CompTIA Security+ SY0-601备考笔记（英文笔记）

**引言：**这是一篇完全基于Mike Chapple在In Learning上发布的视频课的笔记，本篇即第一节课的笔记记录，主要是对于考试内容，考试规则的一些介绍。对于部分第一次出现的专业名词，例如propagation mechanism（传播机制）, payload（有效载荷）, vulnerability（漏洞）等，使用了中文标注释义便于对照记忆，但是由于SY0-601采用了纯英文考试形式，所以应当放弃Google translate以及视频中的中文字幕，使用纯英文学习。Take pains, and be perfect!

推荐工具：

1. DAVID SEIDL - COMPTIA SECURITY+ PRACTICE TESTS
2. Mike Chapple, David Seidl - CompTIA Security+ Study Guide
3. https://www.oxfordlearnersdictionaries.com/

Q：为什么没有更新白帽子讲Web安全的笔记？
A：一直都在看这本书，但是其中内容较为浓缩，涉及对于网络协议、JavaScript、溢出、SQL、不同种类攻击的理解，每学一点都要查阅大量资料，笔记目前看来非常不完善、逻辑较为混乱、内容质量较低，故打算日后一并更新。

Security+ exam introduction

• Duration: 90mins

• Examine content:

  • attacks, threat, vulnerabilities（漏洞）;

    account for 24% ;

    8 objectives

    • Compare and contrast social engineering tech：Spam(邮件诈骗)、fishing attacks

    • Determine the type of attack(malware(恶意软件):

      Need to understand the propagation(传播) methods；

      Need to understand payloads(有效载荷，即核心恶意代码) used by various types of malicious code

      • Viruses: spread through human action;

      • Worms: spread by themselves;

      • Trojan Horses: pose as beneficial software

      • etc.

    • Analyze application attacks

      Analyze indicators associated with application attacks when I am given a scenario.

      Need to understand injection, XSS attacks, directory to reversal（目录遍历）, buffer overflows(缓冲区溢出), request forgery(Cross-Site Request Forgery 跨站请求伪造，CSRF)

    • Analyze network attacks

      Analyze how to dive into the indicators associated with network attacks.

      Need to understand network attacks:

      • Man in the middle

      • Man in the browser

      • Domain Name System(DNS) related attacks

      • DDoS

      • Layer2

    • Explain threat actors, vectors, and intelligence(情报，即CIA的I) source

      • Script kiddies

      • Hacktivists

      • Organized crime

      • Nation-state

      • Insiders

      • Competitors

    • Types of vulnerabilities

      • weak configuration

      • Third-party risks

      • Improper patch management

      • Legacy platform

    • Understand Security assessment techniques

      • Threat hunting

      • Security information and event management systems

      • Vulnerability scanning

        include credentialed scan,none-credentialed, intrusive scan, none-intrusive scan.

    • Explain the proper use of penetration testing 渗透测试

      • Active reconnaissance (侦察)

      • passive reconnaissance

      • pivoting 中转攻击

      • escalation of privilege

      • Understand differences between

        • Black box

        • White box

        • Grey box

  • Architecture and design;

    account for 21%; 8 objectives

    • Explain enterprise security concepts.

      • Configuration management

      • Data sovereignty(主权)

      • site resiliency

      • deception （欺骗技术，例如诱饵系统、蜜罐）and disruption （干扰技术）tech

    • Summarize the virtualization and cloud computing concepts

      • Hypervisor types

      • VM sprawl and VM escape avoidance

      • Cloud computing tech

      • Deployment models

    • Summarize secure application development and deployment concepts

      • Development lifecycle models

      • Secure DevOps environment

      • Version control

      • Change management

      • Understand secure provisoning and de-provisioning of resources

      • Secure coding tech and code quality assurance

    • Summarize authentication and authorization design concepts

      • Authentication techs

        • The use of biometrics

        • Deploying mutifactor authentication

    • How cybersecurity resilience strategies reduce risk

      • The use of security controls to increase:

        • Elasticity

        • Scalability

        • Redundancy （冗余）

        • Fault tolerance

        • High availability

      • Importance of protecting discs, power, network

      • Replicating data across different geographical sites

      • Use of offsite backup techs

    • Explain the security implications of embedded and specialized systems

      • Security associated with industrial control systems

      • Smart devices, cameras, medical devices

      • Network segmentation, security layers, application firewalls, control redundancy and diversity

    • Physical security issues and how they related to Information security

      From control environment to fire exstinguisher

    • Summarize the basics of crytography

      • Understand encryption and decryption

      • Understand digital signatures

      • The use of symmetrical and asymmetrical encryption algorithm(对称和不对称加密算法)

      • Public key and private key

  • implementation（部署实现）;

    account for 25%;

    9 objectives;

    • Able to implement secure protocols and services in a given scenario

      • Learn many acronyms of security tech(缩写)

        such as DNS, IPsec, HTTPS, TLS, SFTP, SMNP

      • Common network ports required to create firewall rules

    • Implement host or application security solutions in different scenarios

      • Endpoint protection techs

      • Database security

      • Application security techs

      • System hardening

      • Use of hardware security tools

        • Self-encrypting drives

        • Trusted platform modules

        • Hardware root of trust

    • Implement secure network designs (wired and wireless)

      • Learn about firewalls, routers, switches, proxies, VPN concentrators, etc.

    • Implement secure mobile solutions

    • Apply cybersecurity solutions into the Cloud

      • Cloud access security brokers (CASBs)

      • Secure web gateways

      • Firewalls

    • Implement identity and account management controls

  • Operations and incident response;

    account for 16%

    • Use approperiate tools to assess organizational security

    • Follow incident response procedures

    • Utilize appropriate data sources for an investigation

    • Basic forensic procedures

  • Governance（治理）, risk, and compliance（合规性）.

    Account for 14%;

    5 objectives;

    • How to compare and contrast security controls

    • Explain the importance of applicable regulations, standards or frameworks

    • Policies related to organizational security

    • Explain risk management processes and concepts

    • Explain privacy and sensitive data concepts

• Type of questions:

  • multiple choice questions : 1 correct answer in 4 possible answers.

  • performance based questions: manipulate（操纵） objects on the screen.

• Passing:

  • 900 out of 900, 750 passing

• Other learning sources