Security + SUCCESS SECRETS
Take exam within 3 weeks of this Friday!
Optimal if exam taken within 10 days
Did you take A+ & Network+?
Most students need 20-40 MORE hours studing after Friday
On Friday I will ask you how many more hours you need
Challenges: Not enough times, 81.25%, exhibits
Poor test banks in back of books
Extra: optional buy hands-on labs from comptia.org(store) Handout 2 should help you decide.
Extra: optional buy exam simulator from comptia.org and/or use securitytutoring.com
securitytutoring.com, free for 10 days
OWASP.org
https://www.comptia.org/certifications/security
https://www.securitytutoring.com/
https://www.encryptionconsulting.com/certificate-authority-and-hierarchy/
Patrick_Fuller@learningtree.me
703-408-6828
HOMEWORK: Study handouts 1 & 2, port numbers, create comptia account, pearsonvue.com
CHEAT SHEET
Follow policy & procedures
Life first
Loss of life
Disgruntled employee
Resource = has IP Address
Hashing is not reversible, Encryption is reversible
How are password stores in system? Hash
8 bits = 1 byte = 1 octet
Hash = Integrity
HMAC = Auth + I (Non-R) - FAST (Both need password)
DIG SIG = Auth + I - SLOW (Don't need password)
What is the only cipher that is deemed unbreakable? OTP (One-time pad)
What does BitLocker use for encryption? Requires a TPM (Trusted Platform Module)
Is TPM better than HSM? HSM (Hardware Security Module) you can take with you and TPM is on your m
What does TPM hold? Storage Root Key
There is a signature in your certificate.
What does PKI gives you? Confidentiality, Integrity, Authentication
What does SSH give you? Confidentiality, Integrity, Authentication
What does HTTPS give you? Confidentiality, Integrity, Authentication
What is a wildcard certificate? *.
What is the last step in the process?
Lesson Learned, Documentation, Follow ups
What is a SOC Report?
Who needs them?
Most detailed, least detailed, public report?
SE = Social Engineering
How to stop all attacks? Input validation (Character sanitization)
EAP is an authentication framework
Vulnerability = Exploit
Threats = Human Commucation
Exception - Temporary deviation
Exemption - Permanent deviation
Saying ...
Following policy & procedures
Firewalls have rules, routers have ACL's
ACL = Access Control List. Administrator config file
Flaring = Blinding a camera with a laser
Pop Quiz: Controls
1. Management
2. Operational
3. Operational
4. Technical
Domain 1: Match the items to the Topics
Always verify - ZTNA
Penetration test - Management
When patch no longer available - Gap analysis
Reporting suspicious behavior - Operational
Performing an audit - Detective
Protecting cables - STP (Shield twisted pair)
Using a unique or secret phrase - Honeytoken
May delay patching - Application restart
Domain 5: Match the items to the Topics
Linkelihood x Impact - Heat Map
Specifying permissions - Authorization
Logest SDLC phase - Maintenance
Before eradication - Contain
Performs backups - Custodian
Detailed instructions - Playbook
Does not specify exact solution - Standards
Tracking Risk - Risk Register
Domain 2: Match the Items to the Topic
Fake AP - Evil Twin
Target breach - Supply chain
defenseless - Embedded System
Distributed Denial of Service - C2
../../../../../ - Traversal
Discovered via malvertizing - Malicious Update
IOS Unapproved - Jailbreak
Found USB - Keylogger
Domain 6: Match the Items to the Topics
WAN Security - SASE
No Sex, Gambling, Anarchy - DNS filter
Hard to see, not encrypted - obfuscation
Scalable cloud apps - Containers
Least secure VPN - Split tunnel
IaC - SDN
Access to a strict area - Jumpbox
More than a UTM - NGFW
IPS - Inline
Secure access by 802.1x - VLAN
Pop Quiz
BBQ sauce product recipe - Trade secret
Your name and address - PII
Company logo - TM
Binary data with health records - PHI
Pop Quiz: Connection Protocol
1. At a high-security organization, it is desired to implement turnstile security
2. A requirement is that a mobile devices be possessed by an individial that broadcasts a signal to per
3. Which protocol should be used? NFC
Domain 4: Match the Items to the Topics
Traffic collection - Netflow
Standards, guilines, and best practices - NIST CSF
Centralized - RADIUS
Compensating - Reducing/lessening damage
Reads code - Static scanner
Audit method - interview
HTTPS only - Secure cookie
Paid to hack - Big Bounty
Pop Quiz: Multi-Factor Authentication
How many factors?
1. One factor
2. One factor
3. One factor
4. 2 factor
Pop Quiz: Automation
1. Guardrail
2. technical Debt
Domain 4: Match the Items to the Topics
Saving code changes frequently - Continuous integration
Email and DNS - SPF (Sender Policy Framework)
Opposite of MAC - Discretionary
Follows eradication - Recovery
A rogue user created - IoC
Authorized when needed - JIT Permissions
Automated ticketing - SOAR
Authorized app - OAuth2
Authentication Servers
Kerberos (Best server)
tickets
AAA
Authen > Author > Accounting/Auditing
Ticket > Service
TGT > TGS
Radius
certs
AAA
Diameter
European improvement of Radius
FRR
FAR
CER
SYMMETRIC
Static key, same
Super fast
Key = password
Problem: Key Distribution
Confid
Private key only
32braids
2DES
2FISH
blowfish
RC4
IDEA
AES, Rijndael, block 128, Ket 128/192/256
DES
Serpent
IV (initialization Vector)
FIREWALL
Filter > decisions > rules
WAF (input validaton)
Stateless packet inspection - current
Stateful packet inspection - previous and current
Application Proxy - Best firewall
NGFW - DPI (Deep Packet Inspection)
UTM (Unified Threat Management) - everything, very simple
NAT (Network Address Translation) - translate public IP to private non-routable
ASYMMETRIC
Public key (public/private)
Very slow
Solves sym key exchange problem
Problem: MITM
Deer
Diffie Hellman
El-Gamal
ECC - smart cards, low overhead
RSA - 2 large prime numbers
IV (initialization Vector)
Security Controls
Technical
Administrative (mgmt)
Operational
Categories:
Detective: lights,
Preventive: Firewall, door access control
Corrective: Backups, redundant servers, Crossing training, patching
Deterrent: Clean desk policy, guards, warning signs
Compensating: Fire extinguishers
Directive: policy
Key Exchange
DEERIODE
Diffie Hellman
El-Gamal
ECC - smarrt cards, low overhead
RSA - 2 prime numbers
IKE = IP sec
OOB
DHE
ECDHE
Salt
PII
PCI-DSS = Credit card
PHI = Personal Health
HIPAA = US Medical
GLBA = Financial
GDPR = Strict of all, EU
PIPEDA - Canadian
Hash
Integrity
Detects changes
Passwords = hash
Rainbow Tables = Precomputed table for hashing
Collision
Mr Sh or shrm
MD5
Ripemd
Havel
SHA-0
SHA-1
SHA-2
SHA-3
IDS
WIPS
NIDS
HIDS
PKI
Manages public key & certificates
CA = Certificate Authority - root. CA = a trusted third party
RA = Registration Authority
RA = Recovery Agent
Key Escrow = back door = the password to everything
What is the world standard? x.509v3
CRL = Certification Revocation List
OCSP = Online Certificate Status Protocol
Whos sig is in your cert? CA or the creator (ie. Go Daddy, Verisign..)
sig = encrypted hash
sig = nonrepudiation = Authentication + integrity
Non-repudiation = cant deny.
Q) When do I use a Sig vs a Cert?
SIG = documents, software, Non-repud (Auth +int)
Cert = devices, servers. Similar to an electronic version of a drivers license/passport.
Cert = Conf + I + Auth
IPS
WIPS
NIPS
HIDS
PROTOTCOL/SERVICE
See page 5-45, 310
Study tonight
FTP
Radius
DNS
HTTP
HTTPS
SMB
LDAP
RDP
SSH
SFTP
SCP
DHCP
TFTP
FTPS
Telnet
IKE (Key exch IP sec)
IP sec in ESP (Encapsulated Security Payload)
IP sec in AH
IMAP
POP
POP3
SMTP
Microsoft SQL Server
NetBIOS
Syslog
SNMP
NTP
LDAPS
LEGAL/CONTRACTS
Due care = careful
Due diligence + demonstrate doing due care
ROE - Rules of Engagement
MSA - Master-level service agreement
BPA - Business Partnership Agreement
EULA - End user license agreement
NDA - Non-discloser agreement
AUP - Acceptable use policy
SLA - Service Level Agreement
SOP = Step by step = Standard operating procedures
SOW = Statement of Work
MOU - Memordium of Understanding
MOA - Memoradium of Agreement
Page 330
Copyright
Trademark
Patent
PORT#
21/20
1812
TCP & UDP/53
80
443
135,139,445
389
3389
22
22
22
UDP/67 & UDP/68
UPD/69
TCP/990
23
UPD/500
50
51
993
110
995
25
1433/1434
137/138
514
161/162(trap)
123
636
UDP
UDP
(139 UDP)
UDP
UDP
UDP
UDP
UDP
(v1/v2 UDP)
IEEE 802 7 layer OSI
802.3 = ethernet (cable) 7Application
802.11 = Wifi 6Presentation
802.1D = STP = allows loops, Availability 5Session
4Transport
802.1X =Port based access control = Switch 3Network
802.1Q = VLAN 2Data Link
1Physical
CIA MODEL CONT.
Threat
C-onfid Eavsdropping
I-ntegrity Spoofing, Changed
A-vailability DDOS, DDOS
CONT.
Best layer for protection
Represents
Syncs
TCP = connection or., UDP = connectionless, ICMP
Packets, Routers, IP Address, Subnetting, IP Sec
Frames (ethernet), switches, VLANs, MAC Address
bits, cable, hubs/conc/repeater
CONT.
Solution
Encrypt
Hashing, digital signature
Redundant, resiliant, patching
FORENSICS
Stego = Hiding a message in a picture
Chain of custody
OOV - Order of Volitility
Evidence use write blocker
ACCESS CONTROL
RBAC = Rule (Firewall)base Access Control
RBAC = Role base Access Control
DAC = Weakest
MAC = Military, labels
ABAC = Attribute base access control
POLICIES, STANDARDS, PROCEDURES
Page 102
Policy = Higher-level goals
Standard = are ways of achieving a policy goal
Procedures detailed and related to a specific solution
Guidelines = recommended, not required
RISK MITIGATION/RESPONSE
- maatd
make An Assessed Timely Decision
Mitigate
accept
avoid
Transfer - Insurance
Deterr
RISK/BC/DR VULN TEST PEN TEST
BIA Safe NOT SAFE
AV Full access = root no access
EF Internal External
ALE = SLE * ARO (SLEARO) Due care Due Diligence (Audit)
SLE = AV * EF (SLEAVE +F)
Qual = L/M/H or simple scale 1-10
Quant = 4.2 mil
RPO <I> RTO
RPO
RTO
DR TESTING
tabletop
failover
simul
parallel
ALTERNATE SITES
Hot site - most expensive
Warm site
Cold site
SOC 1 SOC 2 SOC 3
Private Private Public
Audit on Financials Most detailed Least Detailed
Internal Controls CIA
Type 1 = 12-31-2023
Type 2 = 1-1 to 12-31-24
WEB SERVER ATTACKS COMMANDS
XSS (CSS) - Cookie stealing HO 2! Put them here
XSRF - Advanced Cookie stealing
XSRF - Advanced Cookie stealing (XS > RF) ../
Buffer Overflowing = Giving too much memory netstat
SQL-Injection (1=1) ping
traceroute
STOP? Input validation
WIFI CLOUD SERVICES
802.11 SaaS
Evil Twin = SSID PaaS
Rogue IP = unauthorized IaaS - Data center in the cloud
Bluebooth FaaS - serverless architecture
Bluejacking XaaS
bluesnarfing
power and replacement
MDM = Mobile data management
Power & replacement
Ad-hoc vs infrastructure mode
v1 = WEP
RC4
PSK
V2 = WPA
TKIP
PSK or ENT
V3 = WPA/2
AES-CCMP
PSK or ENT
V4 = WPA/3
CLOUD TYPES Infrastructure
Private P282
Public
Community
Hybrid
CLOUD LOCATION VPN TYPES
Private/On-Premise IP SEC
Host AH = Auth + I
Page 272 ESP (Tunnel Mode) = Auth + I + Confidentiality
VPCloud L2TP
GRE
AH
ESP (Tunnel Mode)
PPTP
DO NOT CONFUSE DATA LABELS
X.500 vs X.509 Page 329, 5-64
RC4 vs RSA
Critical
Sensitive
Condifdential
Restricted
Private
Public
IPV4 IPV6
8-bits=octet = BYTE 128 bits
32 bits
Unicast Unicast
Multicast Multicast
Broadcast Anycast
SEC = OFF SEC = ON
IP sec IP sec
Backup Types
Imaging
Snapshot
Full - Slowest to backup, fastest to restore
Incremental - Fastest to back up, slowesy to restore
Differential
Full
C/D
Increm
Deployment Models
BYOD = Bring your own device
CYOD = Choose your own device
COPE = Corporate Owned, Personally Enabled
VDI = Virtual Desktop Infrastructure
FRAUD REDUCTION Capability Maturity Model
Least priv Initial
Job Rotation managed
separation of duties Defined
Mandatory Vacations Quantitatively managed
Optimized
AUTHENTICATION SANITIZATION & DESTRUCTION
R U who you say u r? page 385
something you: Sanitiz
Know = password Burning
Have = token, usb, CAC, PIV Shredding
Are = BIOMETRIC - Best Pulping
fingerprint, facial, voice, palm Pulverizing
retina, Iris, Degaussing
Iris is the best biometrics Disposal
Purging
Somewhere you are: Wipe and clearing
Geofencing
GPS
BIO
Type 1 = FRR - False Rejection Rate
Type 2 = FAR - Far Acceptance Rate
CER - Cross Error Rate
ATTACK FRAMEWORK SSO Outside SSO INTRANET
Kill Chain SAML Kerberos
RWDEICA Oauth
WEBSITE SNMP
cve.MITRE.org remote management
nvd Trap is a predefined threshold
Community string = Password
owasp.org V1, V2 broken
SOO INTERNET
SAML
Authen and Author
Oauth
Authorization
OpenID (Paired with Oauth)
Authentication
