This is what you need to know to pass the Security+ exam.

• Criminal Law - Violations that can result in a jail sentance or other punishment
• Civil Law - Resolve Disputes
• Administrative Law - facilitate effective government
• Private Regulations - Flow from Contractual Relationships
• 4^th Amendment - Right to be secure from unreasonable searches and seizures and arbitrary arrests. Law enforcement officials normally need a warrant to conduct these activities.
• Federal Information Security Modernization Act (FISMA)
  1. Security Frameworks - A collection of standards and practices designed to form a solid approach to information security
  2. Reference Frameworks - A description of the specific controls that would achieve an organization's security objectives

• Identify - Assists in developing an organizational understanding to managing cybersecurity risk to systems, people, assets, data, and capabilities.
• Protect - Outlines appropriate safeguards to ensure delivery of critical infrastructure services and supports the ability to limit or contain the impact of a potential cybersecurity event.
• Detect - Defines the appropriate activities to identify the occurrence of a cybersecurity event.
• Repond - Includes appropriate activities to take action regarding a detected cybersecurity incident and supports the ability to contain the impact of a potential cybersecurity incident.
• Recover - Identifies appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident in a timely manner.

• Provides a common language for cybersecurity risk
• Helps identify and prioritize actions
• Aligns security actions across control types
• Offers different value to different organizations

Please see NIST's online learning of the five parts of their cybersecurity Framework for more information.

Defense in Depth - Organizations should use multiple, overlapping security controls to achieve each of their security objectives. This layered approach protects the integrity of organizational information assets against the following:

1. The failure of any single security control
2. Eavesdropping attacks
3. Malicious network traffic
4. Unauthorized access to resources

1. Technical - Logical controls (e.g. encryption, file permission settings, authentication and etcetera)
2. Administrative - Official activities to minimize security risks (e.g. background checks on prospective employees, implementing NonDisclosure Agreements [NDAs] and etcetera)
3. Physical - Tangible measures to protect organizational assets (e.g. Security Guards, fences, locks, security cameras and etcetera)

Security Education

1. Security Training - knowledge to protect the organization
2. Security Awareness - Reminders of concepts covered in security training

Customize training based upon user roles

• Established Security Policies and Programs - detailed rules and instructions that management ratifies and activities to educate users on these rules and instructions
• Training frequency - depends on organization's needs

Information Classification

• Data Classification Policies - data handling
• Labeling Requirements - Identify sensitive information
• Securely dispose information on old devices

Compliance Training

• Compliance Programs - Ensure information security controls are consistent with laws and regulations.
• Include compliance obligations
  • Laws - rules for everyone that are created by statutes that originate from legilative bills (e.g. Public Law 106 - 102 - Gramm-Leach-Bliley Act)
  • Regulations - rules that are created by a government agency (e.g. HIPAA Home Security Rules)
  • Standards - Detailed technical specifications for security and other controls (e.g. PCI DSS Agreement)
• Begin implementing compliance obligations with a gap analysis
• Implement Good User Habits, such as:
  • Good Passwords
  • Clean Desk Policies
  • Physical Security Training
  • Good BYOD policies
  • Appropriate peer-to-peer and social media use

User-Based Threats

• Phishing - Collecting user credentials by tricking users into giving out their credentials
• Social Engineering - The art of manipulating people so they give up confidential information
• Malware - Malicious software

Measuring Security Training

• Simulated Phishing (e.g. PhishMe Simulator)
• Security Awareness Surveys - Ask users how they feel about information security.
• Measure how awareness changes over time - Analyzing survey answers over time.
• Change tactics based on survey results - Adapting security training according to organizational needs and how well users know their part in maintaining information security.

• Network Border Firewall - A firewall which is on the perimeter of the network and does packet filtering and then applies rules from Access Control Lists (ACLs) to determine what is allowed into the LAN.
• Network Traffic Collectors - Used to determine what traffic exists on a network by doing the following:
  • Collect and analyze data flow
  • Correlate data and unveil traffic patterns
  • Pin point the cause of bottle necks and other security risks
• Network Switched Port ANalyzer (SPAN) Ports - A port that a sniffer is attached to for netflow analysis.
• Security Information and Event Management (SIEM) - Provides real-time analysis of security alerts generated by network hardware and applications to help network administrators respond to attacks faster and organize mountains of log data.
• Proxy servers and content filters (normally in DMZ) - Evaluates web requests from users and forwards it to the internet. When the responses come back to the proxy server it will evaluate the responses and then forawrd it back to the user, if the responses are deamed acceptable.
• VPN Concentrators - A type of networking device that provides secure creation of VPN connections and delivery of messages between VPN nodes (usually a router), built specifically for creating and managing VPN communication infrastructures.
• SSL Accelerators - Maintain the security and encryption of data going through a large network while also making sure the application runs efficiently by going through the handshake process for Secure Socket Layer (SSL) process on behalf of web servers in a server farm (i.e. the SSL Accelerator will process encryption and decryption requests while the web servers render web content).
• Load Balancers - Distribute network traffic across multiple servers
• DDoS Mitigation Tools - Tools that prevent a Distributed Denial of Service (DDoS) attack on the network.

• Network Functions
  1. Control Plane - Data flow decisions made by switches and routers
  2. Data Plane - Data simply being forwarded through routers and switches (no decisions made)
• Security benefits
  • Granular network configurations
  • Respond to Security Incidents
• Security Network Complexity - Need to monitor and act appropriately

Secure Systems Design - Appliances do the following:

• Bundle together hardware and software to achieve a function
• Often run full operating systems
• Requires vendor support for updates

Data Encryption does the following:

• Protects Data
• Mostly uses software (e.g. aescrypt)
• Full Disk Encryption (FDE) protects and entire hard drive (e.g. FileVault on Apple Mac)
• Hardware Security Modules (HSMs) use dedicated hardware that is built for encryption and decryption (gold standard) and come in the following forms:
  • Trusted Platform Modules (TPMs)
  • Self-Encrypting Drives (SEDs)

• Basic Input and Output Systems (BIOS) • Vulnerable
• Unified Extensible Firmware Interface (UEFI), which includes the following:
  • Secure Boot
    1. Read the boot loader from disk
    2. Compute the hash of the boot loader
    3. Decrypt the boot loader's digital signature
    4. Verify that the signature is accurate
  • Remote Atestation
• Hardware Root of Trust - Verifies that the UEFI is good
• Electromagnetic Magnetic Interference (EMI)
• Peripheral Security - shoring up peripherals to protect agains attacks

1. Patch Operating Systems
2. Secure printer's web server (i.e. change the administrative passwords from their defaults)
3. Encrypt print traffic
4. Secure wipe printer hard drives (e.g. DBAN [for personal use] or Blancco [for Enterprise use])

• Use of scripts to deploy servers and workstations (e.g. DISM)
• Distributive allocation refers to load balancing
• Validate system configurations
• Continuous monitoring for automation for analysis and response events

• Automatic builds
• System snapshots
• Revert to known state
• Live boot media

• Monitoring for deviations from security standards
• Leveraging Industry Standards (e.g. NIST Security Standards for Apple OS X 10.10)
• Security Benchmarks (e.g. benchmarks.cisecurity.org)

• Use security baselines to establish any necessary changes
• Document the reasons for any deviations from industry standards
• Add, remove and modify controls to develop proprietary (customized) security standards

1. Baseline - A measurement or state (snapshot) at a point in time - Used to define normal usage
2. Development - Creating programs and solutions for users - Security professionals need to track changes made by developers
3. Integrity Measurement - A determination on how well a program or solution leaves the system in its original state after it ends, using Trusted Platform Module (TPM) which is a special tamper resistant hardware chip that provides cryptographic hash functions to fingerprint an executable - Used at load time (when code gets deployed) to verify the integrity.
   
   While TPM collects information on the executable, TPM does not actually calculate the hash values. The following mechanisms are used to track changes to code after deployment and then calculate the hash values:
   • Integrity Measurement Architecture (IMA) - Maintains a kernel trust chain
   • Core-Root-of-Trust-Measurement (CRTM) - Measures the bootloader and then sends the hash value to the TPM for storage in a Platform Configuration Register (PCR) with an Attestation Identity Key (AIK)

• Software Development Life-Cycle (SDLC) - Uses the following process to produce high-quality software products:
  

  Planning* - Analysis of customers, associates and industry experts and then subsequent assessment to plan the basic project approach and to conduct product feasibility study in the economical, operational and technical areas Defining - to clearly define and document the product requirements and get them approved from the customer or the market analysts. Designing - To propose more than one design approach for the product architecture and then document it in a Design Document Specification (DDS) Building - the actual development starts and the product is built according to the DDS Testing - Developers and Quality Assurance personnel test the product to verify whether or not it meets the requirements Deployment - The product is formally released (deployed) in the appropriate manner * Since updates are likely required, developers will likely need to return to the planning stage until the product or solution is deemed obsolete.

  __________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________

• Waterfall Model (not common due to strictness) - Follows this process:
  

  Requirement Analysis - All possible requirements of the system to be developed are captured System Design - The requirement specifications from first phase are studied in this phase and the system design is prepared Implementation - With inputs from the system design, the system is first developed in small programs called units, which are integrated in the next phas Testing - All the units developed in the implementation phase are integrated into a system after testing of each unit Deployment - Once all of the test results are satisfied, the product is deployed Maintenance - Users are supported and issues which come up in the client environment get fixed with patches that are released

  __________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________

• Spiral Model - moved through in an iterative manner in the following manner:

  Planning* - Identifying the system requirements for continuous communication between the system analyst and the customer(s) Risk Analysis - Identifying potential risks planning a mitigation strategy which must be finalized before going to the next step Engineering - Testing, coding and deploying software to the customer(s) Evaluation - Evaluation of software by the customer, identifying risks, mitigating issues and monitoring risks such as schedule slippage and cost overrun * The planning stage starts again as issues and concerns come up or when updates or patches become necessary.

  __________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________

• Agile (ajəl) - This is a good software development method because of its iteractive nature which uses the following process:
  
  
  1. Concept - Projects are envisioned and prioritized

  2. Inception - Team members are identified, funding is put in place, and initial environments and requirements are discussed

  3. Construction Iterations - The development team works to deliver working software based on iteration requirements and feedback

  4. Deployment - Quality Assurance (QA) testing, internal and external training, documentation development, and final release of the iteration into production

  5. Production - Ongoing support of the software or solution

  6. Retirement - End-of-life activities, including customer notification and migration

  __________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________

• Maturity Models - provides a way for developers to compare their work benchmark standards

  SoftWare - Capability Maturity Model (SW - CMM) Initial - The software process is characterized as ad hoc, and occasionally even chaotic. Few processes are defined, and success depends on individual effort. Repeatable - Basic project management processes are established to track cost, schedule, and functionality. The necessary process discipline is in place to repeat earlier successes on projects with similar applications. Defined - The software process for both management and engineering activities is documented, standardized, and integrated into a standard software process for the organization. All projects use an approved, tailored version of the organization's standard software process for developing and maintaining software. Managed - Detailed measures of the software process and product quality are collected. Both the software process and products are quantitatively understood and controlled. Optimizing - Continuous process improvement is enabled by quantitative feedback from the process and from piloting innovative ideas and technologies.

  IDEAL Model Initiating - The business reasons for undertaking the effort are clearly articulated. Diagnosing - builds upon the initiating phase to develop a more complete understanding of the improvement work Establishing - develop a detailed work plan by prioritizing work and developing an approach Action - implement the work that has been conceptualized and planned in the previous three phases Learning - continuously improve the ability to implement change

• Operation, maintenance, and change management - Software development is never finished until it is decommissioned
  • Change Management accomplishes two things, namely:
    1. Request For Control
    2. Release Control
  • This is the Maintenance Process (Change Management)
    
    
    1. Request for Change* - Change requests come from users, customers or management
    2. Impact Analysis - a formal way of collecting data and supposition in support of the pros and cons in any change or disruption to business
    3. System Release Planning - software developers plan, develop, maintain, and replace software systems with a high degree of efficiency and quality
    4. Change Implementation - Software Developers prepare for deployment by testing their software, making all necessary adjustments and then getting management and customer approval to release the software
    5. System Release - Deploying the software and providing support for this software
  
  *Since change is inevitable, developers will need to return to step 1 after system release for patching issues and software updates. This process keeps cycling through until the software is no longer used.

• Developer Operations (DevOps) - The most common software development method because of its iteractive nature which builds collaboration & embraces automation for a secure and efficient development environment
  
  • Infrastructure as Code - scripts the creation of resources in which infrastructure are provisioned and managed using code and software development techniques, such as version control and continuous integration
  • Continuous Integration - developers regularly merge their code changes into a central repository, after which automated builds and tests are run
  • Security Automation or Policy as Code - A component of Infrastructure as Code that allows organizations can monitor and enforce compliance dynamically and at scale

  • Configuration Management - A component of Infrastructure as Code that allows Developers and system administrators use code to automate operating system and host configuration, operational tasks, and more

• Code Access Systems (ability to edit)
  • Immutable - Code cannot be changed
  • Mutable - Code can be changed
• Approaches to Application Control
  • Blacklist - allows most software on a device unless it is explicitly prohibited
  • Whitelist - Does not allow any software on a device unless it is explicitly permitted
• Code Repositories - House keeping of development activities for consistence (e.g. git)
  • Libraries - shared code objects
  • Software Development Kits (SDKs) - a set of software development tools that allow developers to create applications, software or framework
  • Application Programming Interfaces (APIs) - A specification of possible interactions with a software component
  • Third-party code - computer programming code licensed to the Company or any of its Subsidiaries pursuant to a Contract identified on Schedule 4.19(e) or Schedule 4.19(f)
  • Code Reuse - The practice of using already-existing code to perform a new function or to act in a new environment
  • Dead Code - Code that is never executed
• Code Signing
  • Signing the Code - Developers
    1. Obtain digital certificates
    2. Creates digital signatures for code using the private keys associated with the certificates
  • Verifying Code Signatures
    1. Users download the software
    2. The operating system uses the certificate public key to validate signatures
    3. The operating systems verifies that the signature hashes match the code
• Code Reviews - Peer Analysis - access code
  • Fagan Code Inspections (formal)
  • Less formal processes
• Compiled Code - Code that in converted to an executable program
• Runtime Code - Code that is being executed
• Software testing
  1. Model Validation -
  2. Software Verification -
     • Stress Testing
     • User Acceptance Testing (UAT) - Beta testing
     • Regression Testing
• Code Tests - Uses technology to vet code - Code review, static testing, and dynamic testing are complementary, rather than competitors
  1. Static Tests - A search for defects when the code is not running - This is considered white box testing since the code is available (see below).
  2. Dynamic Tests - Executing the code to verify that it functions properly with synthetic transactions (inputs) - best not to use actual input data.
• Software Vulnerability Testing - Software may run fine, except there may be vulnerabilities lurking in that software. Therefore, testing may be done with one of the following methods:
  • Black Box Testing - The tester does not have access to the source code of the Application Under Test (AUT)
  • Gray Box Testing - The tester has partial access to the source code of the Application Under Test (AUT)
  • White Box Testing - The tester has full access to the source code of the Application Under Test (AUT)
• Proper Input Validation - Requires the following activities:
  1. Verify that the input does not contain an invalid characters that would cause a breach in security. Please watch Professor Messer's lecture on data code injections for more information.
  2. Protect against any race condition which is a vulnerability that exists when multiple processes can access and manipulate the same data concurrently, and the outcome of the execution depends on the particular order in which the access takes place - A race condition allows an attacker to run an illegitimate script that processes data at the same time that the legitimate processes that same data with the hope of gaining unauthorized access to that data by "Winning the Race" against the legitimate process.
• Fuzz testing - Automatically puts in input value to try to break the code (e.g. OWASP's Zed Attack Proxy [ZAP]) - Avoid looking like a hacker! here are a few different types of fuzzing:
  • Application Fuzzing - Attack vectors within the application's input and output
  • Protocol Fuzzing - Forged packets sent to the tested application which can act as a prozy and modify requests on the fly and then replay them
  • File Format Fuzzing - Multiple malformed samples that are generated and then opened sequentially - When the program crashes then the debug information is kept for further investigation.
• Code Execution
  1. Interpreted Code - written in a higher level program
  2. Compiled Code - Produces an executable file which runs in binary or machine language

• Database Normal Forms (Normalization)
  1. 1^st Normal Form (1NF) - You must define the data items
  2. 2^nd Normal Form (2NF) - The data items should meet all the rules for 1NF and there must be no partial dependencies of any of the columns on the primary key
  3. 3^rd Normal Form (3NF) - The following conditions are mandatory:
     • The data items are in second normal form and
     • All nonprimary field are dependent on the primary key
• Encryption - Protect sensitive data (including development code) by ciphering the plain text so that it cannot be read by a normal human
• Obfuscation and camouflage - Hide the locations of sensitive data (including development code)
• Stored Procedures for data security - Write Sequential Query Language (SQL) code that can be reused over and over again to protect from SQL Injection attacks

• Virtualization - machines that exist logically on a physical server which runs a virtualization system (e.g. VMWare), but is not a physical host.
• Hypervisors permit the instance (use) of one or many different Operating Systems (OSs) to run on single hosts, independently (e.g. VMWare or Microsoft Hyper-V). The different types of hypervisors include:
  1. runs directly on physical hardware
  2. runs on a hosted operating system that can run other applications, but are not directly connected to physical hardware
• Virtual Security
  • Virtual machine isolation is critical
  • Each server must access to only its own memory and storage
  • Patch the virtualization system to guard against Virtual Machine escape attacks which attempt to break out of the guest environment - Often the result of a Virtualized Environment Neglected Operations Manipulation (VENOM) attack or a Pwn2Own attack.
• VM Sprawl - Lease to unused and unmaintained servers (need to patch virtualization systems)
• Cloud computing models - running a logical computer on equipment owned by someone else
  1. Public - Organization uses a shared tenancy infrastructure (i.e. computer exists in a remote site)
  2. Private - Organization uses dedicated cloud infrastructure (i.e. computer exists on the organization's premesis)
  3. Hybrid - A combination of Public and Private clouds
  4. Community - Designed to accommodate the mutual needs of a particular business community
• Public cloud tiers
• Software as a Service (SaaS) - Software that runs on a server (e.g. Google Docs - Customer is responsible for the data & vendor takes care of the rest
• Infrastructure as a Service (IaaS) - Customer is responsible for data, applications and Operating System & vendor is responsible for the hardware and the Data Center
• Platform as a Service (PaaS) - Customer is responsible for the data and applications & vendor is responsible for the rest
• Security as a Service (SecaaS) - Provides security tools and services, such as:
  • Identity and Access Management (IAM)
  • Email security
  • Encryption
  • Firewall management
  • IDS/IPS
  • SIEM
  • Vulnerability and compliance assessments
  • Website security
• Cloud Storage Security - Apply the same security controls in the cloud
  • Encryption - Prevents unauthorized users from access via ciphering plain text (need decryption keys)
  • Access Control - Restrict Access to online computers
• Security Service Providers
• Managed Security Service Providers (MSSPs) = SECurity as a Service (SECaaS) which are IT service providers that provide organizations with some amount of cybersecurity monitoring and management services
• Cloud Access Security Brokers (CASB) - Provides on-premises, or cloud-based security policy enforcement points, placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as the cloud-based resources are accessed. The following are pillars of CASB:
  • Visibility - The capability to see risk in the environment
  • Compliance - The capability to meet regulatory requirements
  • Data security - Identifying, monitoring, and securing sensitive data
  • Threat protection - Protection against cloud-native malware and account compromise
  The two types of CASBs are:
  1. Network-Based
     • Broker intercepts traffic between the user and the cloud service, monitoring for security issues
     • Broker can block requests
  2. API-Based
     • The broker queries the cloud service via API
     • Broker may not be able to block requests, depending upon API capabilities
• Desktop and application virtualization
  • Virtual Desktop Infrastructure (VDI) - Provides network-based access to a desktop computing environment
  • Virtual Desktop Environments (VDEs) - Similar to server virtualization, except for the differences in their usage and the performance demanda made on them
  • Containerization - Runs multiple apps on the same operating system with restricted resource access (Application cells = Containers)

• Go back to Domain #2 → Technology and Tools,
• Proceed to Domain #4 → Identity and Access Management,
• Return to the main Security+ resources page,
• Return to the main Nine Star training website, or
• Go to the main Nine Star website.

Good luck!