Sec+ Exam Tips (Ian Neil)

# Hardware Management

- New Device: Change default settings immediately

- Legacy Device: Harden due to lack of vendor support

- Firmware: Software upgrade for hardware/BIOS

# Hardware Deprovisioning

- Destruction: Destroy, shred, pulverize, degauss

- Sanitization: Reuse/donate via wiping/overwriting

# Work Documentation

- MSA: Terms and conditions of contract

- SOW: Type and duration of work to be performed

# Privacy Regulations

- GDPR: EU privacy law for multinational data handling

- ISO 27701: Data Privacy Controls

- CCPA: California Consumer Privacy Act

# Data Roles

- Data Owner: Sets access/sharing policy

- Data Custodian: Stores, manages, backs up, encrypts data

- Data Controller: Creates data handling policy

- Data Processor: Follows Controller's policies

- Data Privacy Officer: Ensures compliance

- Data Subject: Person whose data is being used

# Access Control

- Mandatory: Based on file classification

- Role Based: Based on job function

- Discretionary: Owner grants access based on subject's identity

# Software Development Lifecycle

- Development: Multiple developers merge code

- Testing: Final version testing

- Staging: Testing and patching environment

- Production: Package and distribute software

# Vulnerabilities

- CVE List: Vulnerabilities and affected platforms

- CVSS: Vulnerability scoring (9-10 critical)

- Credentialed: Privilege scan - sees third-party software

- Non-Credentialed: User-level scan perspective

# IPSec

- L2TP/IPSec VPN: Home to work (Tunnel mode)

- L2TP/IPSec Site to Site: Point-to-point (Always-on)

- Server to server internal: Transport Mode

# Cloud Services

- Public Cloud: Multi-tenant, shared risk

- Private Cloud: Single tenant, control over security

- IaaS: Hardware/servers requiring OS installation

- SaaS: Leased application, no customization

- Load Balancer: Geographical dispersal

- CASB: Cloud security visibility and control

# Common Attacks

- Whaling: CEO/Executive email targeting

- SQL Injection: Database SELECT* or 1=1 attack

- Buffer Overflow: Memory overwrite via excess data

- Phishing: Email attack

- Smishing: SMS attack

# Threat Actors

- Hacktivist: Political/social motivation

- Insider: Staff sabotage

- Shadow IT: Unauthorized network devices

- Organized Crime: Financial extortion

- Nation-State: Sophisticated government attacks