CompTIA Security+ SY0-201 Video Course

CompTIA Security+ SY0-201 Video Course

by Shon L. Harris
Released June 2009
Publisher(s): Pearson IT Certification
ISBN: 9780789739964

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Video description

CompTIA® Security+ Video Course

SY0-201

Classroom Training from the Expert

30+ hours of personal video training from leading security expert Shon Harris

The fast, powerful way to prepare for your Security+ exam!

Get all the hands-on training you need to pass the tough CompTIA Security+ exam, get certified, and move forward in your IT security career! In this easy-to-use video, the world’s #1 information security trainer walks you through every skill and concept you’ll need to master. This video contains over 30 full hours of videos adapted from Shon Harris’s legendary five-day Security+ boot camps–including realistic labs, scenarios, case studies, and animations designed to build and test your knowledge in real-world settings!

Comprehensive coverage of all six Security+ domains of knowledge:

     .    Systems Security

     .    Network Infrastructure

     .    Access Control

     .    Assessment and Audits

     .    Cryptography

     .    Organizational Security

About the Shon Harris Security Series

This video is part of a complete library of books, online services, and videos designed to help security professionals enhance their skills and prepare for their certification exams. Every product in this series reflects Shon Harris’s unsurpassed experience in teaching IT security professionals.

Category: Security

System Requirements

OPERATING SYSTEM: Windows 2000, XP, or Vista; Mac OS X 10.4 (Tiger) or later

MULTIMEDIA: DVD drive; 1024 x 768 or higher display; sound card with speakers

COMPUTER: 500MHz or higher CPU; 128MB RAM or more

Table of contents

  1. Course Introduction
    1. Introduction 00:06:59
  2. Domain 1 – Systems Security
    1. Systems Security 00:01:06
    2. Security+ Placement 00:00:42
    3. Security+ and DoD 8570 Mandate 00:01:25
    4. Privilege Escalation 00:01:55
    5. Agenda 11 00:01:57
    6. Boot Sector Invasion 00:00:36
    7. Few Other Types 00:00:46
    8. How Do They Work? 00:01:27
    9. More Malware 00:02:16
    10. Blended Malware 00:02:11
    11. A Back Orifice Attack! 00:00:59
    12. NetBus 00:00:40
    13. Hoaxes 00:00:56
    14. Agenda 12 00:01:02
    15. Signature Scanning 00:00:58
    16. Monitoring Activities 00:00:56
    17. Monitoring for Changes 00:01:21
    18. More Bad Stuff 00:04:36
    19. Circumventing Access Controls 00:01:17
    20. Attacks 00:00:51
    21. TOC/TOU Examples 00:00:38
    22. Attack Type – Race Condition 00:01:50
    23. Attacking Through Applications 00:03:53
    24. How a Buffer Overflow Works 00:01:39
    25. Watching Network Traffic 00:01:23
    26. Traffic Analysis 00:01:07
    27. Functionally Two Different Types of Rootkits 00:01:19
    28. Examples of Trojaned Files 00:00:48
    29. Exploitation 00:02:10
    30. Trojans (2) 00:02:07
    31. Types of Trojan 00:01:56
    32. Back Orifice 2000 00:00:54
    33. Sub7 00:01:22
    34. Defenses to Trojan 00:01:39
    35. Backdoor 00:01:30
    36. How “Netcat” Works as a Backdoor 00:00:54
    37. VNC – Virtual Network Computing 00:01:22
    38. Backdoor Defenses 00:02:10
    39. Rootkit 00:01:26
    40. Popular Rootkits 00:00:44
    41. Unix Rootkit Prevention 00:04:21
    42. Windows Rootkit Prevention 00:01:08
    43. Botnet 00:01:35
    44. Show Me the Money! 00:01:12
    45. Botnet (2) 00:02:08
    46. Another Common Attack 00:01:02
    47. Identity Theft 00:01:19
    48. Fake Login Tools 00:00:42
    49. How Do These Attacks Work? 00:00:33
    50. Attempts to Get Your Credentials 00:01:02
    51. Instructional Emails 00:01:26
    52. Knowing What You Are Disposing of Is Important 00:01:18
    53. Other Examples 00:00:46
    54. Another Danger to Be Aware of… Spyware 00:02:07
    55. Is Someone Watching You? 00:02:11
    56. What Does This Have to Do with My Computer? 00:01:17
    57. Sometimes You Know that Software Is Installing on Your System 00:02:54
    58. Provide the Hackers with Tools 00:02:09
    59. Common Web Server Flaws 00:01:08
    60. Improper Data Validation 00:01:59
    61. Uniform Resource Locator (URL) 00:02:00
    62. Directory Traversal 00:01:04
    63. Buffer Overflow 00:00:57
    64. Cross-Site Scripting Attack 00:01:51
    65. Common SQL Injection Attack 00:01:30
    66. Attacking Mis-configurations 00:01:12
    67. CGI Information 00:00:44
    68. Logging Activities 00:00:43
    69. Are ALL Patches Applied? 00:00:39
    70. Instant Messaging 00:03:02
    71. Browser 00:04:07
    72. P2P 00:03:21
    73. P2P Security 00:01:06
    74. P2P Networks – Common Attacks 00:00:52
    75. Hardware Security 00:08:26
    76. Removable Media 00:01:08
    77. Magnetic Media 00:03:17
    78. Optical Media 00:01:53
    79. Electronic Media 00:01:16
    80. Memory Cards 00:01:27
    81. Memory Card Characteristics 00:00:35
    82. USB Devices 00:04:27
    83. Data Leakage Prevention 00:02:17
    84. NAS 00:03:45
    85. Security Templates 00:04:36
    86. Security Suite Components 00:06:10
    87. Security Best Practices – Summary 00:04:49
    88. Security Suite Components 00:03:06
    89. Personal Firewall 00:00:58
    90. Personal Firewall Features 00:02:08
    91. Antivirus 00:03:02
    92. Anti-spam 00:11:35
    93. Popup Blockers 00:01:08
    94. Security Suite 00:01:00
    95. Security Suite Components 00:01:16
    96. Virtualization Technology 00:00:49
    97. Virtual Machine 00:05:48
    98. VMWare 00:01:31
    99. Approaches to Application Virtualization 00:03:18
    100. Domain 1 Review 00:00:39
  3. Domain 2 – Network Infrastructure
    1. Network Infrastructure 00:00:40
    2. Agenda 1 00:03:09
    3. Networking Communications 00:00:40
    4. An Older Model 00:01:40
    5. Data Encapsulation 00:02:02
    6. Application Layer 00:00:25
    7. OSI – Application Layer 00:02:08
    8. Presentation Layer 00:01:21
    9. OSI – Presentation Layer 00:01:16
    10. OSI – Session Layer 00:01:00
    11. Client/Server Model 00:00:56
    12. Client/Server Session Layer 00:01:15
    13. Transport Layer 00:01:52
    14. Transport Layer Analogy 00:01:07
    15. OSI – Network Layer 00:00:56
    16. Here to There 00:01:06
    17. Network Layer 00:00:44
    18. OSI – Data Link 00:01:49
    19. Data Link 00:02:05
    20. Sublayers 00:01:58
    21. OSI – Physical Layer 00:01:33
    22. Layers Working Together 00:06:22
    23. Devices Work at Different Layers 00:02:17
    24. Types of Networks 00:01:27
    25. Network Topologies – Physical Layer 00:00:37
    26. Topology Type – Bus 00:00:52
    27. Topology Type – Ring 00:01:46
    28. Topology Type – Star 00:00:55
    29. Network Topologies – Mesh 00:01:49
    30. Summary of Topologies 00:01:11
    31. Agenda 2 00:01:10
    32. Media Access 00:00:53
    33. One Goal of Media Access Technologies 00:00:42
    34. Collision Domain 00:00:58
    35. Back Off, Buddy 00:01:30
    36. Carrier Sense Multiple Access 00:01:11
    37. CSMA/Collision Avoidance (CSMA/CA) 00:01:24
    38. Media Access Technologies – Ethernet 00:02:09
    39. Media Access Technologies – Token Passing 00:02:55
    40. Token’s Role 00:00:46
    41. Other Technologies 00:01:07
    42. Media Access Technologies – Polling 00:01:02
    43. Agenda 3 00:01:39
    44. Cabling Types – Twisted Pair 00:01:29
    45. Cable Types 00:00:56
    46. Multimode versus Single Mode 00:01:12
    47. Signal and Cable Issues 00:00:52
    48. Signaling Issues 00:01:04
    49. Transmission Types – Analog and Digital 00:01:53
    50. Transmission Types – Synchronous 00:00:57
    51. Asynchronous 00:00:42
    52. Transmission Types 00:02:08
    53. Cabling Issues – Plenum-Rated 00:01:57
    54. Transmission Types – Number of Receivers 00:02:30
    55. Internet Group Management Protocol 00:00:54
    56. Multicasting 00:00:52
    57. Network Technologies 00:01:14
    58. Extranet 00:00:42
    59. Network Technologies (Cont.) 00:01:14
    60. EDI Evolution 00:00:38
    61. Networking Devices 00:01:50
    62. Network Device – Hub 00:00:48
    63. Networking Device – Bridge 00:01:26
    64. Forwarding Table Example 00:01:21
    65. Network Devices – Switch 00:00:55
    66. Virtual LAN 00:01:24
    67. VLAN 00:00:53
    68. Interfaces and VLANs 00:02:14
    69. Sniffers 00:03:13
    70. Networking Devices – Router 00:02:14
    71. Hops 00:00:56
    72. Routers 00:00:49
    73. Bridges Compared to Routers 00:01:29
    74. Network Devices – Gateway 00:00:54
    75. Agenda 4 00:02:09
    76. Client Ports 00:01:34
    77. Conceptual Use of Ports 00:00:47
    78. TCP/IP Suite 00:01:09
    79. UDP versus TCP 00:02:29
    80. TCP Segment 00:00:50
    81. SYN Flood 00:03:29
    82. Teardrop Attack 00:02:05
    83. Source Routing 00:01:03
    84. Source Routing Types 00:00:52
    85. IP Address Ranges 00:02:56
    86. IPv6 00:02:25
    87. Protocols 00:00:11
    88. Protocols – ARP 00:01:09
    89. IP to MAC Mapping 00:00:50
    90. How ARP Works 00:01:27
    91. ARP Poisoning 00:01:13
    92. ICMP Packets 00:01:22
    93. A Way Hackers Use ICMP 00:01:19
    94. Ping Steps 00:01:30
    95. Protocols – SNMP 00:00:49
    96. SNMP in Action 00:03:20
    97. SNMP 00:01:48
    98. SNMP Output 00:00:58
    99. POP3 and SMTP 00:00:47
    100. Protocols – SMTP 00:00:33
    101. Mail Relay 00:02:00
    102. Protocols – FTP, TFTP, Telnet 00:02:36
    103. Protocols – RARP and BootP 00:01:18
    104. DHCP – Dynamic Host Configuration Protocol 00:01:04
    105. Agenda 5 00:01:49
    106. Network Configurations 00:01:07
    107. DMZ Configurations 00:01:05
    108. Firewall Comparisons 00:00:44
    109. Network Devices – Firewalls 00:02:25
    110. Packet Filtering Firewall 00:01:56
    111. Packet Filtering Firewall Weaknesses 00:00:57
    112. Packet Filtering 00:00:35
    113. Rule Set Example 00:01:22
    114. Firewall Types – Proxy Firewalls 00:01:50
    115. Firewall Types – Circuit-Level Proxy Firewall 00:02:17
    116. Firewall Types – Application-Layer Proxy 00:03:30
    117. Application-Layer Proxy Advantages 00:00:44
    118. Application-Layer Proxy Disadvantages 00:01:01
    119. Dedicated Proxy Servers 00:00:57
    120. Firewall Types – Stateful 00:05:06
    121. Compare 00:03:35
    122. Firewall Types – Kernel Proxies 00:01:31
    123. Firewall Based VPN Devices 00:00:51
    124. Best Practices 00:02:58
    125. Firewall Placement 00:01:18
    126. Packet Filtering (Cont.) 00:00:36
    127. Screened Host 00:01:14
    128. Firewall Architecture Types – Multi- or Dual-Homed 00:01:24
    129. Screened Subnet 00:02:25
    130. Agenda 6 00:00:47
    131. Dial-Up Protocol – SLIP 00:00:46
    132. Dial-Up Protocol – PPP 00:01:01
    133. PPP 00:00:51
    134. PPP versus SLIP 00:01:31
    135. Authentication Protocols – PAP 00:00:45
    136. Authentication Protocols – CHAP 00:02:15
    137. Authentication Protocol – EAP 00:01:24
    138. Data Inspection 00:03:44
    139. Virtual Private Network Technologies 00:00:16
    140. What Is a Tunneling Protocol? 00:01:01
    141. Analogy 00:01:01
    142. Examples 00:00:58
    143. Tunneling Protocols – PPTP 00:01:08
    144. Tunneling Protocols – L2TP 00:02:35
    145. L2TP Encapsulation 00:00:30
    146. Tunneling Protocols – IPSec 00:00:48
    147. IPSec Basic Features 00:03:55
    148. IPSec Modes 00:00:35
    149. Security Associations (SAs) 00:04:01
    150. Combining Sas 00:02:42
    151. Agenda 7 00:01:20
    152. Layer 3 at Layer 2 00:00:59
    153. MPLS 00:01:09
    154. Multiprotocol Label Switching 00:01:13
    155. Quality of Service (QoS) 00:01:48
    156. QoS Services 00:00:49
    157. Autonomous Systems 00:02:04
    158. Routing Protocols 00:02:16
    159. Routing 00:01:51
    160. Routing Protocols (Cont.) 00:02:04
    161. OSPF 00:01:22
    162. IGRP 00:00:40
    163. BGP 00:02:39
    164. Routing Protocol Attacks 00:00:54
    165. Metropolitan Area Network Technologies 00:01:23
    166. FDDI 00:00:49
    167. SONET Rings 00:01:17
    168. MAN Technologies – SONET 00:00:34
    169. Connecting Networks 00:01:30
    170. Network Services 00:01:33
    171. DNS Server Structure 00:01:14
    172. Name Resolving Steps 00:03:32
    173. Split DNS 00:01:02
    174. Host Name Resolution Attacks 00:03:37
    175. Network Service – NAT 00:03:26
    176. PAT 00:01:00
    177. NIS 00:00:43
    178. Storing Data 00:00:45
    179. NIS+ Authentication 00:00:38
    180. Agenda 8 00:01:10
    181. PSTN 00:00:58
    182. Circuit Switching 00:00:41
    183. Steps of Connections 00:00:45
    184. Multiplexing 00:01:40
    185. Types of Multiplexing 00:00:53
    186. TDM Process 00:00:23
    187. Statistical Time Division Multiplexing 00:01:21
    188. FDM 00:01:25
    189. Packet Switching 00:02:28
    190. Circuit versus Packet Switching 00:01:24
    191. WAN Technologies – Packet Switched 00:00:17
    192. WAN Technologies – X.25 00:00:54
    193. X.25 00:01:09
    194. WAN Technologies – Frame Relay 00:01:47
    195. WAN Example 00:00:44
    196. Frame Relay 00:02:26
    197. WAN Technologies – ATM 00:01:21
    198. Cell Switching 00:00:46
    199. Wide Area Network Technologies 00:01:02
    200. WAN Technologies – ISDN 00:01:10
    201. On-Demand 00:00:26
    202. ISDN Service Types 00:00:34
    203. WAN Technologies – DSL 00:02:38
    204. WAN Technologies – Cable Modem 00:01:37
    205. Cable Modems 00:01:26
    206. Satellites 00:00:39
    207. Hybrid Connection 00:00:52
    208. Satellite Coverage 00:00:40
    209. Network Perimeter Security 00:01:03
    210. Complexity only Increases 00:01:04
    211. A Layered Approach 00:00:37
    212. Agenda 9 00:00:44
    213. PSTN (Cont.) 00:01:54
    214. Private Branch Exchange 00:01:50
    215. PBX Vulnerabilities 00:01:33
    216. PBX Best Practices 00:01:44
    217. IP Telephony 00:03:00
    218. IP Telephony Components 00:00:36
    219. Media Gateways 00:01:51
    220. IP Telephony Issues 00:01:15
    221. Telephony Protection Mechanisms 00:00:36
    222. Telephony Security 00:02:39
    223. IP Telephony with Wireless 00:00:32
    224. IP Phones Security 00:02:13
    225. Mobile Technology Generations 00:01:55
    226. Mobile Phone Security 00:01:23
    227. Mobile Device Security 00:01:22
    228. Cell Phone 00:02:40
    229. Agenda 10 00:00:25
    230. Wireless Technologies – Access Point 00:01:54
    231. Wireless Frequencies 00:01:10
    232. Alphabet Soup of Standards 00:06:01
    233. Spread Spectrum 00:05:50
    234. OFDM 00:00:42
    235. Where Does Spread Spectrum Work? 00:02:10
    236. 802.11n 00:01:09
    237. Wireless Technologies – Access Point (Cont.) 00:01:01
    238. Architectures 00:00:46
    239. Wireless Technologies – Service Set ID 00:01:46
    240. Authenticating to an AP 00:01:03
    241. 802.11 Authentication 00:02:27
    242. Wireless Technologies – WEP 00:01:58
    243. Wireless Technologies – More WEP Woes 00:02:41
    244. Lack of Integrity 00:01:45
    245. Frequency Management 00:01:19
    246. 802.11 Security Solutions 00:04:12
    247. 802.1x 00:01:20
    248. 802.1x Authentication 00:05:08
    249. Types of 802.11 Security 00:01:22
    250. IEEE 802.11i Standard 00:02:07
    251. Wireless EAP 00:05:50
    252. Wireless Technologies – Common Attacks 00:05:20
    253. Wireless Technologies – War Driving 00:01:59
    254. NetStumbler Example 00:00:44
    255. Warchalking 00:01:33
    256. Countermeasures 00:04:56
    257. Wireless Attacks 00:02:10
    258. Wormhole Attack 00:00:48
    259. Wireless Technologies – WAP 00:00:44
    260. Wireless Technologies – WTLS 00:01:31
    261. i-mode 00:00:36
    262. Bluetooth 00:01:01
    263. Vampire Tap 00:01:53
    264. Tapping 00:00:41
    265. Fiber Tapping 00:01:20
    266. Domain Name Kiting 00:00:58
    267. Null Session 00:01:15
    268. Sniffers (Cont.) 00:03:09
    269. Packet Sniffer 00:01:20
    270. Packet Sniffer – Uses 00:00:48
    271. Spoofing Attacks 00:00:40
    272. E-mail Spoofing 00:01:25
    273. Spoofing – Instructional E-mails 00:01:00
    274. Email Spoofing – Common Messages 00:00:38
    275. Countermeasures (Cont.) 00:01:38
    276. Authentication and Encryption 00:00:47
    277. IP Spoofing 00:00:56
    278. Header Components 00:00:45
    279. Man-in-the-Middle 00:01:51
    280. Man-in-the-Middle Attack 00:00:23
    281. Replay Attack 00:01:00
    282. Countermeasures (Cont.) 00:01:46
    283. Session Hijacking 00:01:47
    284. Programs For Session Hijacking 00:00:32
    285. TCP/IP Hijacking 00:00:41
    286. Sequence Numbers 00:01:08
    287. Finding TCP Sequence Numbers 00:01:05
    288. SYN, SYN/ACK, ACK and ISN 00:00:27
    289. Denial of Service 00:01:46
    290. Reasons for DoS Attacks 00:00:33
    291. TCP Handshake 00:03:32
    292. SYN Flood (Cont.) 00:01:03
    293. TCP 00:00:37
    294. SYN Attacks Defense 00:02:07
    295. UDP Floods 00:01:21
    296. DDoS 00:01:45
    297. DDoS – Example 00:01:19
    298. DDoS Countermeasures 00:02:10
    299. Subnetting 00:01:55
    300. Network Access Control (NAC) 00:02:12
    301. NAC – Features and Benefits 00:00:57
    302. NAC Architecture 00:01:27
    303. Honeypot 00:02:05
    304. Honeypot – Types 00:01:32
    305. Honeypot (2) 00:00:51
    306. Honeynet 00:01:39
    307. Types of Honeypots 00:01:41
    308. Internet Content Filters 00:03:24
    309. Bluesnarfing 00:02:14
    310. Domain 2 Review 00:00:38
  4. Domain 3 – Access Control
    1. Access Control 00:00:08
    2. Access Control 00:00:43
    3. Definitions 00:01:05
    4. Access Control Mechanism Examples 00:01:03
    5. Technical Controls 00:00:54
    6. Access Control Characteristics 00:03:25
    7. Preventive Controls 00:00:56
    8. Preventive – Administrative Controls 00:01:15
    9. Fake Login Pages Look Convincing 00:01:05
    10. Detective – Administrative Control 00:02:08
    11. Detective Examples 00:00:48
    12. Administrating Access Control 00:01:25
    13. OS, Application, Database 00:00:36
    14. Administrating Access Control 00:01:00
    15. Authorization Creep 00:00:59
    16. Accountability and Access Control 00:01:26
    17. Trusted Path 00:03:00
    18. Fake Login Pages Look Convincing 00:01:44
    19. Who Are You? 00:02:08
    20. Identification Issues 00:00:48
    21. Authentication Mechanisms Characteristics 00:00:44
    22. Strong Authentication 00:02:01
    23. Fraud Controls 00:02:40
    24. Internal Control Tool: Separation of Duties 00:01:14
    25. Authentication Mechanisms in Use Today 00:00:24
    26. Biometrics Technology 00:01:05
    27. Biometric Devices 00:00:27
    28. Example 00:01:12
    29. Verification Steps 00:01:33
    30. Why Use Biometrics? 00:00:38
    31. Biometric Type 00:01:44
    32. Iris Sampling 00:00:40
    33. Finger Scan 00:00:58
    34. Hand Geometry 00:00:39
    35. Facial Recognition 00:01:44
    36. Comparison 00:00:52
    37. Biometrics Verification 00:00:40
    38. Issues 00:01:02
    39. Biometrics Error Types 00:01:59
    40. Crossover Error Rate 00:01:45
    41. Biometric System Types 00:02:52
    42. Passwords 00:00:40
    43. Password Generators 00:00:55
    44. Password “Shoulds” 00:03:31
    45. Password Attacks 00:01:05
    46. Attack Steps 00:02:50
    47. Many Tools to Break Your Password 00:00:53
    48. Rainbow Table 00:01:27
    49. Passwords Should NOT Contain… 00:01:26
    50. Countermeasures for Password Cracking 00:01:06
    51. Cognitive Passwords 00:00:47
    52. One-Time Password Authentication 00:01:36
    53. Synchronous Token 00:01:02
    54. One Type of Solution 00:02:34
    55. Synchronous Steps 00:00:48
    56. Challenge Response Authentication 00:04:17
    57. Asynchronous Token Device 00:00:35
    58. Asynchronous Steps 00:02:52
    59. Challenge Response Authentication 00:01:05
    60. Passphrase Authentication 00:01:30
    61. Key Protection 00:02:15
    62. Smart Card 00:00:56
    63. Characteristics 00:01:09
    64. Card Types 00:00:50
    65. Smart Card Attacks 00:01:34
    66. Software Attack 00:01:02
    67. Side Channel Attack 00:01:18
    68. Side Channel Data Collection 00:00:50
    69. Microprobing 00:00:53
    70. Identity Management 00:02:19
    71. How Are These Entities Controlled? 00:00:55
    72. Some Current Issues 00:01:22
    73. Management 00:03:01
    74. Typical Chaos 00:00:49
    75. Different Identities 00:01:45
    76. Identity Management Technologies 00:00:48
    77. Directory Component 00:01:17
    78. Enterprise Directory 00:00:48
    79. Directory Responsibilities 00:01:03
    80. Authoritative Sources 00:01:47
    81. Meta Directory 00:02:26
    82. Directory Interactions 00:01:46
    83. Web Access Management 00:01:27
    84. Web Access 00:05:09
    85. Password Management 00:02:21
    86. Legacy Single Sign-On 00:02:47
    87. Account Management Systems 00:02:23
    88. Provisioning Component 00:01:56
    89. Provisioning 00:01:59
    90. Not Just Computers 00:00:46
    91. Profile Update 00:01:29
    92. Working Together 00:03:28
    93. Enterprise Directory 00:01:00
    94. Identity Management Solution Components 00:00:36
    95. Right for Your Company 00:02:17
    96. Federated Identity 00:02:59
    97. Different Technologies 00:00:56
    98. Single Sign-on Technology 00:00:30
    99. Single Sign-on 00:01:50
    100. Directory Services as a Single Sign-on Technology 00:01:04
    101. Active Directory 00:00:57
    102. Security Domain 00:01:27
    103. Domains of Trust 00:00:34
    104. Domain Illustration 00:00:29
    105. Thin Clients 00:00:59
    106. Example 00:01:13
    107. Kerberos as a Single Sign-on Technology 00:00:52
    108. Kerberos Components Working Together 00:01:48
    109. Pieces and Parts 00:00:13
    110. More Components of Kerberos 00:00:32
    111. KDC Components 00:00:40
    112. Kerberos Steps 00:09:08
    113. Tickets 00:02:00
    114. Steps of Validation 00:01:16
    115. Kerberos Security 00:01:30
    116. Issues Pertaining to Kerberos 00:01:25
    117. Kerberos Issues 00:01:31
    118. SESAME as a Single Sign-on Technology 00:00:38
    119. SESAME Steps for Authentication 00:02:18
    120. Combo 00:01:22
    121. Models for Access 00:00:54
    122. Access Control Models 00:00:14
    123. Discretionary Access Control Model 00:00:46
    124. ACL Access 00:02:08
    125. Enforcing a DAC Policy 00:00:52
    126. Security Issues 00:01:20
    127. Mandatory Access Control Model 00:01:50
    128. MAC Enforcement Mechanism – Labels 00:02:06
    129. Formal Model 00:00:57
    130. Software and Hardware 00:00:58
    131. Software and Hardware Guards 00:01:09
    132. Where Are They Used? 00:00:44
    133. SELinux 00:00:31
    134. MAC versus DAC 00:01:14
    135. Role-Based Access Control 00:01:14
    136. RBAC Hierarchy 00:01:44
    137. RBAC and SoD 00:00:46
    138. Acquiring Rights and Permissions 00:00:47
    139. Rule-Based Access Control 00:02:30
    140. Access Control Matrix 00:01:37
    141. Capability Tables 00:00:34
    142. Temporal Access Control 00:00:54
    143. Access Control Administration 00:00:43
    144. Access Control Methods 00:00:36
    145. Centralized Approach 00:00:54
    146. Remote Centralized Administration 00:01:35
    147. RADIUS 00:00:39
    148. RADIUS Steps 00:00:55
    149. RADIUS Characteristics 00:01:17
    150. TACACS+ Characteristics 00:01:36
    151. Diameter Characteristics 00:02:27
    152. Diameter Protocol 00:01:01
    153. Mobile IP 00:01:36
    154. Diameter Architecture 00:01:41
    155. Two Pieces 00:01:09
    156. AVP 00:03:46
    157. Decentralized Access Control Administration 00:01:45
    158. Controlling Access to Sensitive Data 00:02:01
    159. Protecting Access to System Logs 00:02:05
    160. Accountability = Auditing Events 00:00:44
    161. Agenda 2 00:02:19
    162. IDS Steps 00:01:26
    163. Network IDS Sensors 00:02:00
    164. Host IDS 00:01:31
    165. Combination 00:01:38
    166. Types of IDSs 00:02:32
    167. Signature-Based Example 00:02:29
    168. Behavior-Based IDS 00:03:32
    169. Statistical Anomaly 00:01:05
    170. Statistical IDS 00:00:45
    171. Protocol Anomaly 00:01:45
    172. What Is a Protocol Anomaly? 00:01:30
    173. Protocol Anomaly Issues 00:00:48
    174. Traffic Anomaly 00:03:47
    175. IDS Response Mechanisms 00:01:10
    176. Responses to Attacks 00:01:37
    177. IDS Issues 00:01:55
    178. Intrusion Prevention System 00:02:19
    179. Differences 00:00:24
    180. Vulnerable IDS 00:00:47
    181. Trapping an Intruder 00:01:43
    182. Controlling Remote Access 00:10:39
    183. Remote Authentication 00:02:14
    184. Mutual Authentication 00:02:47
    185. Without Mutual Authentication 00:02:23
    186. Group Policies 00:01:55
    187. File and Print Resources 00:02:15
    188. File and Print Resources – Protection 00:02:07
    189. Physical Access Security 00:00:48
    190. Different Types of Threats 00:00:42
    191. Wake Up Call 00:00:35
    192. Not Just Hacking 00:00:37
    193. Number One Priority 00:01:19
    194. Physical Security Program Goals 00:01:41
    195. Planning Process 00:01:35
    196. Risk Assessment Needs to be Carried Out 00:01:04
    197. Deterrence Options 00:01:06
    198. Delay 00:00:19
    199. Layered Defense Model 00:00:49
    200. Detection 00:01:04
    201. Weak Link in the Chain 00:00:41
    202. Agenda 1 00:01:20
    203. Crime Prevention through Environmental Design 00:02:14
    204. CPTED Main Strategies 00:00:39
    205. Target Hardening 00:00:42
    206. Access Barriers 00:02:11
    207. Facility Construction 00:00:49
    208. Construction Materials 00:00:43
    209. Rebar Encased in Concrete 00:00:24
    210. Data Center 00:01:04
    211. Designing a Secure Site 00:01:24
    212. Door Types 00:01:51
    213. Window Types 00:01:13
    214. Sensitive Areas 00:01:00
    215. Security Zones 00:00:16
    216. Various Sensors 00:00:14
    217. Lock Types 00:01:47
    218. Entry Access Control 00:01:53
    219. Wireless Proximity Devices 00:00:49
    220. Device Types 00:00:42
    221. Piggybacking 00:00:49
    222. Entrance Protection 00:01:19
    223. Door Configurations 00:00:32
    224. External Boundary Protection 00:02:54
    225. Fencing Characteristics 00:00:42
    226. Fencing Issues 00:00:50
    227. Gates 00:01:40
    228. Lighting Issues 00:01:09
    229. Perimeter Security – Security Guards 00:00:42
    230. Guard Tasks 00:01:03
    231. Security Guards 00:01:57
    232. CCTV 00:04:27
    233. Agenda 2 00:01:00
    234. Intrusion Detection Characteristics 00:01:04
    235. Electro-Mechanical Sensors 00:01:12
    236. Volumetric Sensors 00:02:07
    237. Alarm Systems 00:00:45
    238. Securing Mobile Devices 00:02:08
    239. Agenda 3 00:00:27
    240. HVAC Attributes 00:01:38
    241. Environmental Considerations 00:01:01
    242. Who’s Got Gas? 00:01:04
    243. Documentation of Procedures 00:06:30
    244. Power Preventive Measures 00:01:46
    245. Device Protection 00:01:14
    246. Agenda 4 00:01:25
    247. Automatic Detector Mechanisms 00:02:18
    248. Fire Detection 00:01:34
    249. Fire Types 00:02:56
    250. Emergency Power Off Switch 00:01:09
    251. Fire Suppression Systems 00:04:24
    252. Fire Extinguishers 00:00:47
    253. Emergency Procedures 00:01:41
    254. Domain 3 Review 00:00:46
  5. Domain 4 – Assessments and Audits
    1. Assessments and Audits 00:00:56
    2. Risk Management 00:00:56
    3. Why Is Risk Management Difficult? 00:01:24
    4. Necessary Level of Protection Is Different for Each Organization 00:00:56
    5. Security Team/Committee 00:01:42
    6. Risk Management Process 00:00:30
    7. Planning Stage – Team 00:01:05
    8. Planning Stage – Scope 00:02:04
    9. Planning Stage – Analysis Method 00:01:01
    10. Risk Management Tools 00:01:50
    11. Defining Acceptable Levels 00:02:24
    12. Acceptable Risk Level 00:00:52
    13. Collecting and Analyzing Data Methods 00:01:04
    14. What Is a Company Asset? 00:00:48
    15. Data Collection – Identify Assets 00:01:01
    16. Data Collection – Assigning Values 00:01:34
    17. Asset Value 00:01:03
    18. Data Collection – Identify Threats 00:01:20
    19. Data Collection – Calculate Risks 00:01:38
    20. Scenario Based – Qualitative 00:00:43
    21. Risk Approach 00:00:40
    22. Qualitative Analysis Steps 00:00:56
    23. Want Real Answers? 00:00:53
    24. Qualitative Risk Analysis Ratings 00:01:02
    25. Quantitative Analysis Steps 00:01:37
    26. How Often Will This Happen? 00:00:37
    27. ARO Values and Their Meaning 00:03:27
    28. ALE Value Uses 00:00:48
    29. Relationships 00:00:29
    30. Calculate Risks – ALE Example 00:01:46
    31. Your Turn! 00:00:20
    32. ALE Calculation 00:00:56
    33. Can a Purely Quantitative Analysis Be Accomplished? 00:01:25
    34. Risk Types 00:00:39
    35. Examples of Types of Losses 00:00:35
    36. Delayed Loss 00:00:50
    37. Cost/Benefit Analysis 00:00:58
    38. Cost of a Countermeasure 00:01:21
    39. Cost/Benefit Analysis Countermeasure Criteria 00:02:55
    40. Calculating Cost/Benefit 00:01:01
    41. Controls 00:02:01
    42. Quantitative Analysis 00:02:09
    43. Qualitative Analysis Disadvantages 00:00:49
    44. Can You Get Rid of All Risk? 00:02:34
    45. Uncertainty Analysis 00:01:11
    46. Dealing with Risk 00:01:20
    47. Management’s Response to Identified Risks 00:01:51
    48. Risk Acceptance 00:01:42
    49. Risk Analysis Process Summary 00:01:08
    50. Remote Access Security 00:03:16
    51. Remote Access 00:01:31
    52. Administering Systems Remotely 00:01:36
    53. Facsimile Security 00:01:32
    54. Support Systems 00:01:24
    55. Agenda 6 00:00:58
    56. Testing for Vulnerabilities 00:01:05
    57. Vulnerability Assessments 00:00:15
    58. Security Testing Issues 00:02:07
    59. Vulnerability Scanning 00:00:48
    60. Basic Scanner 00:00:55
    61. Data Leakage – Keystroke Logging 00:00:58
    62. Password Cracking 00:02:10
    63. One of Many Tools 00:00:35
    64. War Dialing 00:00:39
    65. PhoneSweep 00:00:36
    66. Wardialing Output 00:00:27
    67. War Driving 00:00:40
    68. Wireless Reconnaissance Output 00:01:27
    69. Wireless Attacks 00:01:19
    70. Penetration Testing 00:02:52
    71. Testing Steps 00:01:19
    72. Testing Methodology 00:02:58
    73. Automated Pen Testing Tools Canvas Operation 00:01:00
    74. Penetration Testing 00:01:18
    75. Automated Pen Testing Tools Core Impact Operation 00:00:37
    76. Post-Testing and Assessment Steps 00:02:14
    77. Penetration Testing Variations 00:00:55
    78. Types of Testing 00:01:17
    79. Protection Mechanism – Honeypot 00:01:49
    80. Log Reviews 00:01:05
    81. Nmap 00:01:20
    82. Nmap – Options 00:00:51
    83. Nmap – Command line 00:00:46
    84. Nmap (2) 00:00:36
    85. Zenmap 00:00:20
    86. OVAL 00:04:37
    87. Network Performance Monitoring 00:01:17
    88. Network Monitoring 00:01:00
    89. Network Monitoring – Features 00:01:41
    90. System Monitoring 00:03:28
    91. Performance Baseline 00:01:23
    92. Establishing a Performance Baseline 00:01:21
    93. Monitoring Methodologies 00:00:04
    94. Signature Based Monitoring 00:00:49
    95. Behavior Based Monitoring 00:01:10
    96. Anomaly Based Monitoring 00:01:12
    97. Statistical Based Monitoring 00:00:35
    98. Log Management 00:03:04
    99. Logging Activities 00:01:19
    100. Log Reviews 00:01:49
    101. Security Logs 00:01:02
    102. Protecting Access to System Logs 00:01:00
    103. Accountability = Auditing Events 00:01:14
    104. Auditing 00:01:07
    105. Privilege Auditing 00:00:41
    106. Usage Auditing 00:00:46
    107. Escalation Auditing 00:00:43
    108. Retention and Storage 00:00:38
    109. Retention and Storage Policies 00:01:27
    110. Data Retention and Storage 00:02:02
    111. Resource Protection 00:00:52
    112. Library Maintenance 00:01:06
    113. Media Labels 00:01:19
    114. Software Escrow 00:01:27
    115. Weak Link 00:00:17
    116. Liabilities of Insecure Disposal of Information 00:00:24
    117. Devastating to the Company 00:01:17
    118. Safe Disposal 00:00:16
    119. Degaussing 00:00:27
    120. Zeroization 00:01:30
    121. Physical Destruction 00:00:20
    122. Remaining Data 00:00:25
    123. Why Not Just Delete the Files? 00:01:46
    124. Domain 4 Review 00:01:05
  6. Domain 5 – Cryptography
    1. Cryptography 00:00:43
    2. Services Provided by Cryptography 00:01:13
    3. Cryptographic Definitions 00:01:15
    4. Cipher 00:01:36
    5. A Few More Definitions 00:01:09
    6. Need Some More Definitions? 00:01:24
    7. Symmetric Cryptography – Use of Secret Keys 00:01:23
    8. Scytale Cipher 00:01:03
    9. Substitution Ciphers 00:01:55
    10. Simple Substitution Cipher Atbash 00:01:19
    11. Simple Substitution Cipher Caesar Cipher 00:01:59
    12. Simple Substitution Cipher ROT13 00:01:33
    13. Historical Uses 00:01:14
    14. Polyalphabetic Cipher – Vigenere Cipher 00:02:50
    15. Enigma Machine 00:02:33
    16. U-Boats had Enigma Machines 00:03:11
    17. Historical Uses of Symmetric Cryptography – Running Key and Concealment 00:03:01
    18. Agenda 1 00:01:30
    19. Key and Algorithm Relationship 00:02:27
    20. Does Size Really Matter? 00:00:35
    21. Key Space 00:01:20
    22. Ways of Breaking Cryptosystems – Brute Force 00:01:53
    23. Brute Force Components 00:00:44
    24. Ways of Breaking Cryptosystems – Frequency Analysis 00:01:40
    25. Strength of a Cryptosystem 00:01:40
    26. Do You Know What You are Doing?
    27. Developing Cryptographic Solutions In-House
    28. Characteristics of Strong Algorithms
    29. Open or Closed More Secure?
    30. Agenda 2
    31. Type of Symmetric Cipher – Block Cipher
    32. S-Boxes Used in Block Ciphers
    33. Binary Mathematical Function 1
    34. Type of Symmetric Cipher – Stream Cipher
    35. Symmetric Characteristics
    36. Initialization Vectors
    37. Security Holes
    38. Strength of a Stream Cipher
    39. Let’s Dive in Deeper
    40. Out-of-Band Transmission
    41. Symmetric Key Management Issue
    42. Why?
    43. Asymmetric Cryptography
    44. Key Functions
    45. Public Key Cryptography Advantages
    46. Asymmetric Algorithm Disadvantages
    47. Confusing Names
    48. Symmetric versus Asymmetric
    49. Questions 1
    50. When to Use Which Key
    51. Using the Algorithm Types Together
    52. Encryption Steps
    53. Receiver’s Public Key Is Used to Encrypt the Symmetric Key
    54. Receiver’s Private Key Is Used to Decrypt the Symmetric Key
    55. Digital Envelope
    56. Secret versus Session Keys
    57. Asymmetric Algorithm – Diffie-Hellman
    58. Key Agreement Schemes
    59. Asymmetric Algorithm – RSA
    60. Factoring Large Numbers
    61. RSA Operations
    62. RSA Key Size
    63. El Gamal
    64. ECC
    65. ECC Benefits
    66. Asymmetric Mathematics
    67. Asymmetric Security
    68. Mathematics
    69. Symmetric Algorithms – DES
    70. Block Cipher
    71. Double DES
    72. Evolution of DES
    73. Modes of 3DES
    74. Encryption Modes
    75. Block Cipher Modes – CBC
    76. Different Modes of Block Ciphers – ECB
    77. Block Cipher Modes – CFB and OFB
    78. CFB and OFB Modes
    79. Counter Mode
    80. Modes Summary
    81. Symmetric Cipher – AES
    82. IDEA
    83. RC4
    84. RC5
    85. Agenda 3
    86. Hashing Steps
    87. Protecting the Integrity of Data
    88. Hashing Algorithms
    89. Data Integrity Mechanisms
    90. Hashing Strength
    91. Question 1
    92. More Protection in Data Integrity
    93. MAC
    94. HMAC – Sender
    95. HMAC – Receiver
    96. Another Look
    97. What Services
    98. Authentication Types
    99. MAC Using Block Ciphers
    100. Integrity?
    101. What Services?
    102. Question 2
    103. Digital Signatures
    104. One More Look 1
    105. U.S. Government Standard
    106. What Is…
    107. Zero Knowledge Proof
    108. Message Integrity Controls
    109. Security Issues in Hashing
    110. Example of a Birthday Attack
    111. Birthday Attack Issues
    112. Key Management
    113. Key Usage
    114. Cryptoperiod
    115. M-of-N
    116. Key Types
    117. Agenda 4
    118. PKI and Its Components
    119. PKI
    120. PKI Steps
    121. RA Roles
    122. CA
    123. Let’s Walk Through an Example
    124. Digital Certificates
    125. Certificate
    126. Signing the Certificate
    127. Verifying the Certificate
    128. Trusted CA’s
    129. Non-Trusted CA
    130. One More Look 2
    131. What Do You Do with a Certificate?
    132. Components of PKI, Repository, and CRLs
    133. Revoked?
    134. CRL Process
    135. Different Uses for Certificates
    136. Lifecycle of a Certificate
    137. Cross Certification
    138. PKI and Trust
    139. Agenda 5
    140. Historical Uses of Symmetric Cryptography – Vernam Cipher
    141. Binary Mathematical Function 2
    142. One-Time Pad in Action
    143. One-Time Pad Characteristics
    144. Steganography
    145. Digital Watermarking
    146. Link versus End-to-End Encryption
    147. End-to-End Encryption
    148. Encryption Location
    149. Email Standards
    150. You Decide
    151. Non-Hierarchical
    152. Secure Protocols
    153. SSL Connection Setup
    154. Example – SSL
    155. Validating Certificate
    156. Secure Protocols (Cont.)
    157. SSL and the OSI Model
    158. E-Commerce
    159. How Are You Doing?
    160. Hard the First Times Through
    161. Secure Email Standard
    162. Agenda 6
    163. IPSec Key Management
    164. IPSec Handshaking Process
    165. VPN Establishment
    166. SAs in Use
    167. Key Issues Within IPSec
    168. IPSec Configuration Options
    169. IPSec Is a Suite of Protocols
    170. AH and ESP Modes
    171. IPSec Modes of Operation
    172. VPN Establishment (Cont.)
    173. Review
    174. Questions 2
    175. Attack Types
    176. Attacks on Cryptosystems
    177. Known-Plaintext Attack
    178. Chosen-Plaintext Attack
    179. Chosen-Ciphertext Attack
    180. Adaptive Attacks
    181. Side Channel Attacks
    182. Trusted Platform Module (TPM)
    183. TPM
    184. Full Disk Encryption
    185. Putting It All Together
    186. SSH
    187. Authentication Methods Supported
    188. Network Protection
    189. Ciphers Provided
    190. Domain 5 Review
  7. Domain 6 – Organizational Security
    1. Organizational Security
    2. Mainframe Days
    3. In the Good Old Days – Who Knew?
    4. Today’s Environment
    5. Security Definitions
    6. Vulnerabilities
    7. Examples of Some Vulnerabilities that Are Not Always Obvious
    8. Risk – What Does It Really Mean?
    9. Relationships
    10. Who Deals with Risk?
    11. Overall Business Risk
    12. Who?
    13. AIC Triad
    14. Availability
    15. Integrity
    16. Confidentiality
    17. Who Is Watching?
    18. Social Engineering
    19. What Security People Are Really Thinking
    20. Security Concepts
    21. Security?
    22. The Bad Guys Are Motivated
    23. If Not Obscurity – Then What?
    24. Common Open Standards
    25. Without Standards
    26. Logical and Physical Controls
    27. Are There Gaps?
    28. Understanding Drivers
    29. Not Always So Easy
    30. Different Types of Backups
    31. Backup Types
    32. Incremental Backup
    33. Incremental
    34. Differential Backup
    35. Backup Protection
    36. Agenda 3
    37. Mean Time Between Failure
    38. Single Point of Failure
    39. Redundant and Fault Tolerance
    40. Mirroring Data
    41. Disk Duplexing
    42. Redundant Array of Independent Disks
    43. Massive Array of Inactive Disks (MAID)
    44. Redundant Array of Independent Tapes (RAIT)
    45. Serial Advanced Technology Architecture
    46. SAN
    47. Fault Tolerance
    48. Redundancy Mechanism
    49. Some Threats to Computer Operations
    50. Trusted Recovery of Software
    51. After System Crash
    52. Security Concerns
    53. Needs for BCP
    54. Is Your Organization Prepared?
    55. Is Your Company Prepared?
    56. 9/11 Changed Mentalities About BCP
    57. Disaster Affected Many
    58. America Is Rebuilding
    59. Partial FEMA Disaster List for 2005
    60. DRP Focus
    61. BCP Focus
    62. Comparing the Two
    63. What Is the Purpose of a BCP?
    64. More Reasons to Have Plans in Place
    65. Framework
    66. BCP Is a Core Component of Every Security Program
    67. Steps of BCP Process
    68. Different BCP Model
    69. Documentation
    70. Documentation and Approval
    71. BCP Policy Outlines
    72. BCP Policy Sample
    73. Who Is In Charge and Who Can We Blame?
    74. What’s Needed In a Team?
    75. BCP Development Team
    76. Project Sizing
    77. Properly Determining Scope Is Important
    78. BCP Risk Analysis Steps
    79. BIA Steps
    80. Information from Different Sources
    81. Analysis
    82. Critical Functions
    83. Interdependencies
    84. Well, Of Course an Organization Knows How It Works!
    85. Business Silos
    86. Identifying Functions’ Resources
    87. Who Connects to Who?
    88. BIA Steps (Cont.)
    89. MTD
    90. Example
    91. MTD Definitions
    92. BIA Steps (Cont.)
    93. Thinking Outside of the Box What If…
    94. Biological Threats
    95. BIA Steps (Cont.)
    96. Potential Disasters
    97. Risk Approach
    98. Ranking by Risk Level
    99. Potential Losses
    100. Include All RISK Components
    101. What Have We Completed Up to Now?
    102. BIA Steps (Cont.)
    103. Alternate Business Process Procedures
    104. Business Process Reconstruction
    105. Recovery Strategies (Cont.)
    106. Facility Backups – Hot Site
    107. Facility Backups – Warm Site
    108. Facility Backups – Cold Site
    109. Compatibility Issues with Offsite Facility
    110. Tertiary Sites
    111. Subscription Costs
    112. Multiple Processing Centers
    113. Location, Location, Location
    114. Other Offsite Approaches
    115. Security Does Not Stop
    116. More Options
    117. Rolling Hot Site
    118. Recovery Strategies (Cont.)
    119. Supply and Technology Recovery
    120. VoIP
    121. Equipment Replacement
    122. What Items Need to Be Considered?
    123. Priorities
    124. Executive Succession Planning
    125. User Environment Recovery
    126. Co-Location
    127. Data Recovery
    128. Backup Redundancy
    129. Recovering Data
    130. Automated Backup Technologies
    131. Tape Vaulting
    132. Data Recovery (Cont.)
    133. Clustering for Fault Tolerance
    134. Disk or Database Shadowing
    135. Which Option to Use
    136. Cost Effective Measures
    137. Resources, Time, Solutions
    138. Determining Recovery Solutions
    139. Cost and Recovery Times
    140. BIA Steps (Cont.)
    141. Recovery Solutions
    142. Preventative Measures
    143. Reviewing Insurance
    144. Results from the BIA
    145. Now Ready to Develop the Plan
    146. Products That Can Help
    147. Plan Components
    148. External Groups
    149. Activation Phase
    150. Damage Assessment
    151. Notifying Personnel
    152. Plan Activation
    153. Emergency Response
    154. Recovery Procedures
    155. Documentation of Recovery Steps
    156. Reconstitution Phase
    157. Who Goes First?
    158. Disaster Hit – Now What?
    159. Termination of BCP
    160. Life Cycle
    161. Backup of the Backup Plan
    162. Types of Tests to Choose From
    163. Test Objectives
    164. Training Requirements
    165. Lessons Learned
    166. What Is Success?
    167. Out of Date?
    168. Keeping It Current
    169. Change Control
    170. Resulting Plan Should Contain…
    171. Phases of the BCP
    172. Why Incident Response?
    173. Incident Response Alarms
    174. Threats
    175. Incident Response Framework
    176. Preparation and Planning
    177. IRT – Incident Response Team
    178. Incident Response Team – Mission
    179. Incident Response Team – Objectives
    180. Incident Response Team – Priorities
    181. Incident Response Team – Liaisons
    182. Detection
    183. Chain of Custody (2)
    184. Poking Into Network Traffic
    185. Snort
    186. Containment
    187. Containment – Some Considerations
    188. Notification
    189. Investigation
    190. Rules of Evidence
    191. Acceptable Evidence
    192. Exclusionary Rules
    193. Evidence Recognition
    194. Evidence Discovery
    195. Search and Seizure
    196. Network Monitoring
    197. Reviewing System Logs
    198. Interviewing
    199. Terminating the Investigation
    200. Recovery
    201. Response
    202. Follow-Up
    203. Electronic Forensic
    204. Media Analysis Procedures
    205. Media Analysis – IACIS Framework
    206. Step 1 – Sterile Media
    207. Step 2 - Legal Software
    208. Step 3 - Physical Examination of the Evidence
    209. Step 4 - Avoid Altering the Evidence
    210. Step 5 - Capture Date/Time and CMOS (RTC/NVRAM) Information
    211. Step 6 - Create an Exact Image
    212. Step 7 - Logically Examine the Image
    213. Step 8 - Examine the Boot Record Data and User-Defined Files
    214. Step 9 - Recover and Examine All Deleted Files
    215. Step 10 - Create a Listing of All Files
    216. Step 11 - Examine Unallocated Space for Lost or Hidden Data
    217. Step 12 - Examine File Slack
    218. Step 13 - Examine All User Created Files
    219. Step 14 - Unlock and Examine Password-Protected Files
    220. Step 15 - Create Printouts of All of the Apparent Evidence
    221. Step 16 - Examine Executable Files and Run Applications
    222. Step 17 - Write the Forensic Analysis Report
    223. Components of Security Program
    224. A Layered Approach
    225. In Security, You Never Want Any Surprises
    226. Building Foundation
    227. Security Roadmap
    228. Functional and Assurance Requirements
    229. Building Foundation
    230. Most Organizations
    231. Silo Security Structure
    232. Islands of Security Needs and Tools
    233. Get Out of a Silo Approach
    234. Security Is a Process
    235. Approach to Security Management
    236. Result of Battling Management
    237. Industry Best Practices Standards
    238. Pieces and Parts
    239. Numbering
    240. New ISO Standards
    241. COBIT
    242. COBIT – Control Objectives
    243. Measurements
    244. Information Technology Infrastructure Library
    245. Security Governance
    246. Policy Framework
    247. Policy Approved – Now What?
    248. Issue-Specific Policies
    249. System-Specific Policies
    250. Standards
    251. Baseline
    252. Data Collection for Metrics
    253. Guidelines
    254. Procedures
    255. Tying Them Together
    256. Program Support
    257. Senior Management’s Role
    258. Security Roles
    259. Custodian
    260. Auditor
    261. Access
    262. Information Classification
    263. Data Leakage
    264. Do You Want to End Up In the News?
    265. Types of Classification Levels
    266. Data Protection Levels
    267. Classification Program Steps
    268. Information Classification Components
    269. Procedures and Guidelines
    270. Classification Levels
    271. Information Classification Criteria
    272. Criteria Example
    273. Or Not
    274. Information Owner Requirements
    275. Clearly Labeled
    276. Information Classification
    277. Employee Management
    278. Employee Position and Management
    279. Hiring and Firing Issues
    280. A Few More Items
    281. Unfriendly Termination
    282. Security Awareness and Training
    283. Training Characteristics
    284. Awareness
    285. Security Enforcement Issues
    286. PII
    287. Domain 6 Review
    288. Course Closure

Product information

  • Title: CompTIA Security+ SY0-201 Video Course
  • Author(s): Shon L. Harris
  • Release date: June 2009
  • Publisher(s): Pearson IT Certification
  • ISBN: 9780789739964