CompTIA Security+ Study Notes 1

Overview of Security

  • Domains:
    • Threats, Attacks, and Vulnerabilities (21%)
    • Technologies and Tools (22%)
    • Architecture and Design (15%)
    • Identity and Access Management (16%)
    • Risk Management (14%)
    • Cryptography and PKI (12%)
  • Information Security: Protecting data from unauthorized access, modification, disruption, disclosure, corruption, and destruction.
  • Information Systems Security: Protecting systems that hold and process critical data.

Basics and Fundamentals

  • CIA Triad:
    • Confidentiality: Information not disclosed to unauthorized people.
    • Integrity: Information not modified without authorization.
    • Availability: Information accessible at all times.
  • AAA of Security:
    • Authentication: Establishing identity with proof.
    • Authorization: Granting access to data or areas.
    • Accounting: Tracking data, computer usage, and network resources; includes non-repudiation.

Security Threats

  • Malware: Malicious software.
  • Unauthorized Access: Access without owner's consent.
  • System Failure: Computer crashes or application fails.
  • Social Engineering: Manipulating users for confidential information.

Mitigating Threats

  • Physical Controls: Alarm systems, locks, surveillance cameras.
  • Technical Controls: Smart cards, encryption, access control lists.
  • Administrative Controls: Policies, procedures, security awareness training.

Hackers

  • White Hats: Non-malicious, break into systems at request.
  • Black Hats: Malicious, break into systems without authorization.
  • Gray Hats: Unaffiliated, break into networks risking legal consequences.
  • Blue Hats: Work with permission but are not employed.
  • Elite: Find and exploit vulnerabilities first (rare).
  • Script Kiddies: Use others' exploits with limited skill.

Threat Actors

  • Script Kiddies: Use tools written by others.
  • Hacktivists: Driven by social, political, or terrorist causes.
  • Organized Crime: Well-funded and sophisticated crime groups.
  • Advanced Persistent Threats: Highly trained, often nation-state backed.

Malware

  • Malware: Software designed to infiltrate and damage systems without user consent.
  • Types:
    • Viruses: Require user action to spread.
      • Boot Sector: Infects the first sector of a hard drive.
      • Macro: Embedded in documents.
      • Program: Infects executable files.
      • Multipartite: Combines boot and program viruses.
      • Polymorphic: Changes to avoid detection.
      • Metamorphic: Rewrites itself entirely.
      • Armored: Uses protection layers to confuse analysis.
    • Worms: Self-replicate without user interaction.
    • Trojans: Disguised as harmless software but perform malicious functions; Remote Access Trojans (RATs) provide remote control.
    • Ransomware: Restricts access until ransom is paid.
    • Spyware: Gathers user information without consent.
    • Rootkits: Gain administrative control without detection.
    • Spam: Abuses electronic messaging systems.

Malware Summary

  • Virus: Code that infects a computer when a file is opened or executed.
  • Worm: Acts like a virus but can self-replicate.
  • Trojan: Appears to do a desired function but also does something malicious.
  • Ransomware: Takes control of your computer or data unless you pay.
  • Spyware: Software that collects your information without your consent.
  • Rootkit: Gains administrative control of your system by targeting boot loader or kernel.
  • Spam: Abuse of electronic messaging systems.

Malware Infections

  • Threat Vector: Method used to access a victim's machine.
  • Attack Vector: Method to gain access to infect with malware.
  • Common Delivery Methods: Software, messaging, media.
  • Watering Holes: Malware placed on frequented websites.
  • Botnets: Collections of compromised computers under master node control.

Active Interception & Privilege Escalation

  • Active Interception: Computer placed between sender and receiver to capture/modify traffic.
  • Privilege Escalation: Exploiting flaws to gain access to restricted resources.

Backdoors and Logic Bombs

  • Backdoors: Bypass normal security and authentication.
  • Logic Bomb: Malicious code executes when conditions are met.

Symptoms of Infection

  • Inaccessible drives, files, or applications.
  • Strange noises or error messages.
  • Unusual display or jumbled printouts.
  • Double file extensions.
  • Missing or corrupted files and folders.
  • System Restore malfunction.

Removing Malware

  • Identify symptoms.
  • Quarantine infected systems.
  • Disable System Restore.
  • Remediate infected system.
  • Schedule updates and scans.
  • Enable System Restore and create a new restore point.
  • Provide user training.
  • Reboot from external device if boot sector virus suspected.

Preventing Malware

  • Use anti-malware solutions for worms, trojans, and ransomware.
  • Reimage machine for rootkit removal.
  • Verify email servers aren’t open relays.
  • Remove email addresses from website.
  • Use whitelists and blacklists.
  • Train end users.
  • Update software and operating systems regularly.

Security Applications and Devices

  • Removable Media Controls: Technical limitations on USB usage.
  • Network Attached Storage (NAS): Storage devices connected to the network.
  • Storage Area Network (SAN): Network for block storage functions.

Software Firewalls

  • Personal Firewalls: Protect a single computer.
  • Host-based firewalls.

IDS

  • Intrusion Detection System: Monitors system or network for incidents/attacks.
    • HIDS: Host-based IDS.
    • NIDS: Network-based IDS.
  • Detection Methods: Signature-based, Policy-based, Anomaly-based.
  • Alert Types: True/False positives/negatives.
  • IDS alerts and logs; IPS stops malicious activity.

Pop-up Blockers

  • Web-browsers can block JavaScript pop-ups.

Content Filters

  • Block external files containing JavaScript, images, or web pages from loading in a browser.

Data Loss Prevention

  • Data Loss Prevention (DLP): Monitors data in use, transit, or at rest to detect theft attempts.
    • Endpoint DLP System: Monitors data in use on a computer.
    • Network DLP System: Detects data in transit.
    • Storage DLP System: Inspects data at rest.
    • Cloud DLP System: Protects data stored in cloud services.

Securing the BIOS

  • Basic Input Output System (BIOS): Firmware for input/output instructions.
  • Steps:
    • 1. Flash the BIOS.
    • 2. Use a BIOS password.
    • 3. Configure the BIOS boot order.
    • 4. Disable the external ports and devices.
    • 5. Enable the secure boot option.

Securing Storage Devices

  • Encrypt files on removable media.
  • Implement removable media controls.
  • NAS and SAN security measures.
    • 1. Use data encryption
    • 2. Use proper authentication
    • 3. Log NAS access

Disk Encryption

  • Encryption scrambles data.
  • Self-Encrypting Drive (SED): Performs whole disk encryption with embedded hardware.
  • Trusted Platform Module (TPM): Chip on motherboard with encryption key.
  • Advanced Encryption Standard: Symmetric key encryption.
  • Hardware Security Module (HSM): Secure cryptoprocessor during encryption.

Mobile Device Security

  • WiFi Protected Access 2 (WPA2) is the highest level of wireless security
  • AES: Advanced Encryption Standard
  • Bluetooth pairing creates a shared link key to encrypt the connection
  • Wired devices are almost always more secure than wireless ones

Mobile Malware

  • Patch and update mobile devices.
  • Install apps from official stores only.
  • Avoid jailbreaking/rooting.

SIM Cloning & ID Theft

  • Subscriber Identity Module (SIM): Stores IMSI number and key.
  • Be careful with where you post phone numbers

Bluetooth Attacks

  • Bluejacking: Sending unsolicited messages.
  • Bluesnarfing: Unauthorized access of information.

Mobile Device Theft

  • Back up devices.
  • Remote Lock: Requires PIN/password.
  • Remote Wipe: Erases device contents.

Security of Apps

  • Install apps from official stores.
  • Mobile Device Management: Centralized policy enforcement.
  • Turn location services off.
  • Geotagging: Embedding geolocation coordinates.

Bring Your Own Device

  • BYOD introduces security issues.
  • Storage Segmentation: Separation of personal/company data.
  • Ensure a good security policy for mobile devices.

Hardening Mobile Devices

  • 1. Update your device to the latest version of the software
  • 2. Install AntiVirus
  • 3. Train users on proper security and use of the device
  • 4. Only install apps from the official mobile stores
  • 5. Do not root or jailbreak your devices
  • 6. Only use v2 SIM cards with your devices
  • 7. Turn off all unnecessary features
  • 8. Turn on encryption for voice and data
  • 9. Use strong passwords or biometrics
    1. Don’t allow BYOD