Security+™ Fast Pass

Security+™ Fast Pass

by James M. Stewart
Released October 2004
Publisher(s): Sybex
ISBN: 9780782143591

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

Get the streamlined tool you need to bone up for the Security+ exam [SYO-101]. Fast Pass coverage includes:

  • General security concepts.

  • Assessing risk.

  • Securing communications.

  • Implementing wireless security features.

  • Configuring a firewall.

  • Detecting intrusions.

  • Securing your organization's infrastructure.

  • Understanding the basics of cryptography.

  • Managing security keys and certificates.

  • Ensuring operational and organizational security.

  • Recovering from disasters.

  • A CD-ROM so you can practice, practice, practice.

  • Concise, objective-focused coverage and review questions.

Order your copy of the perfect preparation and review resource, Security+ Fast Pass today!

Note:CD-ROM/DVD and other supplementary materials are not included as part of eBook file.

Table of contents

  1. Copyright
    1. Software License Agreement: Terms and Conditions
      1. Software Support
      2. Warranty
      3. Disclaimer
      4. Shareware Distribution
      5. Copy Protection
  2. Acknowledgments
  3. Introduction
    1. What Is Security+ Certification?
      1. Is This Book for You?
      2. How Is This Book Organized?
        1. The Security+ Exam Objectives
        2. How to Contact the Publisher
      3. The Security+ Exam Objectives
        1. Communication Security
        2. Infrastructure Security
        3. Basics of Cryptography
        4. Operational/Organizational Security
  4. 1. General Security Concepts
    1. 1.1. Identifying Access Control Models
      1. 1.1.1. Critical Information
        1. 1.1.1.1. Mandatory Access Control (MAC)
        2. 1.1.1.2. Discretionary Access Control (DAC)
      2. 1.1.2. Role-Based Access Control (RBAC)
        1. 1.1.2.1. Exam Essentials
    2. 1.2. Identifying Authentication Methods
      1. 1.2.1. Critical Information
        1. 1.2.1.1. Kerberos
        2. 1.2.1.2. Challenge Handshake Authentication Protocol (CHAP)
        3. 1.2.1.3. Certificates
        4. 1.2.1.4. Username/Password
        5. 1.2.1.5. Tokens
        6. 1.2.1.6. Multi-Factor Authentication
        7. 1.2.1.7. Mutual Authentication
        8. 1.2.1.8. Biometrics
      2. 1.2.2. Exam Essentials
    3. 1.3. Identifying Non-Essential Services
      1. 1.3.1. Critical Information
      2. 1.3.2. Exam Essentials
    4. 1.4. Identifying Attack Methods
      1. 1.4.1. Critical Information
        1. 1.4.1.1. Denial of Service/Distributed Denial of Service (DOS/DDOS) Attacks
        2. 1.4.1.2. Back Door Attacks
        3. 1.4.1.3. Spoofing Attacks
        4. 1.4.1.4. Man-in-the-Middle Attacks
        5. 1.4.1.5. Replay Attacks
        6. 1.4.1.6. TCP/IP Hijacking Attacks
        7. 1.4.1.7. Weak Keys
        8. 1.4.1.8. Mathematical Attacks
        9. 1.4.1.9. Social Engineering
        10. 1.4.1.10. Birthday Attacks
        11. 1.4.1.11. Password-Guessing Attacks
          1. 1.4.1.11.1. Brute Force
          2. 1.4.1.11.2. Dictionary
        12. 1.4.1.12. Software Exploitation Attacks
      2. 1.4.2. Exam Essentials
    5. 1.5. Identifying Malicious Code
      1. 1.5.1. Critical Information
        1. 1.5.1.1. Viruses
        2. 1.5.1.2. Trojan Horses
        3. 1.5.1.3. Logic Bombs
        4. 1.5.1.4. Worms
      2. 1.5.2. Exam Essentials
    6. 1.6. Understanding Social Engineering
      1. 1.6.1. Critical Information
      2. 1.6.2. Exam Essentials
    7. 1.7. Understanding Auditing
      1. 1.7.1. Critical Information
      2. 1.7.2. Exam Essentials
    8. 1.8. Review Questions
    9. 1.9. Answers to Review Questions
  5. 2. Communication Security
    1. 2.1. Remote Access Technologies
      1. 2.1.1. Critical Information
        1. 2.1.1.1. 802.1x
        2. 2.1.1.2. Virtual Private Network (VPN)
        3. 2.1.1.3. Remote Authentication Dial-In User Service (RADIUS)
        4. 2.1.1.4. Terminal Access Controller Access Control System (TACACS)
        5. 2.1.1.5. Layer 2 Tunneling Protocol / Point to Point Tunneling Protocol (L2TP/PPTP)
        6. 2.1.1.6. Secure Shell (SSH)
        7. 2.1.1.7. Internet Protocol Security (IPSec)
        8. 2.1.1.8. Vulnerabilities
      2. 2.1.2. Exam Essentials
    2. 2.2. E-mail Security
      1. 2.2.1. Critical Information
        1. 2.2.1.1. Secure Multipurpose Internet Mail Extensions (S/MIME)
        2. 2.2.1.2. Pretty Good Privacy (PGP)
        3. 2.2.1.3. Vulnerabilities
          1. 2.2.1.3.1. Spam
          2. 2.2.1.3.2. Hoaxes
      2. 2.2.2. Exam Essentials
    3. 2.3. Internet Security
      1. 2.3.1. Critical Information
        1. 2.3.1.1. Secure Sockets Layer / Transport Layer Security (SSL / TLS)
        2. 2.3.1.2. Hypertext Transfer Protocol / Hypertext Transfer Protocol over Secure Sockets Layer (HTTPS)
        3. 2.3.1.3. Instant Messaging
          1. 2.3.1.3.1. Vulnerabilities
          2. 2.3.1.3.2. Packet Sniffing
          3. 2.3.1.3.3. Privacy
        4. 2.3.1.4. Vulnerabilities
          1. 2.3.1.4.1. JavaScript
          2. 2.3.1.4.2. ActiveX
          3. 2.3.1.4.3. Buffer Overflows
          4. 2.3.1.4.4. Cookies
          5. 2.3.1.4.5. Signed Applets
          6. 2.3.1.4.6. Common Gateway Interface (CGI)
          7. 2.3.1.4.7. Simple Mail Transfer Protocol (SMTP) Relay
      2. 2.3.2. Exam Essentials
    4. 2.4. Directory Security
      1. 2.4.1. Critical Information
        1. 2.4.1.1. Secure Sockets Layer / Transport Layer Security (SSL/TLS)
        2. 2.4.1.2. Lightweight Directory Access Protocol (LDAP)
      2. 2.4.2. Exam Essentials
    5. 2.5. File Transfer Protocols
      1. 2.5.1. Critical Information
        1. 2.5.1.1. Secure File Transfer Protocol (S/FTP)
        2. 2.5.1.2. Blind/Anonymous FTP
        3. 2.5.1.3. File Sharing
        4. 2.5.1.4. Vulnerabilities
          1. 2.5.1.4.1. Packet Sniffing
          2. 2.5.1.4.2. Naming Conventions
      2. 2.5.2. Exam Essentials
    6. 2.6. Wireless
      1. 2.6.1. Critical Information
        1. 2.6.1.1. Wireless Transport Layer Security (WTLS)
        2. 2.6.1.2. and 802.11x
        3. 2.6.1.3. Wired Equivalent Privacy/Wireless Application Protocol (WEP/WAP)
        4. 2.6.1.4. Vulnerabilities
          1. 2.6.1.4.1. Site Surveys
      2. 2.6.2. Exam Essentials
    7. 2.7. Review Questions
    8. 2.8. Answers to Review Questions
  6. 3. Infrastructure Security
    1. 3.1. Security Devices
      1. 3.1.1. Critical Information
        1. 3.1.1.1. Firewalls
        2. 3.1.1.2. Routers
        3. 3.1.1.3. Switches
        4. 3.1.1.4. Wireless
        5. 3.1.1.5. Modems
        6. 3.1.1.6. RAS (Remote Access Server)
        7. 3.1.1.7. Telecom / PBX (Private Branch Exchange)
        8. 3.1.1.8. VPN (Virtual Private Network)
        9. 3.1.1.9. IDS (Intrusion Detection System)
        10. 3.1.1.10. Network Monitoring/Diagnostics
        11. 3.1.1.11. Workstations
        12. 3.1.1.12. Servers
        13. 3.1.1.13. Mobile Devices
      2. 3.1.2. Exam Essentials
    2. 3.2. Media Security
      1. 3.2.1. Critical Information
        1. 3.2.1.1. Coaxial Cable
        2. 3.2.1.2. UTP/STP (Unshielded Twisted Pair/Shielded Twisted Pair)
        3. 3.2.1.3. Fiber Optic Cable
        4. 3.2.1.4. Removable Media
          1. 3.2.1.4.1. Tape
          2. 3.2.1.4.2. CD-R (Recordable Compact Disks)
          3. 3.2.1.4.3. Hard Drives
          4. 3.2.1.4.4. Diskettes
          5. 3.2.1.4.5. Flashcards
          6. 3.2.1.4.6. Smartcards
      2. 3.2.2. Exam Essentials
    3. 3.3. Security Topologies
      1. 3.3.1. Critical Information
        1. 3.3.1.1. Security Zones
          1. 3.3.1.1.1. DMZ (Demilitarized Zone)
          2. 3.3.1.1.2. Intranet
          3. 3.3.1.1.3. Extranet
        2. 3.3.1.2. VLANs (Virtual Local Area Network)
        3. 3.3.1.3. NAT (Network Address Translation)
        4. 3.3.1.4. Tunneling
      2. 3.3.2. Exam Essentials
    4. 3.4. Intrusion Detection
      1. 3.4.1. Critical Information
        1. 3.4.1.1. Network Based
        2. 3.4.1.2. Host Based
      2. 3.4.2. Active Detection and Passive Detection
        1. 3.4.2.1. Honey Pots
        2. 3.4.2.2. Incident Response
      3. 3.4.3. Exam Essentials
    5. 3.5. Environment Hardening
      1. 3.5.1. Critical Information
        1. 3.5.1.1. OS/NOS (Operating System/Network Operating System) Hardening
          1. 3.5.1.1.1. File System
          2. 3.5.1.1.2. Updates (Hotfixes, Service Packs, Patches)
        2. 3.5.1.2. Network Hardening
          1. 3.5.1.2.1. Updates (Firmware)
          2. 3.5.1.2.2. Configuration
          3. 3.5.1.2.3. Enabling and Disabling Services and Protocols
          4. 3.5.1.2.4. Access Control Lists
        3. 3.5.1.3. Application Hardening
          1. 3.5.1.3.1. Updates (Hotfixes, Service Packs, Patches)
          2. 3.5.1.3.2. Web Servers
          3. 3.5.1.3.3. E-mail Servers
          4. 3.5.1.3.4. FTP (File Transfer Protocol) Servers
          5. 3.5.1.3.5. DNS (Domain Name Service) Servers
          6. 3.5.1.3.6. NNTP (Network News Transfer Protocol) Servers
          7. 3.5.1.3.7. File/Print Servers
          8. 3.5.1.3.8. DHCP (Dynamic Host Configuration Protocol) Servers
          9. 3.5.1.3.9. Data Repositories
          10. 3.5.1.3.10. Directory Services
          11. 3.5.1.3.11. Databases
      2. 3.5.2. Exam Essentials
    6. 3.6. Review Questions
    7. 3.7. Answers to Review Questions
  7. 4. Basics of Cryptography
    1. 4.1. Cryptographic Algorithms
      1. 4.1.1. Critical Information
        1. 4.1.1.1. Hashing
        2. 4.1.1.2. Symmetric
        3. 4.1.1.3. Asymmetric
      2. 4.1.2. Exam Essentials
    2. 4.2. Cryptography Security Concepts
      1. 4.2.1. Critical Information
        1. 4.2.1.1. Confidentiality
        2. 4.2.1.2. Integrity
          1. 4.2.1.2.1. Digital Signatures
        3. 4.2.1.3. Authentication
        4. 4.2.1.4. Non-Repudiation
          1. 4.2.1.4.1. Digital Signatures
        5. 4.2.1.5. Access Control
      2. 4.2.2. Exam Essentials
    3. 4.3. Public Key Infrastructure
      1. 4.3.1. Critical Information
        1. 4.3.1.1. Certificates
          1. 4.3.1.1.1. Certificate Policies
          2. 4.3.1.1.2. Certificate Practice Statements
        2. 4.3.1.2. Revocation
        3. 4.3.1.3. Trust Models
      2. 4.3.2. Exam Essentials
    4. 4.4. Cryptographic Standards And Protocols
    5. 4.5. Key Management and Certificate Lifecycles
      1. 4.5.1. Critical Information
        1. 4.5.1.1. Centralized vs. Decentralized
        2. 4.5.1.2. Storage
          1. 4.5.1.2.1. Hardware vs. Software
          2. 4.5.1.2.2. Private Key Protection
        3. 4.5.1.3. Escrow
        4. 4.5.1.4. Expiration
        5. 4.5.1.5. Revocation
          1. 4.5.1.5.1. Status Checking
        6. 4.5.1.6. Suspension
          1. 4.5.1.6.1. Status Checking
        7. 4.5.1.7. Recovery
          1. 4.5.1.7.1. M of N Control (Of M appropriate individuals, N must be present to authorize recovery)
        8. 4.5.1.8. Renewal
        9. 4.5.1.9. Destruction
        10. 4.5.1.10. Key Usage
          1. 4.5.1.10.1. Multiple Key Pairs (Single, Dual)
      2. 4.5.2. Exam Essentials
    6. 4.6. Review Questions
    7. 4.7. Answers to Review Questions
  8. 5. Operational/Organizational Security
    1. 5.1. Physical Security
      1. 5.1.1. Critical Information
        1. 5.1.1.1. Access Control
          1. 5.1.1.1.1. Physical Barriers
          2. 5.1.1.1.2. Biometrics
        2. 5.1.1.2. Social Engineering
        3. 5.1.1.3. Environment
          1. 5.1.1.3.1. Wireless Cells
          2. 5.1.1.3.2. Location
          3. 5.1.1.3.3. Shielding
          4. 5.1.1.3.4. Fire Suppression
      2. 5.1.2. Exam Essentials
    2. 5.2. Disaster Recovery
      1. 5.2.1. Critical Information
        1. 5.2.1.1. Backups
          1. 5.2.1.1.1. Off Site Storage
        2. 5.2.1.2. Secure Recovery
          1. 5.2.1.2.1. Alternate Sites
        3. 5.2.1.3. Disaster Recovery Plan
      2. 5.2.2. Exam Essentials
    3. 5.3. Business Continuity
      1. 5.3.1. Critical Information
        1. 5.3.1.1. Utilities
        2. 5.3.1.2. High Availability/Fault Tolerance
        3. 5.3.1.3. Backups
      2. 5.3.2. Exam Essentials
    4. 5.4. Security Policy Issues
      1. 5.4.1. Critical Information
        1. 5.4.1.1. Security Policy
          1. 5.4.1.1.1. Acceptable Use
          2. 5.4.1.1.2. Due Care
          3. 5.4.1.1.3. Privacy
          4. 5.4.1.1.4. Separation of Duties
          5. 5.4.1.1.5. Need to Know
          6. 5.4.1.1.6. Password Management
          7. 5.4.1.1.7. SLAs (Service Level Agreements)
          8. 5.4.1.1.8. Disposal/Destruction
          9. 5.4.1.1.9. HR (Human Resources) Policy
          10. 5.4.1.1.10. Termination (Adding and revoking passwords and privileges, etc.)
          11. 5.4.1.1.11. Hiring (Adding and revoking passwords and privileges, etc.)
          12. 5.4.1.1.12. Code of Ethics
        2. 5.4.1.2. Incident Response Policy
      2. 5.4.2. Exam Essentials
    5. 5.5. Privilege Management
      1. 5.5.1. Critical Information
        1. 5.5.1.1. User/Group/Role Management
        2. 5.5.1.2. Single Sign-On
        3. 5.5.1.3. Centralized vs. Decentralized
        4. 5.5.1.4. Auditing (Privilege, Usage, Escalation)
        5. 5.5.1.5. MAC/DAC/RBAC (Mandatory Access Control/Discretionary Access Control/Role Based Access Control)
      2. 5.5.2. Exam Essentials
    6. 5.6. Forensics
      1. 5.6.1. Critical Information
        1. 5.6.1.1. Chain of Custody
        2. 5.6.1.2. Preservation of Evidence
        3. 5.6.1.3. Collection of Evidence
      2. 5.6.2. Exam Essentials
    7. 5.7. Risk Identification
      1. 5.7.1. Critical Information
        1. 5.7.1.1. Asset Identification
        2. 5.7.1.2. Risk Assessment
        3. 5.7.1.3. Threat Identification
        4. 5.7.1.4. Vulnerabilities
      2. 5.7.2. Exam Essentials
    8. 5.8. Security Training
      1. 5.8.1. Critical Information
        1. 5.8.1.1. Communication
        2. 5.8.1.2. User Awareness
        3. 5.8.1.3. Education
        4. 5.8.1.4. On-line Resources
      2. 5.8.2. Exam Essentials
    9. 5.9. Security Documentation
      1. 5.9.1. Critical Information
        1. 5.9.1.1. Standards and Guidelines
        2. 5.9.1.2. Systems Architecture
        3. 5.9.1.3. Change Documentation
        4. 5.9.1.4. Logs and Inventories
        5. 5.9.1.5. Classification
          1. 5.9.1.5.1. Notification
        6. 5.9.1.6. Retention/Storage
        7. 5.9.1.7. Destruction
      2. 5.9.2. Exam Essentials
    10. 5.10. Review Questions
    11. 5.11. Answers to Review Questions
  9. Glossary

Product information

  • Title: Security+™ Fast Pass
  • Author(s): James M. Stewart
  • Release date: October 2004
  • Publisher(s): Sybex
  • ISBN: 9780782143591