Questions 422Answers and Explanations 428Chapter 13 Monitoring and Auditing 435Foundation Topics 435Monitoring Methodologies 435Signature-Based Monitoring 435Anomaly-Based Monitoring 436Behavior-Based Monitoring 436Using Tools to Monitor Systems and Networks 437Performance Baselining 438Protocol Analyzers 440Wireshark 441SNMP 443Analytical Tools 445Use Static and Dynamic Tools 447Conducting Audits 448Auditing Files 448Logging 451Log File Maintenance and Security 455Auditing System Security Settings 457SIEM 460Chapter Summary 461Chapter Review Activities 462Review Key Topics 462Define Key Terms 463Complete the Real-World Scenarios 463Review Questions 463Answers and Explanations 470Chapter 14 Encryption and Hashing Concepts 477Foundation Topics 477Cryptography Concepts 477Symmetric Versus Asymmetric Key Algorithms 481Symmetric Key Algorithms 481Asymmetric Key Algorithms 483Public Key Cryptography 483Key Management 484Steganography 485Encryption Algorithms 486DES and 3DES 486AES 487RC 488Blowfish and Twofish 489Summary of Symmetric Algorithms 489RSA 490Diffie-Hellman 491Elliptic Curve 492More Encryption Types 493One-Time Pad 493PGP 494Pseudorandom Number Generators 495Hashing Basics 496Cryptographic Hash Functions 498MD5 498SHA 498RIPEMD and HMAC 499LANMAN, NTLM, and NTLMv2 500LANMAN 500NTLM and NTLMv2 501Hashing Attacks 502Pass the Hash 502Happy Birthday! 503Additional Password Hashing Concepts 503Chapter Summary 505Chapter Review Activities 507Review Key Topics 507Define Key Terms 507Complete the Real-World Scenarios 508Review Questions 508Answers and Explanations 515Chapter 15 PKI and Encryption Protocols 521Foundation Topics 521Public Key Infrastructure 521Certificates 522SSL Certificate Types 522Single-Sided and Dual-Sided Certificates 523Certificate Chain of Trust 523Certificate Formats 523Certificate Authorities 525Web of Trust 529Security Protocols 529S/MIME 530SSL/TLS 531SSH 532PPTP, L2TP, and IPsec 533PPTP 533L2TP 534IPsec 534Chapter Summary 535Chapter Review Activities 536Review Key Topics 536Define Key Terms 536Complete the Real-World Scenarios 537Review Questions 537Answers and Explanations 542Chapter 16 Redundancy and Disaster Recovery 547Foundation Topics 547Redundancy Planning 547Redundant Power 549Redundant Power Supplies 551Uninterruptible Power Supplies 551Backup Generators 553Redundant Data 555Redundant Networking 558Redundant Servers 560Redundant Sites 561Redundant People 562Disaster Recovery Planning and Procedures 562Data Backup 562DR Planning 567Chapter Summary 571Chapter Review Activities 572Review Key Topics 572Define Key Terms 572Complete the Real-World Scenarios 573Review Questions 573Answers and Explanations 577Chapter 17 Social Engineering, User Education, and Facilities Security 583Foundation Topics 583Social Engineering 583Pretexting 584Malicious Insider 585Diversion Theft 586Phishing 586Hoaxes 587