CompTIA Security+: SY0-601 Certification Guide: Complete coverage of the new CompTIA Security+ (SY0-601) exam to help you pass on the first attempt
By Ian Neil
()
About this ebook
The CompTIA Security+ certification validates the fundamental knowledge required to perform core security functions and pursue a career in IT security. Authored by Ian Neil, a world-class CompTIA certification trainer, this book is a best-in-class study guide that fully covers the CompTIA Security+ 601 exam objectives.
Complete with chapter review questions, realistic mock exams, and worked solutions, this guide will help you master the core concepts to pass the exam the first time you take it. With the help of relevant examples, you'll learn fundamental security concepts from certificates and encryption to identity and access management (IAM). As you progress, you'll delve into the important domains of the exam, including cloud security, threats, attacks and vulnerabilities, technologies and tools, architecture and design, risk management, cryptography, and public key infrastructure (PKI).
You can access extra practice materials, including flashcards, performance-based questions, practical labs, mock exams, key terms glossary, and exam tips on the author's website at securityplus.training.
By the end of this Security+ book, you'll have gained the knowledge and understanding to take the CompTIA exam with confidence.
Read more from Ian Neil
CompTIA Security+ SY0-701 Certification Guide: Master cybersecurity fundamentals and pass the SY0-701 exam on your first attempt Rating: 0 out of 5 stars0 ratingsCompTIA Security+ Certification Guide: Master IT security essentials and exam topics for CompTIA Security+ SY0-501 certification Rating: 0 out of 5 stars0 ratings
Related to CompTIA Security+
Related ebooks
CCNA Security 210-260 Certification Guide: Build your knowledge of network security and pass your CCNA Security exam (210-260) Rating: 0 out of 5 stars0 ratingsCybersecurity: The Beginner's Guide: A comprehensive guide to getting started in cybersecurity Rating: 5 out of 5 stars5/5(ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests Rating: 0 out of 5 stars0 ratingsBug Bounty Hunting Essentials: Quick-paced guide to help white-hat hackers get through bug bounty programs Rating: 0 out of 5 stars0 ratingsCertified Information Security Manager Exam Prep Guide: Gain the confidence to pass the CISM exam using test-oriented study material Rating: 0 out of 5 stars0 ratingsPractical Internet of Things Security: Design a security framework for an Internet connected ecosystem Rating: 0 out of 5 stars0 ratingsPractical Industrial Internet of Things Security: A practitioner's guide to securing connected industries Rating: 0 out of 5 stars0 ratingsPractical Network Scanning: Capture network vulnerabilities using standard tools such as Nmap and Nessus Rating: 0 out of 5 stars0 ratingsApplied Network Security Rating: 0 out of 5 stars0 ratingsComputer Networking: Beginners Guide to Network Security & Network Troubleshooting Fundamentals Rating: 0 out of 5 stars0 ratingsCASP+ CompTIA Advanced Security Practitioner Study Guide: Exam CAS-003 Rating: 0 out of 5 stars0 ratingsPractical Cyber Intelligence: How action-based intelligence can be an effective response to incidents Rating: 0 out of 5 stars0 ratingsCybersecurity - Attack and Defense Strategies: Infrastructure security with Red Team and Blue Team tactics Rating: 5 out of 5 stars5/5(ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests Rating: 5 out of 5 stars5/5(ISC)2 SSCP Systems Security Certified Practitioner Official Practice Tests Rating: 0 out of 5 stars0 ratingsMastering Information Security Compliance Management: A comprehensive handbook on ISO/IEC 27001:2022 compliance Rating: 0 out of 5 stars0 ratingsHands-On Machine Learning for Cybersecurity: Safeguard your system by making your machines intelligent using the Python ecosystem Rating: 0 out of 5 stars0 ratingsCompTIA PenTest+ Study Guide: Exam PT0-001 Rating: 0 out of 5 stars0 ratings
Certification Guides For You
CompTIA A+ Certification All-in-One For Dummies Rating: 3 out of 5 stars3/5CompTIA Security+ Certification Practice Exams, Fourth Edition (Exam SY0-601) Rating: 5 out of 5 stars5/5CompTIA A+ Complete Review Guide: Core 1 Exam 220-1101 and Core 2 Exam 220-1102 Rating: 5 out of 5 stars5/5CompTIA Security+ Get Certified Get Ahead: SY0-701 Study Guide Rating: 5 out of 5 stars5/5Coding For Dummies Rating: 5 out of 5 stars5/5Coding All-in-One For Dummies Rating: 4 out of 5 stars4/5CompTIA Security+ Study Guide: Exam SY0-601 Rating: 5 out of 5 stars5/5CompTIA A+ Complete Study Guide: Exam Core 1 220-1001 and Exam Core 2 220-1002 Rating: 4 out of 5 stars4/5Mike Meyers CompTIA Security+ Certification Passport, Sixth Edition (Exam SY0-601) Rating: 5 out of 5 stars5/5CompTIA CySA+ Practice Tests: Exam CS0-002 Rating: 0 out of 5 stars0 ratingsUnderstanding Cisco Networking Technologies, Volume 1: Exam 200-301 Rating: 0 out of 5 stars0 ratingsConcise and Simple Guide to IP Subnets Rating: 5 out of 5 stars5/5Comptia A+ 220-901 Q & A Study Guide: Comptia 21 Day 900 Series, #2 Rating: 5 out of 5 stars5/5CompTIA Security+ Study Guide with over 500 Practice Test Questions: Exam SY0-701 Rating: 0 out of 5 stars0 ratingsMike Meyers' CompTIA Security+ Certification Guide, Third Edition (Exam SY0-601) Rating: 5 out of 5 stars5/5CompTIA Network+ Review Guide: Exam N10-008 Rating: 0 out of 5 stars0 ratingsAWS Certified Cloud Practitioner All-in-One Exam Guide (Exam CLF-C01) Rating: 5 out of 5 stars5/5CompTIA Data+ Study Guide: Exam DA0-001 Rating: 0 out of 5 stars0 ratingsCCNA Certification Study Guide, Volume 2: Exam 200-301 Rating: 0 out of 5 stars0 ratingsPHR and SPHR Professional in Human Resources Certification Complete Study Guide: 2018 Exams Rating: 0 out of 5 stars0 ratingsCISSP Official (ISC)2 Practice Tests Rating: 5 out of 5 stars5/5CompTIA Network+ Practice Tests: Exam N10-008 Rating: 0 out of 5 stars0 ratingsCompTIA Network+ Certification Guide (Exam N10-008): Unleash your full potential as a Network Administrator (English Edition) Rating: 0 out of 5 stars0 ratingsCompTIA Network+ CertMike: Prepare. Practice. Pass the Test! Get Certified!: Exam N10-008 Rating: 0 out of 5 stars0 ratingsMike Meyers' CompTIA A+ Certification Passport, Seventh Edition (Exams 220-1001 & 220-1002) Rating: 2 out of 5 stars2/5CompTIA A+ CertMike: Prepare. Practice. Pass the Test! Get Certified!: Core 1 Exam 220-1101 Rating: 0 out of 5 stars0 ratings
Reviews for CompTIA Security+
0 ratings0 reviews
Book preview
CompTIA Security+ - Ian Neil
BIRMINGHAM—MUMBAI
CompTIA Security+: SY0-601 Certification Guide
Second Edition
Copyright © 2020 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing or its dealers and distributors, will be held liable for any damages caused or alleged to have been caused directly or indirectly by this book.
Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.
Commissioning Editor: Vijin Boricha
Acquisition Editor: Rahul Nair
Senior Editor: Arun Nadar
Content Development Editor: Pratik Andrade
Technical Editor: Yoginee Marathe
Copy Editor: Safis Editing
Project Coordinator: Neil Dmello
Proofreader: Safis Editing
Indexer: Safis Editing
Production Designer: Shantanu Zagade
First published: September 2018
Second Edition published December 2020, updated November 2021
Production reference: 5050623
Published by Packt Publishing Ltd.
Livery Place
35 Livery Street
Birmingham
B3 2PB, UK.
ISBN 978-1-80056-424-4
www.packt.com
2Packt.com
Subscribe to our online digital library for full access to over 7,000 books and videos, as well as industry leading tools to help you plan your personal development and advance your career. For more information, please visit our website.
Why subscribe?
Spend less time learning and more time coding with practical eBooks and Videos from over 4,000 industry professionals
Improve your learning with Skill Plans built especially for you
Get a free eBook or video every month
Fully searchable for easy access to vital information
Copy and paste, print, and bookmark content
Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at packt.com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at [email protected] for more details.
At www.packt.com, you can also read a collection of free technical articles, sign up for a range of free newsletters, and receive exclusive discounts and offers on Packt books and eBooks.
Contributors
About the author
Ian Neil is one of the world's top trainers of Security+. He is able to break down information into manageable chunks so that people with no background knowledge can gain the skills required to become certified. He has recently worked for the US Army in Europe and designed a Security+ course that catered to people from all backgrounds (not just IT professionals), with an extremely successful pass rate. He is an MCT, MCSE, A+, Network+, Security+, CASP, and RESILIA practitioner, who, over the past 23 years, has worked with high-end training providers and was one of the first technical trainers to train Microsoft internal staff when they opened their Bucharest Office in 2006.
About the reviewers
Crystal Voiles is an IT specialist with more than 30 years of IT experience ranging from help desk support, desktop support, system administration, and cyber security support.
For the last 10 years, she has served as a cyber security specialist, managing several cyber security tools, including Assured Compliance Assessment Solution (ACAS), Host-Based Security System (HBSS), Tanium, System Center Configuration Manager (SCCM), and Enterprise Mission Assurance Support Service (eMASS).
Currently serving as the Information Systems Security Manager (ISSM) for a small medical organization responsible for coordination and execution of security policies and controls, as well as assessing vulnerabilities within a medical company. She is responsible for data and network security processing, security systems management, and security violation investigations. She manages backup and security systems, employee training for approximately 900 end user accounts, security planning measures, and recovery of data in disaster testing situations.
Her certifications include Certified Information Systems Security Professional (CISSP), CompTIA Advanced Security Practitioner (CASP+), Security +, Microsoft Certified Professional (MCP), SCCM, and ITIL Foundations.
Rebecca Moffitt is an experienced information security and risk consultant with 8 years of experience in the industry.
Rebecca joined QA in October of 2018, and since then has been working as a cyber security technical specialist. Her areas of training have been primarily related to cyber security, information security, information assurance, and risk management. She most recently obtained her CISM via ISACA, and her CSRM via PECB. She is a certified Information Security Management Systems Lead Implementer and is proficient in ISO 27001, 27002, 27005, and has knowledge of ISO 31000, 27035, and 19011, as well as various cyber, information, and risk frameworks.
Rebecca is passionate about her profession and has spent time working with the younger generations, raising their awareness of the field of cyber/information security and sparking enthusiasm in them about a potential career in cyber security.
On a personal level, Rebecca is Canadian. The country lifestyle is rooted within her. She loves all things related to the East Coast lifestyle: kitchen parties, country music, and fiddleheads.
I would like to thank my family always, for their continual love and support.
- Rebecca Moffitt
Sunil Gupta is an experienced computer programmer and cybersecurity expert and consults in Information Technology with a focus on cybersecurity. He is an invited speaker for, and a member of, many key organizations.
Sunil has helped many organizations around the Globe, including Barclays Bank; Aviation College Qatar (QATAR); Ethiopian Airlines; Telecom Authority Tanzania; NCB Bank (Saudi Arabia); Accenture (India); Afghan Wireless (Afghanistan); and many more.
Currently, he teaches online over 60,000 students in more than 170 countries and some of his best work has been published by major publishing houses. Some of his best courses include: End-to-End Penetration Testing with Kali Linux and Threat and Vulnerability Assessment for Enterprises.
His cybersecurity certifications include SSCP Certification (Systems Security Certified Practitioner), Bug Bounty Program Certification, and more.
Packt is searching for authors like you
If you're interested in becoming an author for Packt, please visit authors.packtpub.com and apply today. We have worked with thousands of developers and tech professionals, just like you, to help them share their insight with the global tech community. You can make a general application, apply for a specific hot topic that we are recruiting an author for, or submit your own idea.
Table of Contents
Preface
Objectives for the CompTIA Security+ 601 exam
Section 1: Security Aims and Objectives
Chapter 1: Understanding Security Fundamentals
Security Fundamentals
CIA Triad Concept
Least Privilege
Defense in Depth Model
Comparing Control Types
Managerial Controls
Operational Controls
Technical Controls
Deterrent Controls
Detective Controls
Corrective Controls
Compensating Controls
Preventative Controls
Access Controls
Discretionary Access Control
Mandatory Access Control
Role-Based Access Control
Rule-Based Access Control
Attribute-Based Access Control
Group-Based Access Control
Linux-Based Access Control
Physical Security Controls
Perimeter Security
Building Security
Device Protection
Understanding Digital Forensics
Five-Minute Practical
Collection of Evidence
Cloud Forensics
Review Questions
Chapter 2: Implementing Public Key Infrastructure
PKI Concepts
Certificate Hierarchy
Certificate Trust
Certificate Validity
Certificate Management Concepts
Types of Certificates
Asymmetric and Symmetric Encryption
Encryption Explained
Digital Signatures Explained
Cryptography Algorithms and Their Characteristics
Symmetric Algorithms
Asymmetric Algorithms
Symmetric versus Asymmetric Analogy
Lightweight Cryptography
XOR Encryption
Key Stretching Algorithms
Salting Passwords
Cipher Modes
Stream versus Block Cipher Analogy
Modes of Operation
Quantum Computing
Blockchain and the Public Ledger
Hashing and Data Integrity
Comparing and Contrasting the Basic Concepts of Cryptography
Asymmetric – PKI
Symmetric Algorithm – Modes of Operation
Hashing Algorithms
Crypto Service Provider
Crypto Module
Data Protection
Basic Cryptographic Terminologies
Obfuscation
Pseudo-Random Number Generator
Nonce
Perfect Forward Secrecy
Security through Obscurity
Collision
Steganography
Homomorphic Encryption
Diffusion
Implementation Decisions
Common Use Cases for Cryptography
Supporting Confidentiality
Supporting Integrity
Supporting Non-Repudiation
Supporting Obfuscation
Low-Power Devices
High Resiliency
Supporting Authentication
Resource versus Security Constraints
Practical Exercises
Practical Exercise 1 – Building a Certificate Server
Practical Exercise 2 – Encrypting Data with EFS and Stealing Certificates
Practical Exercise 3 – Revoking the EFS Certificate
Review Questions
Chapter 3: Investigating Identity and Access Management
Understanding Identity and Access Management Concepts
Identity Types
Account Types
Authentication Types
Security Tokens and Devices
Certificate-Based Authentication
Implementing Authentication and Authorization Solutions
Authentication Management
Authentication Protocols
Authentication, Authorization, and Accounting (AAA) Servers
Access Control Schemes
Summarizing Authentication and Authorization Design Concepts
Directory Services
Cloud versus On-Premises Authentication
On-Premises
In the Cloud
Common Account Management Policies
Account Creation
Employees Moving Departments
Account Recertification
Account Maintenance
Account Monitoring
Security Information and Event Management
Practical Exercise – Password Policy
Review Questions
Chapter 4: Exploring Virtualization and Cloud Concepts
Overview of Cloud Computing
Implementing Different Cloud Deployment Models
Understanding Cloud Service Models
Infrastructure as a Service (IaaS)
Software as a Service (SaaS)
Platform as a Service (PaaS)
Security as a Service (SECaaS)
Anything as a Service (XaaS)
Understanding Cloud Computing Concepts
Understanding Cloud Storage Concepts
Selecting Cloud Security Controls
High Availability Access Zones
Resource Policies
Secret Management
Integration and Auditing
Storage
Networks
Compute
Solutions
Exploring the Virtual Network Environments
Review Questions
Section 2: Monitoring the Security Infrastructure
Chapter 5: Monitoring, Scanning, and Penetration Testing
Penetration Testing Concepts
Rules of Engagement (ROE)
Network Exploitation Techniques
Passive and Active Reconnaissance
Reconnaissance Tools
Exercise Types
Vulnerability Scanning Concepts
Credentialed versus Non-Credentialed Scans
Intrusive versus Non-Intrusive Vulnerability Scans
Other Types of Scans That Can Be Performed
Penetration Testing versus Vulnerability Scanning
Syslog/Security Information and Event Management
Security Orchestration, Automation, and Response
Threat Hunting
Review Questions
Chapter 6: Understanding Secure and Insecure Protocols
Introduction to Protocols
Insecure Protocols and Their Use Cases
Secure Protocols and Their Use Cases
Additional Use Cases and Their Protocols
Subscription Services and Their Protocols
Routing and Its Protocols
Switching and Its Protocols
Active Directory (Directory Services) and Its Protocols
Review Questions
Chapter 7: Delving into Network and Security Concepts
Installing and Configuring Network Components
Firewall
Network Address Translation Gateway
Router
Access Control List – Network Devices
Switch
Tap/Port Mirror
Aggregation Switches
Honeypot
Honeyfile
Fake Telemetry
Proxy Server
Jump Servers
Load Balancer
Remote Access Capabilities
IPSec
VPN Concentrator
Split Tunneling
Remote Support
Secure Network Architecture Concepts
Software-Defined Network
Network Segmentation
Intrusion Prevention System
Intrusion Detection System
Modes of Operation
Sensor/Collector
Monitoring Data
Network Access Control
Domain Name System
DNS Poisoning
DNS Sinkhole
Network Reconnaissance and Discovery
Exploitation Frameworks
Forensic Tools
IP Addressing
IP Schema
IP Version 4
Subnet Mask
CIDR Mask
Network Address Allocation
IP Version 6 Addressing
Review Questions
Chapter 8: Securing Wireless and Mobile Solutions
Implementing Wireless Security
Wireless Access Point Controllers
Securing Access to Your WAP
Wireless Bandwidth/Band Selection
Wireless Channels
Wireless Antenna Types
Wireless Coverage
Wireless – Open System Authentication
Wireless Encryption
Wireless Captive Portals
Wireless Attacks
Wireless Authentication Protocols
Deploying Mobile Devices Securely
Mobile Device Management
Bring Your Own Device
Choose Your Own Device
Corporate-Owned Personally-Enabled
Mobile Device Connection Methods
Mobile Device Management Concepts
Device Management
Device Protection
Device Data
Mobile Device Enforcement and Monitoring
Review Questions
Section 3: Protecting the Security Environment
Chapter 9: Identifying Threats, Attacks, and Vulnerabilities
Virus and Malware Attacks
Social Engineering Attacks
Threat Actors
Advanced Attacks
Password Attacks
Physical Attacks
On-Path Attacks
Network Attacks
Application/Programming Attacks
Hijacking-Related Attacks
Driver Manipulation
Cryptographic Attacks
Security Concerns with Various Type of Vulnerabilities
Cloud vs. On-Premises Vulnerabilities
Third-Party Risks
Review Questions
Chapter 10: Governance, Risk, and Compliance
Risk Management Processes and Concepts
Risk Types
Risk Management Strategies
Risk Analysis
Calculating Loss
Disasters
Business Impact Analysis Concepts
Threat Actors, Vectors, and Intelligence Concepts
Threat Actors
Attack Vectors
Threat Intelligence Sources
Research Sources
The Importance of Policies for Organizational Security
Personnel
Diversity of Training Techniques
Third-Party Risk Management
Data
Credential Policies
Organizational Policies
Regulations, Standards, and Legislation
Key Frameworks
Benchmarks/Secure Configuration Guides
Privacy and Sensitive Data Concepts
Data Sovereignty
Legal implications
Geographic considerations
Organizational Consequences of Privacy Breaches
Notifications of Breaches
Data Types
Privacy-Enhancing Technologies
Data Roles and Responsibilities
Information Life Cycle
Impact Assessment
Terms of Agreement
Privacy Notice
Review Questions
Chapter 11: Managing Application Security
Implementing Host or Application Security
Boot Integrity
Endpoint Protection
Databases
Application Security
Hardening
Full Disk Encryption (FDE)
Self-Encrypting Drives (SEDs)
Understanding the Security Implications of Embedded and Specialist Systems
Internet of Things (IoT)
Real-Time Operating System (RTOS)
Multifunctional Printers (MFPs)
Surveillance Systems
System on a Chip (SoC)
Heating, Ventilation, and Air Conditioning (HVAC)
Specialized Devices
Embedded Systems
Supervisory Control and Data Acquisition (SCADA)
Industrial Control System
Communication Considerations
Constraints
Understanding Secure Application Development, Deployment, and Automation
Software Diversity
Elasticity
Scalability
Environment
Automation/Scripting
Provisioning and Deprovisioning
Version Control
Integrity Measurement
Secure Coding Techniques
Open Web Application Security Project (OWASP)
Review Questions
Chapter 12: Dealing with Incident Response Procedures
Incident Response Procedures
Response and Recovery Controls
Disaster Recovery Exercises
Attack Frameworks
Stakeholder Management
Continuity of Operations Planning (COOP)
Utilizing Data Sources to Support Investigations
Vulnerability Scan Output
SIEM Dashboards
Log Files
Log Managers
journalctl
NXLog
Bandwidth Monitors
Metadata
Network Monitoring
Protocol Analyzer Output
Knowing How to Apply Mitigation Techniques or Controls to Secure an Environment
Reconfigure Endpoint Security Solutions
Application Approved List
Application Block List/Deny List
Quarantine
Configuration Management
Isolation
Containment
Segmentation
Security Orchestration, Automation, and Response (SOAR)
Implementing Cybersecurity Resilience
Redundancy
Review Questions
Section 4: Mock Tests
Chapter 13: Mock Exam 1
Mock Exam 1 Solutions
Chapter 14: Mock Exam 2
Mock Exam 2 Solutions
Chapter Review Solutions
Other Books You May Enjoy
Preface
This book will help you to understand security fundamentals, ranging from the CIA triad to identity and access management. This book describes network infrastructure and how it is evolving with the implementation of virtualization and different cloud models and their storage. You will learn how to secure devices and applications that are used by a company.
Who this book is for
This book is designed for anyone who is seeking to pass the CompTIA Security+ SY0-601 exam. It is a stepping-stone for anyone who wants to become a security professional or move into cybersecurity.
What this book covers
Chapter 1, Understanding Security Fundamentals, covers some security fundamentals that will be expanded upon in later chapters.
Chapter 2, Implementing Public Key Infrastructure, goes into the different encryption types and teaches how certificates are issued and used.
Chapter 3, Investigating Identity and Access Management, looks at different types of authentication. We will look at the concepts of identity and access management.
Chapter 4, Exploring Virtualization and Cloud Concepts, gets you acquainted with various cloud models and cloud security, looking at their deployment and storage environments.
Chapter 5, Monitoring, Scanning, and Penetration Testing, looks at penetration testing, exercise types, scanning, threat hunting, and SIEM systems.
Chapter 6, Understanding Secure and Insecure Protocols, looks at when to use certain secure protocols.
Chapter 7, Delving into Network and Security Concepts, looks at network components, remote access, and network reconnaissance tools.
Chapter 8, Securing Wireless and Mobile Solutions, looks at wireless solutions and secure mobile solutions.
Chapter 9, Identifying Threats, Attacks, and Vulnerabilities, explores attacks and vulnerabilities, taking each type of attack in turn and identifying its unique characteristics. This chapter is probably the most heavily tested module in the Security+ exam.
Chapter 10, Governance, Risk, and Compliance, looks at risk management and regulations, as well as frameworks.
Chapter 11, Managing Application Security, looks at application development and security.
Chapter 12, Dealing with Incident Response Procedures, covers disaster recovery preparation and recovery methods in practice.
Chapter 13, Mock Exam 1, includes mock questions, along with explanations, which will help assess whether you're ready for the test.
Chapter 14, Mock Exam 2, includes more mock questions, along with explanations, which will help assess whether you're ready for the test.
To get the most out of this book
This certification guide assumes no prior knowledge of the product. You need to understand the information fully to become certified.
Additional online resources
You can find further exam support and extra practice resources on the author's website at www.securityplus.training. Additional materials include exam guidance, study flashcards, performance-based questions, and mock exams.
Download the color images
We also provide a PDF file that has color images of the screenshots/diagrams used in this book. You can download it here: http://www.packtpub.com/sites/default/files/downloads/9781800564244_ColorImages.pdf.
Conventions used
There are a number of text conventions used throughout this book.
Code in text: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles. Here is an example: The problem that arises is that strcpy cannot limit the size of characters being copied.
A block of code is set as follows:
int fun (char data [256]) {
int I
char tmp [64], strcpy (tmp, data);
}
Any command-line input or output is written as follows:
Set-ExecutionPolicy Restricted
Bold: Indicates a new term, an important word, or words that you see onscreen. For example, words in menus or dialog boxes appear in the text like this. Here is an example: The SSID is still enabled. The administrator should check the box next to Disable Broadcast SSID.
Tips or important notes
Appear like this.
Get in touch
Feedback from our readers is always welcome.
General feedback: If you have questions about any aspect of this book, mention the book title in the subject of your message and email us at [email protected].
Errata: Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you have found a mistake in this book, we would be grateful if you would report this to us. Please visit www.packtpub.com/support/errata, selecting your book, clicking on the Errata Submission Form link, and entering the details.
Piracy: If you come across any illegal copies of our works in any form on the Internet, we would be grateful if you would provide us with the location address or website name. Please contact us at [email protected] with a link to the material.
If you are interested in becoming an author: If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, please visit authors.packtpub.com.
Reviews
Please leave a review. Once you have read and used this book, why not leave a review on the site that you purchased it from? Potential readers can then see and use your unbiased opinion to make purchase decisions, we at Packt can understand what you think about our products, and our authors can see your feedback on their book. Thank you!
You can leave a review on Amazon using the following link: https://packt.link/r/9781800564244.
For more information about Packt, please visit packt.com.
Objectives for the CompTIA Security+ 601 exam
Listed below are the exam objectives for the CompTIA 601 exam and the relevant chapters in the book where the information is located. There is a comprehensive index to help you find a particular exam topic. Additional resources for the exam can be found at www.securityplus.training.
Details of the exam are as follows:
Exam Code: SY0-601
Number of questions: Maximum of 90
Types of questions: Multiple-choice and performance-based
Duration: 90 minutes
Exam Objectives (Domains)
The following tables show the chapters in which the various defined domains measured by the examination are covered:
123a44
5
Section 1: Security Aims and Objectives
In this section, you will learn about security fundamentals, from the CIA triad through to identify and access management.
This section comprises the following chapters:
Chapter 1, Understanding Security Fundamentals
Chapter 2, Implementing Public Key Infrastructure
Chapter 3, Investigating Identity and Access Management
Chapter 4, Exploring Virtualization and Cloud Concepts
Chapter 1: Understanding Security Fundamentals
In this chapter, we are going to look at some security fundamentals that will help you identify security threats in the system and mitigate them. With cybercrime increasing day by day, as an Information Technology (IT) professional, it is essential to first understand these fundamental concepts.
In this chapter, we will be covering the following topics:
Security Fundamentals
Comparing Control Types
Physical Security Controls
Understanding Digital Forensics
Let's start by looking at security fundamentals.
Security Fundamentals
The fundamentals of security are the foundation of protecting our assets, and there must be a strategy or methodology that we adapt for security. This is the CIA triad; let's look at its breakdown.
CIA Triad Concept
Most security books start with the basics of security by featuring the CIA triad—this is a conceptual model designed to help those writing information security policies within an organization. It is a widely used security model and it stands for confidentiality, integrity, and availability, the three key principles that should be used to guarantee you have a secure system:
Figure 1.1 – CIA triadFigure 1.1 – CIA triad
We'll discuss these principles in more depth here:
Confidentiality: Prevents the disclosure of data to unauthorized people so that only authorized people have access to data. This is known as the need-to-know basis. Only those who should know the contents should be given access. An example would be that your medical history is only available to your doctor and nobody else.
We also tend to encrypt data to keep it confidential. There are two types of encryption, known as symmetric and asymmetric. Symmetric encryption uses one key, known as the secret key. Asymmetric encryption uses two keys, known as the private key and the public key.
Integrity: This means that you know that data has not been altered or tampered with. We use a technique called hashing that takes the data and converts it into a numerical value called a hash or message digest. When you suspect changes have taken place, you would check the hash value against the original. If the hash value has changed, then the data has been tampered with. Common hashing algorithms covered in the exam are Secure Hash Algorithm Version 1 (SHA1) 160-bit and Message Digest Version 5 (MD5) 128-bit. SHA1 is more secure than MD5; however, MD5 is faster. The higher the number of bits, the more secure, and the lower the number, the faster it is.
Availability: Availability ensures that data is always available; an example would be if you wanted to purchase an airplane ticket and the system came back with an error saying that you could not purchase it. This could be frustrating, and therefore, availability is important. Examples of availability include Redundant Array of Independent Disks (RAID), which allows one or two disks to fail while still keeping the data available. Another example may be a fail-over cluster. In this, two servers can access the same data, and if one fails, the other can still provide the data, a data backup, or Heating Ventilation Air Conditioning (HVAC) that regulates the temperature for critical servers. In a datacentre, if the temperature is too hot then the servers will shut down.
Least Privilege
Least Privilege is where you give someone only the most limited access required so that they can perform their job role; this is known as a need-to-know basis. The company will write a least privilege policy so that the administrators know how to manage it.
Defense in Depth Model
Defense in Depth is the concept of protecting a company's data with a series of protective layers so that if one layer fails, another layer will already be in place to thwart an attack. We start with our data, then we encrypt it to protect it:
The data is stored on a server.
The data has file permissions.
The data is encrypted.
The data is in a secure area of the building.
There is a security guard at the building entrance checking identification.
There is CCTV around the perimeter.
There is a high fence around the perimeter.
Let's look at this from the intruder's perspective, trying to jump the fence, and see how many layers they have to circumvent:
Figure 1.2 – Defense in Depth modelFigure 1.2 – Defense in Depth model
Let's now compare the different control types.
Comparing Control Types
There is a wide variety of different security controls that are used to mitigate the risk of being attacked; the three main categories are managerial, operational, and technical. We are going to look at these in more detail; you need to be familiar with each of these controls and when each of them should be applied. Let's start by looking at the three main controls.
Managerial Controls
Managerial Controls are written by managers to create organizational policies and procedures to reduce risk within companies. They incorporate regulatory frameworks so that the companies are legally compliant. The following are examples of management controls:
Annual Risk Assessment: A company will have a risk register where the financial director will look at all of the risks associated with money and the IT manager will look at all of the risks posed by the IT infrastructure. As technology changes and hackers get more sophisticated, the risks can become greater. Each department will identify their risks and the risk treatments, and place them in the risk register. These should be reviewed annually.
Penetration Testing/Vulnerability Scanning: A vulnerability scan is not intrusive as it merely checks for vulnerabilities, whereas a penetration test is more intrusive, as it goes deeper into a computer and can exploit vulnerabilities. It could cause the system to crash unexpectantly. These will be explained further later in this book.
Operational Controls
Operational controls are executed by company personnel during their day-to-day operations. Examples of these are the following:
Annual Security Awareness Training: This is an annual event in which you are reminded about what you should be doing each day to keep the company safe:
Example 1 – When you are finished for the day, you should clear your desk and lock all documents away.
Example 2 – Employees and visitors should wear an identity badge at all times. If they do not, they should be challenged.
Example 3 – Companies need their employees to complete annual cybersecurity training as the risk is getting greater each day.
Change Management: This is a process that a company adopts so that changes made don't cause any security risks to the company. A change to one department could impact another department. The Change Advisory Board (CAB) assists with the prioritization of changes; they also look at the financial benefits of the change and they may accept or reject the changes proposed for the benefit of the company. IT evolves rapidly and our processes will need to change to cope with the potential security risks associated with newer technology.
Business Continuity Plan: This is contingency planning to keep the business up and running when a disaster occurs by identifying any single point of failure that would prevent the company from remaining operational.
Technical Controls
Technical Controls are those implemented by the IT team to reduce the risk to the business.
These could include the following:
Firewall Rules: Firewalls prevent unauthorized access to the network by IP address, application, or protocol. These are covered in depth later in this book.
Antivirus/Antimalware: This is the most common threat to a business, and we must ensure that all servers and desktops are protected and up to date.
Screen Savers: These log computers off when they are idle, preventing access.
Screen Filters: These prevent people that are walking past from reading the data on your screen.
Intrusion Prevention System (IPS)/Intrusion Detection System (IDS): An IDS monitors the network for any changes and an IPS stops the attacks. If you do not have an IDS, the IPS can also fulfill the role of the IDS. These are covered more in-depth in Chapter 7.
Let's now look at other control types, from deterrents to physical controls, when we try and stop attacks at the source.
Deterrent Controls
Deterrent Controls could be CCTV and motion sensors. When someone is walking past a building and the motion sensors detect them, it turns the lights on to deter them. A building with a CCTV camera in a prominent position and a sign warning people that they are being recorded may act as a deterrent.
Detective Controls
Detective Controls are used to investigate an incident that has happened and needs to be investigated; these could include the following:
CCTV records events as they happen and from that, you can see who has entered a particular room or has climbed through a window at the rear of a building. CCTV can capture motion and provide non-repudiation.
Log Files are text files that record events and the times that they occurred; they can log trends and patterns over a period of time. For example, servers, desktops, and firewalls all have event logs that detail actions that happen. Once you know the time and date of an event, you can gather information from various log files. These can be stored in Write-Once Read-Many (WORM) drives so that they can be read but not tampered with.
Corrective Controls
Corrective Controls are the actions you take to recover from an incident. You may lose a hard drive that contained data; in that case, you would replace the data from a backup you had previously taken.
Fire Suppression Systems are another form of corrective control. There may have been a fire in your data center that destroyed many servers, therefore, when you purchase replacement servers, you may install an oxygen suppressant system that will starve a fire of the oxygen needed. This method uses argon/nitrogen and carbon dioxide to displace the oxygen in the server room.
Compensating Controls
Compensating Controls can also be called Alternative or Secondary Controls and can be used instead of a primary control that has failed or is not available. Once a primary control has failed, we need a secondary control. This is similar to when you go shopping and you have $100 in cash—once you have spent your cash, you will have to use a credit card as a compensating control.
Example: When a new employee arrives, they should log in using a smart card and PIN. It may take 3–5 days to get a new smart card, so during the waiting period, they may log in using a username and password.
Preventative Controls
Preventative Controls are in place to deter any attack; this could be having a security guard with a large dog walking around the perimeter of your building. This would make someone trying to break in think twice about doing so. Some of the preventive measures that can be taken are as follows:
Disable User Accounts: When someone leaves a company, the first thing that happens is that their account is disabled, as we don't want to lose information that they have access to, and then we change the password so that they cannot access it. We may also disable an account while people are on secondment, maternity leave or if we find that account has been used in an attack on our network.
Operating System Hardening: This makes a computer more secure, where we ensure that the operating system is fully patched and turn off unused features and services. This will ensure that there will be no vulnerabilities. The US Department of Defence (DOD) has a guide called the Security Technical Implementation Guide (STIG), this contains guidance on how to 'lock down' the computer systems and software to prevent them from being vulnerable to attack.
Access Controls
The three main parts of access controls are identifying an individual, authenticating them when they insert a password or PIN, and then authorization, where an individual is granted permission to the different forms of data. For example, someone working in finance will need a higher level of security clearance and have to access different data than a person who dispatches an order in finished goods:
Identification: This is similar to everyone having their own bank account; the account is identified by the account details on the bank card. Identification in a secure environment may involve having a user account, a smart card, or maybe some sort of biometrics such as fingerprint or face as these are unique to each individual. Each person has their own Security Identifier (SID) for their account, which is like an account serial number.
Authentication: Once the individual inserts their method of identification, they next have to be authenticated, for example, by inserting a password or a PIN.
Authorization: This is the level of access or permissions that you have to apply to selected data. You are normally a member of certain groups, for example, a sales manager could access data from the sales group and then access data from the managers' group. You will only be given the minimum amount of access required to perform your job; this is known as least privilege.
Discretionary Access Control
Discretionary Access Control is similar to the New Technology File System (NTFS) file permissions, which are used in Microsoft operating systems. The user is only given the access that they need to perform their job. They are sometimes referred to as user-based or user-centric. The permissions are as follows:
Full Control: Full access.
Modify: Change data, read, and read and execute.
Read and Execute: Read the file and run a program if one is inside it.
List Folder Contents: Expand a folder to see the subfolders inside it.
Read: Read the contents.
Write: This allows you to write to the file.
Special Permissions: Allows granular access; for example, it breaks each of the previous permissions down to a more granular level.
Data Creator/Owner: The person that creates the unclassified data is called the owner and they are responsible for checking who has access to that data.
The following diagram shows a user called Ian who has Read and Read & Execute permissions:
Figure 1.3 – DAC file permissionsFigure 1.3 – DAC file permissions
Mandatory Access Control
Mandatory Access Control (MAC) is based on the classification level of the data. MAC looks at how much damage could be inflicted to the interests of the nation. These are as follows:
Top secret: Highest level, exceptionally grave damage
Secret: Causes serious damage
Confidential: Causes damage
Restricted: Undesirable effects
Examples of MAC based on the classification level of data are as follows:
Top secret: Nuclear energy project
Secret: Research and development
Confidential: Ongoing legal issues
MAC Roles
Once classified data has been written, it is owned by the company. For example, if a Colonel writes a classified document, it belongs to the Army. Let's look at three roles:
Owner: This is the person who writes data, and they are the only person that can determine the classification. For example, if they are writing a secret document, they will pitch it at that level, no higher.
Steward: This is the person responsible for the quality and labeling of the data.
Custodian: The custodian is the person who stores and manages classified data. The custodian ensures the data is encrypted and backed up.
Security Administrator: The security administrator is the person who gives access to classified data once clearance has been approved.
Role-Based Access Control
Role-based access control is a subset of the department carrying out a subset of duties within a department. An example would be two people within the finance department who only handle petty cash. In IT terms, it could be that only two people on the IT team administer the email server.
Rule-Based Access Control
In Rule-Based Access Control (RBAC), a rule is applied to all of the people within a department, for example, contractors will only have access between 8 a.m. and 5 p.m., and the help desk people will only be able to access building 1, where their place of work is. It can be time-based or have some sort of restriction, but it applies to the whole department.
Attribute-Based Access Control
In Attribute-Based Access Control (ABAC), access is restricted based on an attribute in the account. John could be an executive and some data could be restricted to only those with the executive attribute. This is a user attribute from the directory services, such as a department or a location. You may wish to give different levels of control to different departments.
Group-Based Access Control
To control access to data, people may be put into groups to simplify access. An example would be if two people worked in IT who needed access to IT data. For example, let's call them Bill and Ben. We first place them into the IT group, and then that group is given access to the data:
Figure 1.4 – Group-based accessFigure 1.4 – Group-based access
Another example is where members of a sales team may have full control of the sales data by using group-based access, but you may need two new starters to have only read access. In this case, you would create a group called new starters and give those people inside that group only read permission to the data.
Linux-Based Access Control
In this section, we are going to look at Linux file permissions. These appear frequently in the Security+ exam even though they are not covered in the exam objectives.
Linux File Permissions (not SELinux)
Linux file permissions come in a numerical format; the first number represents the owner, the second number represents the group, and the third number represents all other users:
a. Permissions:
Owner: First number
Group: Second number
All other users: Third number
b. Numerical values:
4: Read
2: Write
1: Execute
Unlike a Windows permission that will execute an application, the execute function in Linux allows you to view or search. A permission of 6 would be read and write. A value of 2 would be write, and a value of 7 would be read, write, and execute. Some examples are as follows:
Example 1: If I have 764 access to File A, this could be broken down as follows:
a. Owner: Read, write, and execute
b. Group: Read and write
c. All other users: Read
Another way the permissions can be set is by alphabetical values, as shown:
a. R: Read
b. W: Write
c. X: Execute
When using alphabetical values, each set of permission is shown as three dashes. Full control for the three entities are as follows:
a. Owner Full Control: rwx --- ---
b. Group Full Control: --- rwx ---
c. All Other Users Full Control: --- --- rwx
Example 2: If a file has an access level of rwx rwx rw-, what does this mean?
a. Owner has read, write, and execute (full control).
b. Group has read, write, and execute (full control).
c. All other users have only read and write permissions.
Physical Security Controls
Physical security controls are put in place to stop unauthorized access to the company or accessing the data. Physical security controls are easily identifiable as you can touch them. Let's look at each of them in turn.
Perimeter Security
In this section, we will look at different types of perimeter security systems:
Signage: Before anyone reaches your main entrance, there should be highly visible signs warning them that they are entering a secure area with armed guards and dogs. This is used as a deterrent to prevent possible intruders.
Fences/Gates: The first line of defense should be a perimeter fence as the openness of many sites renders them highly vulnerable to intruders. Access to the site can be controlled by using a gate either manned by a security guard or with a proximity reader. You could place bollards in front of a building to stop a car from driving through the entrance. You may even have different zones, such as a research and development department, with their own perimeter security.
Access Control: Armed guards at the gates should be checking the identity of those entering. There should be an access control list for visitors who are sponsored by an internal department. The guards checking identities should be behind one-way toughened glass so that visitors cannot see inside the gatehouse.
Access Control Vestibules: Someone entering a building opens one door into a space (the access control vestibule) in which the security guard can confirm their identity before being allowed to access the premises via a second door.
Visitor Logs: The guards at the main entrance to a base or company will ask visitors to complete the visitor logs, and then provide some form of identification.
Badges: The form of identification is retained, and they are allocated a visitor's badge that is a different color to that of employees. When they leave, they then return the badge and are handed back their form of identification. These badges should be visible at all times, and anyone that isn't displaying a badge should be challenged. Badges for members of staff might be RFID-enabled cards so that they can access the building via a card reader.
Lighting: Lighting is installed for two main reasons: the first reason is so that anyone trying to enter your site at night can be seen and the second reason is for safety.
Cameras: Cameras can be set up in areas around the perimeter and on doorways to detect motion. They can be set up to detect objects both day and night to alert the security team by raising an alarm.
Robot Sentries: These can be set up to patrol the perimeter and can shout out warnings to deter any intruders. These sentries patrol the DMZ between North and South Korea and they can be armed:
Figure 1.5 – Robot sentry