CCNA Cyber Ops SECOPS 210-255 Official Cert Guide

Omar Santos is an active member of the cybersecurity community, where he leads several industry-wide initiatives and standards bodies. His active role helps businesses, academic institutions, state and local law enforcement agencies, and other participants dedicated to increasing the security of their critical infrastructures.Omar is the author of more than a dozen books and video courses, as well as numerous white papers, articles, and security configuration guidelines and best practices. Omar is a principal engineer of the Cisco Product Security Incident Response Team (PSIRT), where he mentors and leads engineers and incident managers during the investigation and resolution of cybersecurity vulnerabilities. Additional information about Omar’s current projects can be found at omarsantos.io, and you can follow Omar on Twitter @santosomar.Joseph Muniz is an architect at Cisco Systems and security researcher. He has extensive experience in designing security solutions and architectures for the top Fortune 500 corporations and the U.S. government. Joseph’s current role gives him visibility into the latest trends in cybersecurity, from both leading vendors and customers. Examples of Joseph’s research include his RSA talk titled “Social Media Deception,” which has been quoted by many sources (search for “Emily Williams Social Engineering”), as well as his articles in PenTest Magazine regarding various security topics. Joseph runs The Security Blogger website, a popular resource for security, hacking, and product implementation. He is the author and contributor of several publications covering various penetration testing and security topics. You can follow Joseph at www.thesecurityblogger.com and @SecureBlogger.

• Introduction xviiPart I Threat Analysis and Computer ForensicsChapter 1 Threat Analysis 3“Do I Know This Already?” Quiz 3Foundation Topics 6What Is the CIA Triad: Confidentiality, Integrity, and Availability? 6Confidentiality 6Integrity 7Availability 7Threat Modeling 8Defining and Analyzing the Attack Vector 10Understanding the Attack Complexity 12Privileges and User Interaction 12The Attack Scope 13Exam Preparation Tasks 14Review All Key Topics 14Complete Tables and Lists from Memory 14Define Key Terms 14Q&A 15Chapter 2 Forensics 17“Do I Know This Already?” Quiz 17Foundation Topics 20Introduction to Cybersecurity Forensics 20The Role of Attribution in a Cybersecurity Investigation 21The Use of Digital Evidence 21Defining Digital Forensic Evidence 22Understanding Best, Corroborating, and Indirect or Circumstantial Evidence 22Collecting Evidence from Endpoints and Servers 22Collecting Evidence from Mobile Devices 24Collecting Evidence from Network Infrastructure Devices 24Chain of Custody 26Fundamentals of Microsoft Windows Forensics 28Processes, Threads, and Services 28Memory Management 30Windows Registry 32The Windows File System 34FAT 35NTFS 36Fundamentals of Linux Forensics 37Linux Processes 37Ext4 40Journaling 41Linux MBR and Swap File System 41Exam Preparation Tasks 43Review All Key Topics 43Define Key Terms 44Q&A 44Part II Network Intrusion AnalysisChapter 3 Fundamentals of Intrusion Analysis 49“Do I Know This Already?” Quiz 49Foundation Topics 52Common Artifact Elements and Sources of Security Events 52False Positives, False Negatives, True Positives, and True Negatives 58Understanding Regular Expressions 58Protocols, Protocol Headers, and Intrusion Analysis 61Using Packet Captures for Intrusion Analysis 61Mapping Security Event Types to Source Technologies 66Exam Preparation Tasks 71Review All Key Topics 71Complete Tables and Lists from Memory 71Define Key Terms 71Q&A 72Chapter 4 NetFlow for Cybersecurity 75“Do I Know This Already?” Quiz 75Foundation Topics 78Introduction to NetFlow 78What Is a Flow in NetFlow? 78The NetFlow Cache 80NetFlow Versions 81Cisco Flexible NetFlow 96Flexible NetFlow Records 97Flow Monitors 102Flow Exporters 102Flow Samplers 102Flexible NetFlow Configuration 102Configure a Flow Record 103Configuring a Flow Monitor for IPv4 or IPv6 105Configuring a Flow Exporter for the Flow Monitor 107Applying a Flow Monitor to an Interface 109IPFIX 110IPFIX Architecture 111IPFIX Mediators 111IPFIX Templates 111Option Templates 112Introduction to the Stream Control Transmission Protocol (SCTP) 112NetFlow and IPFIX Comparison 113NetFlow for Cybersecurity and Incident Response 113NetFlow as an Anomaly Detection Tool 113Incident Response and Network Security Forensics 114Using NetFlow for Data Leak Detection and Prevention 119NetFlow Analysis Tools 125Commercial NetFlow Analysis Tools 125Cisco’s Lancope StealthWatch Solution 126Plixer’s Scrutinizer 129Open Source NetFlow Monitoring and Analysis Software Packages 129Exam Preparation Tasks 136Review All Key Topics 136Define Key Terms 136Q&A 136Part III Incident ResponseChapter 5 Introduction to Incident Response and the Incident HandlingProcess 141“Do I Know This Already?” Quiz 141Foundation Topics 144Introduction to Incident Response 144What Are Events and Incidents? 144The Incident Response Plan 145The Incident Response Process 146The Preparation Phase 146The Detection and Analysis Phase 146Containment, Eradication, and Recovery 147Post-Incident Activity (Postmortem) 148Information Sharing and Coordination 148Incident Response Team Structure 148The Vocabulary for Event Recording and Incident Sharing (VERIS) 149Exam Preparation Tasks 153Review All Key Topics 153Complete Tables and Lists from Memory 153Define Key Terms 153Q&A 153Chapter 6 Incident Response Teams 157“Do I Know This Already?” Quiz 157Foundation Topics 159Computer Security Incident Response Teams (CSIRTs) 159Product Security Incident Response Teams (PSIRTs) 161Security Vulnerabilities and Their Severity 161Vulnerability Chaining Role in Fixing Prioritization 164Fixing Theoretical Vulnerabilities 164Internally Versus Externally Found Vulnerabilities 165National CSIRTs and Computer Emergency Response Teams (CERTs) 166Coordination Centers 166Incident Response Providers and Managed Security Service Providers (MSSPs) 167Exam Preparation Tasks 168Review All Key Topics 168Define Key Terms 168Q&A 168Chapter 7 Compliance Frameworks 171“Do I Know This Already?” Quiz 172Foundation Topics 175Payment Card Industry Data Security Standard (PCI DSS) 175PCI DSS Data 175Health Insurance Portability and Accountability Act (HIPAA) 185HIPAA Security Rule 186HIPAA Safeguards 187Sarbanes-Oxley (SOX) 189Section 302 190Section 404 190Section 409 190Summary 192References 192Exam Preparation Tasks 193Review All Key Topics 193Complete Tables and Lists from Memory 193Define Key Terms 193Review Questions 194Chapter 8 Network and Host Profiling 197“Do I Know This Already?” Quiz 197Foundation Topics 200Network Profiling 200Throughput 200Used Ports 206Session Duration 211Critical Asset Address Space 212Host Profiling 215Listening Ports 216Logged-in Users/Service Accounts 220Running Processes 223Applications 226Summary 229References 230Exam Preparation Tasks 231Review All Key Topics 231Define Key Terms 231Q&A 231Part IV Data and Event AnalysisChapter 9 The Art of Data and Event Analysis 235“Do I Know This Already?” Quiz 235Foundation Topics 238Normalizing Data 238Interpreting Common Data Values into a Universal Format 238Using the 5-Tuple Correlation to Respond to Security Incidents 239Retrospective Analysis and Identifying Malicious Files 241Identifying a Malicious File 241Mapping Threat Intelligence with DNS and Other Artifacts 242Deterministic Versus Probabilistic Analysis 242Exam Preparation Tasks 244Review All Key Topics 244Complete Tables and Lists from Memory 244Define Key Terms 244Q&A 245Part V Incident HandlingChapter 10 Intrusion Event Categories 247“Do I Know This Already?” Quiz 247Foundation Topics 250Diamond Model of Intrusion 250Cyber Kill Chain Model 254Reconnaissance 256Weaponization 259Delivery 260Exploitation 261Installation 263Command and Control 264Action and Objectives 265Summary 269References 269Exam Preparation Tasks 271Review All Key Topics 271Define Key Terms 271Q&A 271Part VI Final PreparationChapter 11 Final Preparation 275Tools for Final Preparation 275Pearson Cert Practice Test Engine and Questions on the Website 275Customizing Your Exams 277Updating Your Exams 277The Cisco Learning Network 278Memory Tables and Lists 278Chapter-Ending Review Tools 279Suggested Plan for Final Review/Study 279Summary 279Part VII AppendixAppendix A Answers to the “Do I Know This Already?” Quizzes and Q&A 281Glossary 295Elements Available on the Book WebsiteAppendix B Memory Tables and ListsAppendix C Memory Tables and Lists AnswersAppendix D Study Planner9781587147036, TOC, 5/4/2017