Prepare for the CompTIA Security+ certification exam that covers the skills required to perform core security functions and pursue a career in IT. You will learn the basic principles of network security. Computer network vulnerabilities and threats are covered and you will learn how to safeguard computer networks. Network security planning, technology, and organization are discussed along with associated legal and ethical issues.Lesson objectives and instruction succinctly review each major topic, including: network fundamentals, operational and organizational security, risk management, wireless security, change management, physical security, forensics, network attacks, and much more. You will:Identify the concepts of confidentiality, integrity, and availabilityImplement secure network administration principlesApply appropriate risk mitigation strategiesExplain the impact of physical security on computer and network securityUse assessment tools to discover security threats and vulnerabilitiesImplement appropriate security controls when performing account managementThis book is for security professionals looking to get this credential, including systems administrators, network administrators, security administrators, junior IT auditors and penetration testers, security specialists, security consultants, security engineers, and more.
Ahmed F Sheikh CompTIA Security+ Certification Study Guide Network Security Essentials 1st ed Ahmed F Sheikh Miami, FL, USA Any source code or other supplementary material referenced by the author in this book is available to readers on GitHub via the book’s product page, located at www.apress.com/9781484262337 For more detailed information, please visit http://www.apress.com/source-code ISBN 978-1-4842-6233-7 e-ISBN 978-1-4842-6234-4 https://doi.org/10.1007/978-1-4842-6234-4 © Ahmed F Sheikh 2020 This work is subject to copyright All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed The use of general descriptive names, registered names, trademarks, service marks, etc in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication Neither the publisher nor the authors or the editors give a warranty, expressed or implied, with respect to the material contained herein or for any errors or omissions that may have been made The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations Distributed to the book trade worldwide by Springer Science+Business Media New York, New York Plaza, New York, NY 10004 Phone 1-800SPRINGER, fax (201) 348-4505, e-mail orders-ny@springer-sbm.com, or visit www.springeronline.com Apress Media, LLC is a California LLC and the sole member (owner) is Springer Science + Business Media Finance Inc (SSBM Finance Inc) SSBM Finance Inc is a Delaware corporation This book is affectionately dedicated to all IT experts, professionals, and students Table of Contents Chapter 1: General Security Concepts and Trends Information Security Model Operational Model of Computer Security Diversity of Defense Communications Security Access Control Authentication Social Engineering Security Trends Due Care and Due Diligence Summary Resources Chapter 2: Network Fundamentals and Infrastructure Security Network Architectures Network Topology Network Protocol The OSI Model IP Packet TCP vs UDP Three-Way Handshake Internet Control Message Protocol (ICMP) Packet Delivery Domain Name System (DNS) Routing IP Addressing Network Address Translation (NAT) Security Zones Demilitarized Zone Virtual LAN (VLAN) Tunneling Infrastructure Security: Securing a Workstation Virtualization Hubs Bridges Switches Routers Firewalls Basic Packet Filtering Stateful Packet Filtering Modems Cable Modems DSL Modems Virtual Private Networks Intrusion Detection System Mobile Devices Media Cables Security Concerns for Transmission Media Object Reuse Network-Attached Storage Summary Resources Chapter 3: Wireless and Intrusion Detection System Network Security Introduction to Wireless Networking 802.11 WAP WAP Vulnerabilities Bluetooth 802.11 Modulation 802.11 Individual Standards 802.11 Protocol Attacking 802.11 NetStumbler on a Windows PC Windows Displaying Access Points New Security Protocols Implementing 802.X Types of Intrusion Detection Systems IDS Components NIDS Placement Network IDS Advantages Disadvantages Active vs Passive NIDS Signatures IDS Matrix IDS Detection Models Firewall Intrusion Prevention Systems Proxy Servers Types of Proxy Servers Protocol Analyzers Honeypots and Honeynets Host-Based IDS (HIDS) HIDs Advantages vs Disadvantages Modern HIDS Antivirus Products Antivirus Products: Signature-Based and Heuristic Scanning Signature-Based Scanning Heuristic Scanning Personal Software Firewalls Pop-Up Blockers and Windows Defender Anti-spam Summary Chapter 4: Role of People in Security—Operational and Organizational Security Security Options The Operational Process Controls Physical Security Physical Barriers Environmental Issues Fire Suppression Electromagnetic Eavesdropping Location Role of People in Security Social Engineering Spear Phishing and Pharming Vishing Shoulder Surfing Security Hoaxes Password Best Practices Piggybacking Dumpster Diving Installing Unauthorized Hardware and Software Physical Access by Non-employees Security Awareness Individual User Responsibilities Roles and Responsibilities Security Roles and Responsibilities Summary Resources Chapter 5: Risk Management Risk Management Vulnerabilities General Risk Management Model Qualitatively Assessing Risk Annualized Loss Expectancy (ALE) Qualitative vs Quantitative Risk Assessment Management’s Response Certification and Accreditation recovery, and trust models You learned about the importance of implementing a public key infrastructure to manage digital certificates Resource International Telecommunication Union: www.itu.int/en/Pages/default.aspx Footnotes www.itu.int/en/Pages/default.aspx Index A Access control administrative layer lists physical layer technical layer types Accountability Annual loss expectancy (ALE) Anti-spam software Antivirus solutions automated scanning automated updates email scanning heuristic scanning manual scanning media scanning resolution signature based scanning Application-level events Asymmetric algorithms Attacks avenue of on encryption injection attack malicious code malware defense minimizing possible avenues password attack pharming phishing social engineering software exploitation systems and networks types of war-dialing war-driving Auditing Authentication and remote access accounting authentication authorization B Baselines Bell–LaPadula security model Biba security model Bluetooth vulnerabilities Business continuity plan (BCP) backup plan cold Site hot Site secure recovery utilities warm Site C Certification and Accreditation (C&A) agreements approval to operate guidelines process Change Control Board (CCB) Change management CCB purpose configuration auditing configuration control configuration identification configuration status accounting emergency change implementations management goal process separation of duties standard change workflow Clark-Wilson security model Cloud computing Computer forensics analysis chain of custody conducting an investigation drive space allocation evidence identifying evidence incident response cycle message digest and hash remediation after attack safeguarding evidence Volatility of data Computer Incident Response Team (CIRT) Cryptography algorithm use confidentiality Digital rights management digital signatures asymmetric encryption BitLocker description FreeOTFE Gnu Privacy Guard key management keys one-time pad PGP shift cipher substitution cipher symmetric algorithms TrueCrypt TPM Vigenère cipher D Demilitarized zone (DMZ) Denial-of-service (DoS) attack Designated Approving Authority (DAA) Disaster recovery plans (DRP) business impact assessment exercises functional test policies and procedures Discretionary Access Control Domain name system (DNS) IP addresses classless network classes reserved types subnetting routing E Electromagnetic eavesdropping Email security antivirus software hoax emails outlook configuration Pretty Good Privacy S/MIME spam F Fault tolerance Firewalls access control lists basic packet filtering network address translation personal software proxy services stateful packet filtering G Group policy object (GPO) H Hardening application patches definition device configuration hotfix updates Linux firewall configuration user accounts Mac OS X file permissions 10.15 security window patch management service pack Software updates windows 2019 server service configuration window user account control Hash algorithms message digest SHA Heating, ventilation, and air conditioning (HVAC) systems High availability Honeypots/honeynets I, J Infrastructure security Instant messaging Internal controls implicit deny job rotation least privilege separation of duties Internet Control Message Protocol (ICMP) Internet Protocol Security (IPsec) transport mode tunnel mode Intrusion detection system (IDS) anomaly-based IDS anomaly detection model components HIDS issues misuse detection model NIDS active advantages disadvantages passive placement signature-based IDS Intrusion detection systems (IDS) Intrusion prevention systems (IPS) K Kerberos operations L Legal issues CFAA computer trespass cybercrime Digital Millennium Copyright Act ECPA, 134EAR GLBA import/export encryption organizations PCI DSS SOX sources of laws USA Patriot Act US Digital Signature Laws M Mobile devices Models of Access control access role-based access control mandatory access control rule-based access control Modems Mutual authentication N Network address translation (NAT) Network architecture Network-Attached Storage (NAS) Network attacks backdoors DoS attack drive-by download attack man-in-the-middle attack null session Ping-of-Death attack replay attack sniffing spoofing IP address sequence numbers trusted relationships SYN flood attack TCP/IP hijacking three-way handshake trapdoors Network protocols Ethernet IEEE 802.11 sub-protocols TCP/IP Network topology bus hybrid mesh ring star O Open Systems Interconnection (OSI) model Open Vulnerability and Assessment Language (OVAL) Operational and organizational security access by non-employee control types data Custodian data Owner dumpster diving electromagnetic eavesdropping environmental issues fire suppression device individual user responsibilities installing unauthorized software/hardware locate equipment operational process operations security password people roles pharming phishing security hoax shoulder surfing social engineering spear phishing physical barriers physical security mechanisms piggybacking roles/responsibilities security awareness program user P, Q Physical security access controls CCTV system laptops and mobile devices layered access access tokens authentication biometrics bootdisks computer policies drive imaging environmental controls fire detection devices fire extinguishers fire suppression systems HVAC systems measures multiple-factor authentication suppression methods universal serial bus Policy acceptable use policy email usage policy guidelines human resources policies procedures sample security Pop-up blockers Privacy choice consent notice personally identifiable information policies privacy impact assessment US Privacy Laws Privilege management See Windows 2019 server users Protocol analyzers Proxy servers Public key infrastructure (PKI) authentication certificate authority digital certificate digital certificates key escrow key recovery registration authority revocation Trust and Certificate Verification Process trust models R Redundant Array of Independent Disks (RAID) applications inexpensive redundancy mirrored drives/expensive no redundancy/improve performance Remote access protocols IEEE 802.1x RADIUS TACACS+ Risk management affinity grouping annual loss expectancy asset identification baseline identification and analysis cause-and-effect analysis certification and accreditation agreements approval to operate guidelines process control design and evaluation cost–benefit analysis Gantt charts intangible impact interrelationship digraphs Pareto chart PERT plan documenting qualitative risk analysis residual risk management tangible Impact threat assessment vulnerabilities S Secure development life cycle (SDL) coding phase buffer overflow injections least privilege programming Errors list software vulnerabilities SQL injection vulnerability design phase requirement phase testing phase Secure/Multipurpose Internet Mail Extensions (S/MIME) Secure shell (SSH) protocol Security auditing Security concerns disconnection packet Sniffing unauthorized access Security access control authentication communications security diversity of defense domain information security model desired goals information states safeguards operational model social engineering template zones Service-level agreement (SLA) Service set identifier (SSID) Software engineering Spoofing IP address sequence number trusted relationship Steganography Storage Area Network (SAN) Storage media Systematic Development of Software System-level events T TCP vs UDP ICMP packet delivery local packet delivery remote packet delivery three-way handshake pattern Tunneling U Unauthorized access Uninterruptible power supplies (UPSs) User-level events V Virtualization technologies basic packet filtering bridges firewalls hubs network switches routers stateful packet filtering vulnerabilities Virtual LAN (VLAN) Virtual private networks (VPNs) W, X, Y, Z Web components ASP ActiveX technology browser plug-ins buffer overflows common gateway interface cookies DAP/LDAP FTP/SFTP HTTP/HTTPS Java OVAL signed applet SSL/TLS Web 2.0 site Windows 2019 Server users group management password expiration password policy consequences construction domain elements protection reuse restrictions/duration permissions control rights rights assignment policies setting log-on hours single sign-on time-of-Day Restrictions tokens Windows Defender Wireless Application Protocol (WAP) Wireless networking access points bluetooth IEEE 802.11 protocol access point attacks beacon frame EAP–MD5 EAP–TLS EAP–TTLS frequency modulation individual standard speed and frequency range SSID Wired equivalent privacy NetStumbler security protocols WAP gateway Wireless Transport Layer Security (WTLS)