Security + Exam Guide (Charles River Media Networking/Security)

As stated in Chapter 1, a “Test Tips” section is located at the end of each chapter. These Test Tips are a brief review of some of the important topics covered in the particular chapter that might be targeted by the Security+ exam. Plus, as an added bonus, there might be a few tips that you have not run across that could be helpful in your preparation. If you have trouble with a topic, it is suggested that you go back in the chapter and review it again until you understand it completely.

Also remember that there is a wealth of information available on the Internet regarding most of the topics described in this book. If you are just interested in knowing more about a subject, use every available resource. This book is designed as a preparation study resource. It is not designed to teach you everything there is to know about security. You will need a library for that.

• An operating system can use an access control list (ACL) as an authentication method to see what rights a user has to a certain object such as a file, folder or network share.

• With discretionary access control (DAC), user access to an object (that is, a file or folder) is controlled by the owner of the object. The owner of an object is usually the creator of the object unless ownership rights have been taken by an administrator or supervisor (ultimate rights) and granted to another user. The Bell-LaPadula model is based on this access control.

• The principle of least privilege is a theory that says every user should be granted the very minimal level of permission required to perform their job properly.

• In a nutshell, centralized access control means that control over rights, permissions, user IDs and system policies are maintained in one company location on one computer system.

• With decentralized access control, control of rights, permissions, user IDs and system policies can be managed from several company locations using many computer systems. The Windows NT domain models are based on this concept.

• Mandatory Access Control (MAC) is a non-discretionary access control technique. This technique assigns hierarchical, multi-level sensitivity labels to users and data (as in the military—unclassified, confidential, secret, top secret). In this labeling system, user labels are referred to as security clearances while object labels are referred to as security classifications.

• Role-Based Access Control (RBAC) is essentially a type of MAC. Applications employing RBAC provide a mechanism of formulating the system’s structure to compliment the existing structure of an organization.

• Devices such as tokens and smart cards are used for authentication purposes.

• MAC and DAC are access control techniques.

• RADIUS and TACACS are considered a centralized access control methodology.

• Passwords are considered knowledge-based authentication mechanisms.

• Sniffers are software programs or devices that listen to and gather network traffic. They can be used to monitor network traffic and weaknesses or can be used to steal passwords, user IDs, or credit card information. Most network snifters work well in networks that utilize broadcast techniques. They do not operate well in networks that use collision techniques. Network transmission techniques will be discussed further in Chapter 4.

• Password crackers are programs that figure out easy-to-guess passwords in encrypted password lists or databases.

• Remote penetration programs are software programs that use the Internet or networks as a vehicle to gain unauthorized and illegal control of a computer system or network resource.

• Local penetration programs gain unauthorized illegal access to systems on which they are run.

• Local DoS programs shut down the computers on which they are run.

• Remote DoS programs are used on the Internet or networks as vehicles to shut down other services or computers.

• Vulnerability scanners are programs that are sent out on the Internet to search for computers that might have a weakness or certain vulnerability for a specific type of attack.

• Network scanners are programs that are run on networks to map out the locations of particular networks weaknesses.

• Multi-factor authentication is the combined use of a password as well as a key-exchange system to provide strong authentication. This type of authentication scheme should be implemented when the use of a Single Sign-On and password or an encrypted key system alone will not be enough security. Multi-factor authentication is considered a very strong security practice. It is likely that the exam will expect you to know this concept.

• With mutual authentication, a trust relationship is first established between a host and its intended recipients or clients. Second, digitally signed certificates are typically implemented in order to allow the host or server system to authenticate to the client system. Then, the recipient or client system is authenticated with the host or server. It is highly likely that the exam will expect you to understand this concept.

• Weak key attacks occur on secret encrypted keys that exhibit a poor level of encryption. Please refer Chapter 5 for more information regarding weak keys. The exam is most likely to ask you about weak keys!