- Lesson 1 - Getting Started with CompTIA Security+ Training
-
In this lesson you will meet your instructor and you will find out what you will be doing in the lessons.
- About Your Instructor
- About This Course
- Lesson 2 - Introduction to IT Security
-
What is IT Security and why do you need to know about it? This lesson answers those questions and defines basic security terminology that will be used throughout the course.
- What is IT Security?
- The Information Security Triad – CIA
- The AAA Protocol
- Lesson 3 - Types of Attacks
-
As an IT security professional you need to have a firm understanding of all possible threats to your computers and to company infrastructure as a whole. This lesson introduces you to a wide range of attack types, including attacks on data in transit and attacks via email and other communications. You will also get some mitigation tips to help prevent and stop attacks.
- Spoofing/Poisoning
- Pharming
- Man-in-the-Middle
- Replay Attack
- Denial of Service (DoS)
- Distributed Denial of Service (DDoS)
- Smurf Attack
- Scanners and Sniffers
- Spam
- Phishing
- Privilege Escalation
- Transitive Access
- Client-side Attacks
- Lesson 4 - Malware Prevention and Cleanup
-
Malware has many variations that you will need to keep track of as an IT security professional. This lesson introduces you to each malware type, and then moves on to talk about how to lower the likelihood of malware infections and how to deal with malware after an infection occurs.
- Malware
- Viruses
- Worms
- Trojans
- Spyware
- Adware and Pop-ups
- Rootkits
- Backdoors
- Logic Bombs
- Botnets
- Ransomware
- Malware Mitigation
- Malware Removal
- Lesson 5 - Network Device Security
-
This lesson discusses what each network device is, what security purpose it serves, some security best practices for it, and if each device is physical or software based. The strengths and weaknesses of different types of firewalls are also detailed. You will also watch a demonstration of using a web browser’s built-in content inspection and filtering.
- Firewalls
- Routers
- Switches
- Load Balancers
- Proxies
- Web Security Gateways
- VPN Concentrators
- Network-based Intrusion Detection Systems (NIDS)
- Network-based Intrusion Prevention Systems (NIPS)
- Kinds of NIDS and NIPS
- Other Security Appliances
- Protocol Analyzers/Sniffers
- Host-based Filtering Tools
- Lesson 6 - Secure Network Administration
-
This lesson will familiarize you with what is available to manage your network securely. Also, the instructor demonstrates how to configure a rule on a Windows client firewall both from the graphical user interface and the command line.
- Rule-based Management
- Access Control Lists (ACLs)
- Firewall Rules
- Secure Router Configuration
- Port Security
- Flood Guards and Loop Protection
- Network Separation and Network Bridging
- Log Analysis
- Lesson 7 - Secure Network Design
-
In this lesson, you will begin thinking about using security zones to help control who can access what from inside and outside your network. Then, you will get an overview of different network design elements that can be used to create and secure these zones.
- Security Zones
- DMZ (Demilitarized Zone)
- Subnetting
- Virtual Local Area Network (VLAN)
- Network Address Translation (NAT)
- Remote Access
- Virtual Private Network (VPN)
- Telephony
- Network Access Control (NAC)
- Virtualization
- Cloud Computing
- Lesson 8 - TCP/IP Protocols and Port Security
-
This lesson starts with a quick review of TCP/IP and then moves on to discuss the common protocols that work at the different TCP/IP layers. Each protocol is evaluated for its strength and any important security considerations are listed. There is also a chart of the most common protocols and their port numbers you will use as an IT professional.
- TCP/IP
- FTP
- SSH and SCP
- Telnet
- SMTP
- DNS
- TFTP
- HTTP
- SFTP
- SNMP
- HTTPS
- FTPS
- SSL and TLS
- TCP
- UDP
- IP
- ICMP
- ARP
- TCP/IP Ports to Remember
- IPSec
- Lesson 9 - Attacks on Wireless Networks
-
After watching this lesson you should be motivated to add extra security to your wireless networks. You will get definitions of the common attacks on 802.11 and Bluetooth wireless networks along with some tips on how to lower the likelihood of these attacks.
- Rogue Access Points
- Evil Twin
- Wardriving
- Warchalking
- IV Attack
- Packet Sniffing
- Attacks on Bluetooth
- Interference
- Lesson 10 - Securing Wireless Networks
-
Now that you know what kind of wireless attacks are out there, learn what you can do about them. This lesson teaches you about ways to secure your wireless network with encryption, authentication, and configuration. Also, learn which encryption protocols are preferred and which should be avoided.
- IEEE 802.11x Wireless Standards
- WEP
- WPA and WPA2
- TKIP
- CCMP
- WAP
- EAP, PEAP, and LEAP
- Securing Wireless Routers and Access Points Best Practices
- Change the SSID and Turn off SSID Broadcast
- Consider Using MAC Filtering
- Work with Antenna Placement and Power Level Controls
- Lesson 11 - Host Security
-
Servers and clients have their own set of security vulnerabilities. This lesson teaches you what needs to be done to harden your physical, virtual, and mobile hosts.
- Antimalware
- Host-based Firewalls
- Updates and Patch Management
- Disabling Unused Services
- Users and Accounts
- Virtualization
- Host Software Baselining
- Securing Servers
- Securing Mobile Devices
- Lesson 12 - Securing Applications
-
Every application installed on a host should be considered as a possible security issue. This lesson explains the most common attacks on applications, and how to avoid them. The lesson will then go on to discuss different tasks to strengthen application security.
- Cookies
- Session Hijacking
- Header Manipulation
- Cross-site Scripting (XSS)
- Cross-site Request Forgery (XSRF or CSRF)
- Injection Attacks
- Preventing Injection Attacks
- Buffer Overflow
- Java Applets and JavaScript
- ActiveX Controls
- Demo: Internet Explorer Security Settings
- Malicious Add-ons, Attachments, and Zero Day Exploits
- Secure Coding Concepts
- Fuzzing
- Application Hardening
- Lesson 13 - Data Security
-
Special care needs to be taken to insure data is protected. This lesson covers when and where to use different software-based and hardware-based data encryption methods. Also covered is the use of data loss prevention systems.
- Data Loss Protection (DLP)
- Individual Files/Folders Encryption
- Full Disk/Whole Disk Encryption
- Database Encryption
- Removable Media Encryption
- Mobile Device Encryption
- Trusted Platform Module (TPM)
- Hardware Security Module (HSM)
- USB Encryption
- Hard Drive Encryption
- Encryption Key Management
- Data in the Cloud
- Lesson 14 - Authentication, Authorization, and Access Control
-
The three A’s: authentication, authorization, and access control are fundamental to managing who can interact with what in your environment. Learn the best practices to keep the bad-guys (internal or external) from accessing what they shouldn’t. This is done by using credentials that could be something you know, something you have, or something you are.
- Identification vs. Authentication
- Authentication and Authorization
- Something You Know, Something You Have, and Something You Are
- Single Factor vs. Multifactor Authentication
- Types of Access Control
- Information Models
- Mandatory Vacations
- Job Rotation
- Separation of Duties
- Trusted OS
- Lesson 15 - Physical and Environmental Security
-
This lesson teaches you what your company should be considering for physical and environmental security. Because all the money and effort spent on technical controls are useless if the servers overheat or if someone walks right in and steals your server.
- Physical Security
- Fencing
- Mantraps
- Access Lists
- Proximity Readers
- Video Surveillance and Monitoring
- Hardware Locks
- Environmental Security
- HVAC Considerations
- Hot and Cold Aisles
- Environmental Monitoring and Controls
- Fire Suppression
- Power Systems
- Electromagnetic Emissions: Interference and Shielding
- Lesson 16 - Authentication Services
-
There are several different technologies that handle authentication for the access of resources and data. Watch this lesson to learn about both newer and older authentication service options.
- Introduction to Authentication Services
- RADIUS
- TACACS+
- TACACS and XTACACS
- Kerberos
- LDAP
- Lesson 17 - User Account Management
-
It is important to have user accounts that are secure but allow the users to access what they need for their job. Learn the concepts behind setting up and maintaining well configured user accounts in this lesson.
- Privilege Management
- Group Based Privileges
- User Account Policy
- Password Policies
- Lesson 18 - Risk Management
-
All organizations small and large need to uncover and then decide how to manage risks. This lesson covers how to assess different risks, calculate their impact, and the options for handling those risks.
- Risk Management Vocabulary
- Risk Management Steps
- Impact Analysis
- Risk Calculation
- Options for Handling Risk
- Control Types
- Lesson 19 - Threat and Vulnerability Assessment and Detection
-
In this lesson you will learn about different assessment types, techniques, and tools for discovering security threats and vulnerabilities.
- Assessment Types
- Assessment Techniques
- Tools
- Vulnerability Scanning
- Penetration Testing
- Black, White, and Gray Box Testing
- Lesson 20 - Risk Mitigation and Deterrence
-
Now that you have discovered and assessed risk, this lesson talks about deterring and mitigating those risks using hardening, policies, technical controls, and more.
- Security Posture
- Manual Bypassing of Electronic Controls
- Change Management
- Implement Security Controls Based on Risk
- Detection vs. Prevention Controls
- Hardening
- Perform Routine Audits
- Data Loss or Theft Prevention
- Security Policies
- Privacy Policies
- Acceptable Use Policies (AUP)
- Other Policies
- Lesson 21 - Log Monitoring and Reporting
-
One way to mitigate risk and help keep an eye on threats in real time is with log monitoring and reporting. In this lesson you will learn about different log file types and how to manage logs in order to gain useful information from them.
- Reporting
- Monitoring and Analyzing Logs
- Log Types
- Logs Management
- Lesson 22 - Business Continuity
-
Business continuity planning focuses on ensuring continued business operations are available day-to-day, because every minute of system downtime is money lost. This lesson introduces business continuity concepts so you can start planning for expected and unexpected IT failures or attacks that lead to breaks in operation.
- Business Continuity vs. Disaster Recovery
- Business Continuity Planning (BCP) and Testing
- Business Impact Analysis
- IT Contingency Planning
- Continuity of Operations
- Succession Planning
- Lesson 23 - Disaster Recovery Planning
-
Having a well thought out and tested disaster recovery plan allows an organization to get their infrastructure and/or data back up and running in the event of a disaster. This lesson talks about both the physical network elements and the preparation concepts for disaster recovery planning.
- Disaster Recovery Plan
- Service Level Agreement (SLA)
- Utilities
- Backup Types
- Backup Plans
- Backup Storage Options
- Recovering from Backups
- Backup and Recovery Considerations
- Redundancy
- Fault Tolerance
- RAID: Redundant Array of Independent Disks
- Load Balancing
- Clustering
- Alternative/Backup Sites
- Lesson 24 - Incident Response
-
Even expensive preparation and planning can’t guarantee an incident won’t happen. Learn about what goes into a good incident response plan in order to control the damage and data loss caused by incidents. This lesson also discusses the basics of computer forensics for investigating and analyzing computer systems that have been attacked.
- Incident Response Plan
- Damage and Loss Control
- Chain of Custody
- First Responder
- Basic Forensic Procedures
- Lesson 25 - User Education
-
Users have the ability to greatly help or hinder the security efforts of an organization. The best written policies are useless if users don’t follow them. That is why in this lesson you will learn about security awareness and training that needs to take place at all levels of the company.
- Security Policy Training and Procedures
- Threat Awareness
- Personally Identifiable Information (PII)
- Regulatory Compliance
- Social Networking
- Peer to Peer (P2P) File Sharing
- User Habits
- Information Classification
- Data Labeling, Handling, and Disposal
- Lesson 26 - Social Engineering
-
To attack your organization, social engineering attackers exploit the gullibility, niceness, or even enthusiasm of your staff. In this lesson you will learn about social engineering techniques that all employees need to be aware of and prepared for.
- Social Engineering Overview
- Impersonation
- Tailgating
- Dumpster Diving
- Shoulder Surfing
- Phishing
- Hoaxes
- Reverse Social Engineering
- Lesson 27 - Cryptography Concepts
-
In this lesson you will learn the basics of what cryptography is and how it works. The lesson describes symmetric cryptography, asymmetric cryptography, and cryptographic hashing.
- Cryptography Overview
- Symmetric vs. Asymmetric Encryption
- Digital Signatures
- Non-repudiation
- Encryption/Decryption Methods
- Cryptographic Hashing
- Transport Encryption
- Steganography
- Use of Proven Technologies
- Lesson 28 - Cryptography Tools
-
In this lesson you will apply the information from the cryptography concepts lesson to learn about several cryptography algorithms and their comparative strengths.
- DES
- 3DES
- RC4
- AES
- Blowfish
- Twofish
- Diffie-Hellman
- RSA
- ECC
- Collisions
- SHA
- MD5
- RIPEMD
- HMAC
- SSL/TLS and HTTPS
- SSH
- IPSec
- Wi-Fi Authentication
- PGP/GPG
- NTLM and NTLMv2
- One-time Pads (OTP)
- CHAP and PAP
- Whole Disk Encryption
- Comparative Strengths of Algorithms
- Lesson 29 - Public Key Infrastructure (PKI) Concepts
-
This lesson covers the basic concepts of public key infrastructure which is a common way to provide data integrity, non-repudiation, and data confidentiality.
- Public Key Infrastructure (PKI) Overview
- Digital Certificates
- Certificate Authorities (CA)
- How PKI Works
- Registration Authorities
- Certificate Revocation Lists (CRL)
- Recovery Agents
- Key Escrow
- Lesson 30 - PKI Implementation
-
Building on what you learned in the PKI concepts lesson this lesson goes into the policies, practices, and management considerations for implementing PKI.
- Publicly Trusted Certificate Authorities
- Internal Certificate Authorities
- Working with Registration Authorities
- Key Management
- Certificate Management
- Trust Models
- Lesson 31 - Preparing for Your CompTIA Security+ SY0-301 Certification Exam
-
Watch this lesson if you are interested in taking the Security+ Test. This lesson gives an overview of the exam and how the exam objectives match up with the lessons in this course.
- About the Exam
- Mapping Exam Objectives to this Course
- Studying for the Exam
- Test Day Tips
- Lesson 32 - Next Steps
-
You have finished watching the course, now what? In this lesson, we’ll look back at what we covered and discuss additional materials you may want to consult going forward beyond certification.
- What We Have Covered in This Course
- My Favorite Supporting Resources
- Get Certified
- Continue Learning
- Join the Community