Log In
Or create an account -> 
Imperial Library
  • Home
  • About
  • News
  • Upload
  • Forum
  • Help
  • Login/SignUp

Index
Title Page Copyright About the Authors Acknowledgments Contents at a Glance Contents Foreword Preface Introduction Instructor Web Site Chapter 1 Introduction and Security Trends
The Computer Security Problem
Definition of Computer Security Historical Security Incidents The Current Threat Environment Threats to Security Security Trends
Targets and Attacks
Specific Target Opportunistic Target Minimizing Possible Avenues of Attack
Approaches to Computer Security Ethics Additional References Chapter 1 Review
Chapter 2 General Security Concepts
Basic Security Terminology
Security Basics Security Tenets Security Approaches Security Principles Access Control Authentication Mechanisms Authentication and Access Control Policies
Security Models
Confidentiality Models Integrity Models
Chapter 2 Review
Chapter 3 Operational and Organizational Security
Policies, Procedures, Standards, and Guidelines
Security Policies Change Management Policy Data Policies Human Resources Policies Due Care and Due Diligence Due Process Incident Response Policies and Procedures
Security Awareness and Training
Security Policy Training and Procedures Role-Based Training Compliance with Laws, Best Practices, and Standards User Habits New Threats and Security Trends/Alerts Training Metrics and Compliance
Interoperability Agreements
Service Level Agreements Business Partnership Agreement Memorandum of Understanding Interconnection Security Agreement
The Security Perimeter Physical Security
Physical Access Controls Physical Barriers
Environmental Issues
Fire Suppression
Wireless Electromagnetic Eavesdropping
Modern Eavesdropping
Chapter 3 Review
Chapter 4 The Role of People in Security
People—A Security Problem
Social Engineering Poor Security Practices
People as a Security Tool
Security Awareness Security Policy Training and Procedures
Chapter 4 Review
Chapter 5 Cryptography
Cryptography in Practice
Fundamental Methods Comparative Strengths and Performance of Algorithms
Historical Perspectives
Substitution Ciphers One-Time Pads
Algorithms
Key Management Random Numbers
Hashing Functions
SHA RIPEMD Message Digest Hashing Summary
Symmetric Encryption
DES 3DES AES CAST RC Blowfish Twofish IDEA Block vs. Stream Symmetric Encryption Summary
Asymmetric Encryption
Diffie-Hellman RSA ElGamal ECC Asymmetric Encryption Summary Symmetric vs. Asymmetric
Quantum Cryptography Steganography Cryptography Algorithm Use
Confidentiality Integrity Authentication Nonrepudiation Cipher Suites Key Exchange Key Escrow Session Keys Ephemeral Keys Key Stretching Secrecy Principles Transport Encryption Digital Signatures Digital Rights Management Cryptographic Applications Use of Proven Technologies
Chapter 5 Review
Chapter 6 Public Key Infrastructure
The Basics of Public Key Infrastructures Certificate Authorities Registration Authorities
Local Registration Authorities
Digital Certificates
Certificate Extensions Certificate Attributes
Certificate Lifecycles
Registration and Generation CSR Renewal Suspension Revocation Key Destruction
Certificate Repositories Trust and Certificate Verification Centralized and Decentralized Infrastructures
Hardware Security Modules Private Key Protection Key Recovery Key Escrow
Public Certificate Authorities In-House Certificate Authorities
Choosing Between a Public CA and an In-House CA Outsourced Certificate Authorities Tying Different PKIs Together Trust Models
Certificate-Based Threats
Stolen Certificates
Chapter 6 Review
Chapter 7 PKI Standards and Protocols
PKIX and PKCS
PKIX Standards PKCS Why You Need to Know the PKIX and PKCS Standards
X.509 SSL/TLS Cipher Suites ISAKMP CMP XKMS S/MIME
IETF S/MIME History IETF S/MIME v3 Specifications
PGP
How PGP Works
HTTPS IPsec CEP Other Standards
FIPS Common Criteria WTLS ISO/IEC 27002 (Formerly ISO 17799) SAML
Chapter 7 Review
Chapter 8 Physical Security
The Security Problem Physical Security Safeguards
Walls and Guards Physical Access Controls and Monitoring Convergence Policies and Procedures Environmental Controls
Fire Suppression
Water-Based Fire Suppression Systems Halon-Based Fire Suppression Systems Clean-Agent Fire Suppression Systems Handheld Fire Extinguishers Fire Detection Devices
Power Protection
UPS Backup Power and Cable Shielding Electromagnetic Interference
Electronic Access Control Systems
Access Tokens
Chapter 8 Review
Chapter 9 Network Fundamentals
Network Architectures Network Topology Network Protocols
Protocols Packets
Internet Protocol
IP Packets TCP vs. UDP ICMP
IPv4 vs. IPv6 Packet Delivery
Ethernet Local Packet Delivery Remote Packet Delivery IP Addresses and Subnetting Network Address Translation
Security Zones
DMZ Internet Intranet Extranet Flat Networks Enclaves VLANs Zones and Conduits
Tunneling Storage Area Networks
iSCSI Fibre Channel FCoE
Chapter 9 Review
Chapter 10 Infrastructure Security
Devices
Workstations Servers Virtualization Mobile Devices Device Security, Common Concerns Network Attached Storage Removable Storage
Networking
Network Interface Cards Hubs Bridges Switches Routers Firewalls How Do Firewalls Work? Next-Generation Firewalls Web Application Firewalls vs. Network Firewalls Concentrators Wireless Devices Modems Telephony VPN Concentrator
Security Devices
Intrusion Detection Systems Network Access Control Network Monitoring/Diagnostic Load Balancers Proxies Web Security Gateways Internet Content Filters Data Loss Prevention Unified Threat Management
Media
Coaxial Cable UTP/STP Fiber Unguided Media
Removable Media
Magnetic Media Optical Media Electronic Media
Security Concerns for Transmission Media Physical Security Concerns Cloud Computing
Private Public Hybrid Community Software as a Service Platform as a Service Infrastructure as a Service
Chapter 10 Review
Chapter 11 Authentication and Remote Access
User, Group, and Role Management
User Group Role
Password Policies
Domain Password Policy
Single Sign-On
Time of Day Restrictions Tokens Account and Password Expiration
Security Controls and Permissions
Access Control Lists Mandatory Access Control (MAC) Discretionary Access Control (DAC) Role-Based Access Control (RBAC) Rule-Based Access Control Attribute Based Access Control (ABAC) Account Expiration
Preventing Data Loss or Theft The Remote Access Process
Identification Authentication Authorization Access Control
Remote Access Methods
IEEE 802.1X RADIUS TACACS+ Authentication Protocols FTP/FTPS/SFTP VPNs IPsec Vulnerabilities of Remote Access Methods
Connection Summary Chapter 11 Review
Chapter 12 Wireless Security and Mobile Devices
Introduction to Wireless Networking Mobile Phones
Wireless Application Protocol 3G Mobile Networks 4G Mobile Networks
Bluetooth
Bluetooth Attacks
Near Field Communication IEEE 802.11 Series
802.11: Individual Standards Attacking 802.11 Current Security Methods
Wireless Systems Configuration
Antenna Types Antenna Placement Power Level Controls Site Surveys Captive Portals Securing Public Wi-Fi
Mobile Devices
Mobile Device Security BYOD Concerns Location Services Mobile Application Security
Chapter 12 Review
Chapter 13 Intrusion Detection Systems and Network Security
History of Intrusion Detection Systems IDS Overview
IDS Models Signatures False Positives and False Negatives
Network-Based IDSs
Advantages of a NIDS Disadvantages of a NIDS Active vs. Passive NIDSs NIDS Tools
Host-Based IDSs
Advantages of HIDSs Disadvantages of HIDSs Active vs. Passive HIDSs Resurgence and Advancement of HIDSs
Intrusion Prevention Systems Honeypots and Honeynets Tools
Protocol Analyzer Switched Port Analyzer Port Scanner Passive vs. Active Tools Banner Grabbing
Chapter 13 Review
Chapter 14 System Hardening and Baselines
Overview of Baselines Operating System and Network Operating System Hardening
OS Security
Host Security
Machine Hardening Operating System Security and Settings OS Hardening Hardening Microsoft Operating Systems Hardening UNIX- or Linux-Based Operating Systems Updates (a.k.a. Hotfixes, Service Packs, and Patches) Antimalware White Listing vs. Black Listing Applications Trusted OS Host-based Firewalls Hardware Security Host Software Baselining
Host-Based Security Controls
Hardware-Based Encryption Devices Data Encryption Data Security Handling Big Data Cloud Storage Storage Area Network Permissions/ACL
Network Hardening
Software Updates Device Configuration Securing Management Interfaces VLAN Management IPv4 vs. IPv6
Application Hardening
Application Configuration Baseline Application Patches Patch Management Host Software Baselining
Group Policies Security Templates Alternative Environments
SCADA Embedded Systems Phones and Mobile Devices Mainframe Game Consoles In-Vehicle Computing Systems Alternative Environment Methods Network Segmentation Security Layers Application Firewalls Manual Updates Firmware Version Control Wrappers Control Redundancy and Diversity
Chapter 14 Review
Chapter 15 Types of Attacks and Malicious Software
Avenues of Attack
Minimizing Possible Avenues of Attack
Malicious Code
Viruses Worms Polymorphic Malware Trojan Horses Rootkits Logic Bombs Spyware Adware Botnets Backdoors and Trapdoors Ransomware Malware Defenses
Attacking Computer Systems and Networks
Denial-of-Service Attacks Social Engineering Null Sessions Sniffing Spoofing TCP/IP Hijacking Man-in-the-Middle Attacks Replay Attacks Transitive Access Spam Spim Phishing Spear Phishing Vishing Pharming Scanning Attacks Attacks on Encryption Address System Attacks Cache Poisoning Password Guessing Pass-the-Hash Attacks Software Exploitation Client-Side Attacks
Advanced Persistent Threat
Remote Access Trojans
Tools
Metasploit BackTrack/Kali Social-Engineering Toolkit Cobalt Strike Core Impact Burp Suite
Auditing
Perform Routine Audits
Chapter 15 Review
Chapter 16 E-Mail and Instant Messaging
How E-Mail Works
E-Mail Structure MIME
Security of E-Mail
Malicious Code Hoax E-Mails Unsolicited Commercial E-Mail (Spam) Sender ID Framework DomainKeys Identified Mail
Mail Encryption
S/MIME PGP
Instant Messaging
Modern Instant Messaging Systems
Chapter 16 Review
Chapter 17 Web Components
Current Web Components and Concerns Web Protocols
Encryption (SSL and TLS) The Web (HTTP and HTTPS) HTTPS Everywhere HTTP Strict Transport Security Directory Services (DAP and LDAP) File Transfer (FTP and SFTP) Vulnerabilities
Code-Based Vulnerabilities
Buffer Overflows Java JavaScript ActiveX Securing the Browser CGI Server-Side Scripts Cookies Browser Plug-ins Malicious Add-ons Signed Applets
Application-Based Weaknesses
Session Hijacking Client-Side Attacks Web 2.0 and Security
Chapter 17 Review
Chapter 18 Secure Software Development
The Software Engineering Process
Process Models Secure Development Lifecycle
Secure Coding Concepts
Error and Exception Handling Input and Output Validation Fuzzing Bug Tracking
Application Attacks
Cross-Site Scripting Injections Directory Traversal/Command Injection Buffer Overflow Integer Overflow Cross-Site Request Forgery Zero-Day Attachments Locally Shared Objects Client-Side Attacks Arbitrary/Remote Code Execution Open Vulnerability and Assessment Language
Application Hardening
Application Configuration Baseline Application Patch Management NoSQL Databases vs. SQL Databases Server-Side vs. Client-Side Validation
Chapter 18 Review
Chapter 19 Business Continuity and Disaster Recovery, and Organizational Policies
Business Continuity
Business Continuity Plans Business Impact Analysis Identification of Critical Systems and Components Removing Single Points of Failure Risk Assessment Succession Planning Continuity of Operations
Disaster Recovery
Disaster Recovery Plans/Process Categories of Business Functions IT Contingency Planning Test, Exercise, and Rehearse Recovery Time Objective and Recovery Point Objective Backups Alternative Sites Utilities Secure Recovery Cloud Computing High Availability and Fault Tolerance Failure and Recovery Timing
Chapter 19 Review
Chapter 20 Risk Management
An Overview of Risk Management
Example of Risk Management at the International Banking Level Risk Management Vocabulary
What Is Risk Management?
Risk Management Culture
Business Risks
Examples of Business Risks Examples of Technology Risks
Risk Mitigation Strategies
Change Management Incident Management User Rights and Permissions Reviews Data Loss or Theft
Risk Management Models
General Risk Management Model Software Engineering Institute Model NIST Risk Models Model Application
Qualitatively Assessing Risk Quantitatively Assessing Risk
Adding Objectivity to a Qualitative Assessment Risk Calculation
Qualitative vs. Quantitative Risk Assessment Tools
Cost-Effectiveness Modeling
Risk Management Best Practices
System Vulnerabilities Threat Vectors Probability/Threat Likelihood Risk-Avoidance, Transference, Acceptance, Mitigation, Deterrence Risks Associated with Cloud Computing and Virtualization
Chapter 20 Review
Chapter 21 Change Management
Why Change Management? The Key Concept: Separation of Duties Elements of Change Management Implementing Change Management
Back-out Plan
The Purpose of a Change Control Board
Code Integrity
The Capability Maturity Model Integration Chapter 21 Review
Chapter 22 Incident Response
Foundations of Incident Response
Incident Management Anatomy of an Attack Goals of Incident Response
Incident Response Process
Preparation Security Measure Implementation Incident Identification/Detection Initial Response Incident Isolation Strategy Formulation Investigation Recovery/Reconstitution Procedures Reporting Follow-up/Lessons Learned
Standards and Best Practices
State of Compromise NIST Department of Justice Indicators of Compromise Cyber Kill Chain Making Security Measurable
Chapter 22 Review
Chapter 23 Computer Forensics
Evidence
Types of Evidence Standards for Evidence Three Rules Regarding Evidence
Forensic Process
Acquiring Evidence Identifying Evidence Protecting Evidence Transporting Evidence Storing Evidence Conducting the Investigation
Analysis Chain of Custody Message Digest and Hash Host Forensics
File Systems Windows Metadata Linux Metadata
Device Forensics Network Forensics E-Discovery
Reference Model Big Data Cloud
Chapter 23 Review
Chapter 24 Legal Issues and Ethics
Cybercrime
Common Internet Crime Schemes Sources of Laws Computer Trespass Significant U.S. Laws Payment Card Industry Data Security Standard (PCI DSS) Import/Export Encryption Restrictions Non-U.S. Laws Digital Signature Laws Digital Rights Management
Ethics Chapter 24 Review
Chapter 25 Privacy
Personally Identifiable Information (PII)
Sensitive PII Notice, Choice, and Consent
U.S. Privacy Laws
Privacy Act of 1974 Freedom of Information Act (FOIA) Family Education Records and Privacy Act (FERPA) U.S. Computer Fraud and Abuse Act (CFAA) U.S. Children’s Online Privacy Protection Act (COPPA) Video Privacy Protection Act (VPPA) Health Insurance Portability & Accountability Act (HIPAA) Gramm-Leach-Bliley Act (GLBA) California Senate Bill 1386 (SB 1386) U.S. Banking Rules and Regulations Payment Card Industry Data Security Standard (PCI DSS) Fair Credit Reporting Act (FCRA) Fair and Accurate Credit Transactions Act (FACTA)
Non-Federal Privacy Concerns in the United States International Privacy Laws
OECD Fair Information Practices European Laws Canadian Laws Asian Laws
Privacy-Enhancing Technologies Privacy Policies
Privacy Impact Assessment
Web Privacy Issues
Cookies
Privacy in Practice
User Actions Data Breaches
Chapter 25 Review
Appendix A CompTIA Security+ Exam Objectives: SY0-401 Appendix B About the Download
System Requirements Downloading Total Tester Premium Practice Exam Software Total Tester Premium Practice Exam Software
Installing and Running Total Tester
Technical Support
Total Seminars Technical Support McGraw-Hill Education Content Support
Glossary Index
  • ← Prev
  • Back
  • Next →
  • ← Prev
  • Back
  • Next →

Chief Librarian: Las Zenow <zenow@riseup.net>
Fork the source code from gitlab.

This is a mirror of the Tor onion service:
http://kx5thpx2olielkihfyo4jgjqfb7zx7wxr3sd4xzt26ochei4m6f7tayd.onion