Comptia Cysa+ Study Guide - Chapple, Mike

. .

Résumé :
Introduction xxvii Assessment Test xli Chapter 1 Today's Cybersecurity Analyst 1 Cybersecurity Objectives 2 Privacy vs. Security 3 Evaluating Security Risks 4 Identify Threats 6 Identify Vulnerabilities 8 Determine Likelihood, Impact, and Risk 8 Reviewing Controls 10 Building a Secure Network 10 Network Access Control 10 Firewalls and Network Perimeter Security 12 Network Segmentation 15 Defense Through Deception 16 Secure Endpoint Management 17 Hardening System Configurations 17 Patch Management 17 Group Policies 18 Endpoint Security Software 19 Penetration Testing 19 Planning a Penetration Test 20 Conducting Discovery 21 Executing a Penetration Test 21 Communicating Penetration Test Results 22 Training and Exercises 22 Reverse Engineering 22 Isolation and Sandboxing 23 Reverse-Engineering Software 23 Reverse-Engineering Hardware 24 The Future of Cybersecurity Analytics 25 Summary 26 Exam Essentials 26 Lab Exercises 28 Activity 1.1: Create an Inbound Firewall Rule 28 Activity 1.2: Create a Group Policy Object 28 Activity 1.3: Write a Penetration Testing Plan 30 Activity 1.4: Recognize Security Tools 30 Review Questions 30 Chapter 2 Using Threat Intelligence 35 Threat Data and Intelligence 36 Open Source Intelligence 37 Proprietary and Closed Source Intelligence 39 Assessing Threat Intelligence 39 Threat Indicator Management and Exchange 41 The Intelligence Cycle 42 The Threat Intelligence Community 43 Threat Classification 44 Threat Actors 44 Threat Classification 45 Threat Research and Modeling 46 Attack Frameworks 48 MITRE's ATT&CK Framework 48 The Diamond Model of Intrusion Analysis 50 Lockheed Martin's Cyber Kill Chain 51 The Unified Kill Chain 53 Common Vulnerability Scoring System (CVSS) 53 Applying Threat Intelligence Organizationwide 53 Proactive Threat Hunting 54 Summary 55 Exam Essentials 56 Lab Exercises 57 Activity 2.1: Explore the ATT&CK Framework 57 Activity 2.2: Set Up a STIX/TAXII Feed 58 Activity 2.3: Intelligence Gathering Techniques 58 Review Questions 59 Chapter 3 Reconnaissance and Intelligence Gathering 63 Mapping and Enumeration 64 Active Reconnaissance 65 Mapping Networks and Discovering Topology 65 Pinging Hosts 67 Port Scanning and Service Discovery Techniques and Tools 69 Passive Footprinting 75 Log and Configuration Analysis 76 Harvesting Data from DNS and Whois 84 Responder 91 Information Aggregation and Analysis Tools 92 Information Gathering Using Packet Capture 92 Gathering Organizational Intelligence 92 Organizational Data 93 Electronic Document Harvesting 94 Detecting, Preventing, and Responding to Reconnaissance 97 Capturing and Analyzing Data to Detect Reconnaissance 97 Preventing Reconnaissance 99 Summary 100 Exam Essentials 101 Lab Exercises 102 Activity 3.1: Port Scanning 102 Activity 3.2: Write an Intelligence Gathering Plan 102 Activity 3.3: Intelligence Gathering Techniques 103 Review Questions 103 Chapter 4 Designing a Vulnerability Management Program 109 Identifying Vulnerability Management Requirements 110 Regulatory Environment 110 Corporate Policy 114 Identifying Scan Targets 114 Determining Scan Frequency 115 Active vs. Passive Scanning 117 Configuring and Executing Vulnerability Scans 118 Scoping Vulnerability Scans 118 Configuring Vulnerability Scans 119 Scanner Maintenance 123 Developing a Remediation Workflow 126 Reporting and Communication 127 Prioritizing Remediation 129 Testing and Implementing Fixes 130 Delayed Remediation Options 131 Overcoming Risks of Vulnerability Scanning 131 Vulnerability Scanning Tools 133 Infrastructure Vulnerability Scanning 133 Web Application Scanning 133 Interception Proxies 134 Wireless Assessment Tools 136 Summary 137 Exam Essentials 138 Lab Exercises 139 Activity 4.1: Install a Vulnerability Scanner 139 Activity 4.2: Run a Vulnerability Scan 1...

Biographie:

MIKE CHAPPLE, PhD, CySA+, CISSP, is Teaching Professor of IT, Analytics, and Operations at the University of Notre Dame. He's a cybersecurity professional and educator with over 20 years of experience. Mike provides cybersecurity certification resources at his website, CertMike.com.

DAVID SEIDL, CySA+, CISSP, PenTest+, is Vice President for Information Technology and CIO at Miami University. David co-led Notre Dame's move to the cloud, and has written multiple cybersecurity certification books.