Security+ Exam Notes

Physical Security

  • Physical access equals device ownership.
  • Surveillance:
    • CCTV (Closed Circuit TV).
    • PTZ (Pan Tilt Zoom).
  • Door Locks:
    • Keys, pins, wireless signals, or biometrics.
    • Mantrap: Area between two doors for identification/authentication.
  • Biometric Readers:
    • Relies on physical characteristics ("something you are").
    • FAR (False Acceptance Rate): Unauthorized user accepted.
    • FRR (False Rejection Rate): Authorized user rejected.
    • CER (Crossover Error Rate): FAR equals FRR; measures system effectiveness.

Facilities Security

  • Fire Suppression: Protect employees, data, equipment, and buildings.
    • Handheld fire extinguishers: Class A, B, C, D, K.
    • Sprinklers:
      • Wet Pipe: Pipes filled with water.
      • Dry Pipe: Pipes filled with pressurized air, water pushes when needed.
      • Pre-action: Activates upon heat or smoke detection.
    • Special Hazard Protection:
      • Clean Agent System: Uses gas (HALON, FM-200, CO2) instead of water.
      • Evacuate server room upon loud alarm.
  • HVAC (Heating, Ventilation, and Air Conditioning):
    • Humidity target: around 40%.
    • May connect to ICS/SCADA networks.
  • Shielding:
    • STP (Shielded Twisted Pair): Shielding inside the cable.
    • Faraday Cage: Shielding around a room to block electromagnetic energy/radio frequencies.
    • TEMPEST: U.S. Government shielding standards to prevent emissions/interference.
      • Resistant to EMPs (electromagnetic pulses).
  • Vehicles:
    • CAN (Controller Area Network): Connects car systems.
    • Air Gap: Isolates an entity.
    • Security policies must include company vehicles.

Authentication

  • Multi-factor Authentication: Two or more factors (Knowledge, Ownership, Characteristic, Location, Action).
    • Username/password = single-factor.
  • One-Time Passwords:
    • TOTP (Time-based One Time Password): Shared secret + time.
    • HOTP (HMAC-based One Time Password): Shared secret, synchronized between client/server.
  • Authentication Models:
    • Context-aware: Checks attributes before connection (time, location).
    • SSO (Single Sign-On): Single profile for all resources.
      • Compromised SSO = big breach.
    • FIdM (Federated Identity Management): Single identity shared across organizations.
      • Cross-Certification: Web of trust between organizations.
      • Trusted Third-Party: Trust in a single third-party.
      • SAML (Security Assertion Markup Language): XML-based attestation model for FIdM.
      • OpenID:
        • Open standard protocol for federated authentication.
        • Easier to implement than SAML, but less efficient.
      • 802.1x:
        • Port-based authentication framework for wired/wireless.
        • RADIUS and TACACS+.
      • EAP (Extensible Authentication Protocol):
        • Framework for various authentication methods.
        • EAP-MD5: Simple passwords.
        • EAP-TLS: Digital certificates for mutual authentication.
        • EAP-TTLS: Server-side certificate, client-side password.
        • EAP-FAST: Protected access credential instead of a certificate.
        • PEAP (Protected EAP): Server certificates and Active Directory.
        • LEAP: Cisco proprietary.
  • LDAP and Kerberos
    • LDAP (Lightweight Directory Access Protocol):
      • Centralized client/object information.
      • Unencrypted: Port 389.
      • Encrypted: Port 636.
      • Active Directory: Microsoft's version.
    • Kerberos:
      • Authentication protocol using tickets for mutual authentication.
      • Port 88.
      • Domain controller: Single point of failure.
  • Remote Desktop Services
    • RDP (Remote Desktop Protocol):
      • Microsoft's GUI remote connection protocol.
      • Port 3389
    • VNC (Virtual Network Computing):
      • Cross-platform remote GUI access.
      • Requires client, server, and protocol configuration.
      • Port 5900
  • Remote Access Services
    • PAP (Password Authentication Protocol):
      • Unencrypted credentials.
    • CHAP (Challenge Handshake Authentication Protocol):
      • Encrypts a challenge string with the password.
      • MS-CHAP: Microsoft's version.
      • Mostly used with dial-up.
  • VPN (Virtual Private Network):
    • Creates a secure tunnel over an untrusted network.
    • Client-to-Site (Remote Access) VPN.
    • VPN Concentrator: For simultaneous VPN connections.
    • Split Tunneling: Internal traffic over VPN, external traffic over local connection.
      • Prevent split tunneling via configuration/segmentation.
  • RADIUS and TACACS+
    • RADIUS (Remote Authentication Dial-In User Service):
      • Centralized authentication for dial-up, VPN, wireless (802.1x, EAP).
      • Application layer protocol.
    • TACACS+ (Terminal Access Controller Access-Control System Plus):
      • Cisco proprietary version of RADIUS.
  • Authentication Summary
    • 802.1x: Port-based Network Access Control (PNAC) at data link layer.
    • LDAP: Application layer protocol for directory services.
    • Kerberos: Mutual authentication with tickets.
    • RAS (Remote Access Services): Dial-up and VPN connections.
    • CHAP: Authentication scheme for dial-up.
    • RADIUS: Centralized authentication for dial-up, VPN, wireless - Ports 1812/1813 (UDP) or 1645/1646 (UDP).
    • TACACS+: Cisco's RADIUS version with separate authentication/authorization - Port 49 (TCP).

Access Control

  • Access Control: Securing data by verifying user permissions (read, write, delete, modify).
  • Access Control Models:
    • DAC (Discretionary Access Control):
      • Owner determines access policy.
      • Every object has an owner.
      • Commonly used.
    • MAC (Mandatory Access Control):
      • System determines access policy.
      • Relies on security labels for users (subjects) and objects.
      • Data labels create trust levels.
      • Implemented through Rule-based and Lattice-based methods.
    • Rule-based Access Control:
      • Label-based; grants/denies access based on object/subject labels.
    • Lattice-based Access Control:
      • Uses complex math to define object/subject interactions.
      • High-security systems only (complex configuration).
    • RBAC (Role-Based Access Control):
      • System controlled (like MAC) but uses permissions instead of data labels.
      • Power Users is a role-based permission in Windows
    • ABAC (Attribute-Based Access Control):
      • Dynamic, context-aware using IF-THEN statements.
  • Best Practices:
    • Implicit Deny: Deny all access by default, allow only when explicitly stated.
    • Least Privilege: Users get lowest access level needed.
    • Separation of Duties: Multiple people for sensitive tasks; can be implemented by one user with standard/admin account.
    • Job Rotation: Enhances skills, reduces boredom, increases security (identifies theft, fraud).
  • Users and Groups
    • Computers can have multiple users and groups
    • User Rights: Permissions assigned to a user
    • Groups: Collection of users based on common attributes
      • Permissions in Windows: Full Control, Modify, Read & Execute, List Folder Contents, Read, Write
      • Permissions are assigned to Owners (U), Groups (G), and All Users (O or A)
    • chmod: Command in Linux to change permissions.
      • R (Read) = 44
      • W (Write) = 22
      • X (Execute) = 11
      • Example: # chmod 760 filename (7 = Owner RWX, 6 = Group RW, 0 = No access for others)
      • 777 = Everyone has Read, Write, Execute.
    • Privilege Creep: Users accumulate permissions over time, violating least privilege.
      • User Access Recertification: Periodic revalidation of user rights.
    • Permissions:
      • Inherited from parent folder by default.
      • Propagation: Permissions passed to subfolders.
      • Use groups for roles; don't assign users directly to folder permissions.
      • Copying a folder inherits permissions from destination parent folder; moving retains original permissions.
  • Usernames and Passwords
    • Strong Passwords:
      • Uppercase, lowercase, numbers, special characters, 8+ characters (preferably 14+).
      • Require password change on account creation.
      • Frequent password changes (e.g., every 90 days).
      • Change default Administrator/Root password.
      • Disable Guest account.
      • Enable CTRL+ALT+DEL for login.
  • User Account Control (UAC):
    • Keeps users in standard mode instead of admin mode.
      • Exception: Administrator account.
      • Eliminates unnecessary admin requests, reduces malware risk.
      • Can be disabled from Control Panel.

Risk Assessments

  • Risk Assessments:
    • Identify risk in a system.
  • Risk: Threat probability.
  • Vulnerabilities: System weaknesses.
  • Threat: Potential harm to IT systems.
    • External, beyond control.
    • Risk management minimizes negative outcomes.
    • Risk Avoidance: Stop risky activity.
    • Risk Transfer: Pass risk to a third party.
    • Risk Mitigation: Minimize risk to acceptable level.
    • Risk Acceptance: Accept current risk level.
    • Residual Risk: Risk remaining after controls.
    • Identify assets, vulnerabilities, threats, and impact.
  • Qualitative Risk:
    • Uses intuition/experience to assign relative risk value.
      • Experience is critical
  • Quantitative Risk:
    • Uses numerical/monetary values to calculate risk.
    • Calculates direct cost for each risk.
    • Magnitude of Impact:
      • SLE (Single Loss Expectancy) = Asset Value x Exposure Factor (cost per threat occurrence).
      • ARO (Annualized Rate of Occurrence) = Number of times a threat occurs per year.
      • ALE (Annualized Loss Expectancy) = SLE x ARO (expected annual cost).
    • Hybrid approaches: Combine quantitative and qualitative analysis.
  • Methodologies
    • Security Assessments: Validate security posture against attacks (required by contracts, regulations, etc.).
      • Active Assessments: Intrusive techniques (scanning, probing).
      • Passive Assessments: Open source info, passive data collection (less detail).
  • Security Controls: Mitigate risk.
    • Categories: Physical, Technical, Administrative.
      • Physical Controls: Prevent unauthorized physical access.
      • Technical Controls: Safeguards for systems and information.
      • Administrative Controls: Change people's behavior.
    • NIST Categories: Management, Operational, Technical.
      • Management Controls: Decision-making, risk management.
      • Operational Controls: Actions done by people.
      • Technical Controls: Logical controls in systems.
    • Preventative, Detective, Corrective Controls
      • Preventative Controls: Installed before an event to prevent it.
      • Detective Controls: Find out bad activities happening during an event.
      • Corrective Controls: Used after an event occurs.
    • A single control can have multiple categories
    • Compensating Control: Used when normal control can’t be met.
      • Residual risk is an accepted risk
  • Vulnerability Management
    • Vulnerability assessment seeks to identify network/system issues prior to exploitation.
    • Vulnerability Management: Finding and mitigating vulnerabilities.
      • 1. What is the value of the information?
      • 2. What is the threat your system is facing?
      • 3. What is the mitigation that could be deployed?
      • Tools: Nessus, Qualysguard, AlienVault.
      • Process: Define desired state, baseline, prioritize, mitigate, monitor (Scan, Patch, Scan).
  • Penetration Testing
    • Evaluates network vulnerabilities from an external perspective; requires permission.
      • Tools: Metasploit and CANVAS.
      • Steps: Reconnaissance, enumerate targets, exploit targets, document results.
      • Pivot: Attacker moves to another system.
      • Persistence: Attacker maintains inside compromised network.
      • Can simulate insider threats.
  • OVAL
    • OVAL (Open Vulnerability and Assessment Language):
    • Standard for transferring secure public information and the Internet utilizing any security tools and service available
      • OVAL Language
        • An XML schema used to define and describe the information being created.
      • OVAL Interpreter
        • A reference developed to ensure the information passed around by these programs complies with the OVAL schemas and definitions used by the OVAL language
  • Vulnerability Assessments
    • Baselining network to assess security.
      • Network Mapping: Discovery and documentation of the network.
        • Software available
      • Vulnerability Scanning: Identifies threats without exploiting them.
        • Banner Grabbing: Gaining server info and inventory
        • Tools: Nessus and Qualysguard.
      • Network Sniffing: Finding computers on the network by capturing the packets being sent.
        • Protocol Analyzer: Packet capture, reassembly, and analysis.
      • Password Analysis