CompTIA Exam Prep - ITF+, A+, Network+, Security+, CySA+

 EMAIL ATTACKS Phishing • Email based • Prevented by DMARC Spear phishing • Email based • Multiple people in the same department/company • Prevented by DMARC Whaling • Email based • C-Level (CEO, CFO, etc) Board of Directors • Specific to the person it targets

 WHOIS COMMAND Whois ·          Too much information ·          The correct amount of information

 SQLi SQLi (SQL Injection) ·          Server-side attack ·          A query formatted: ‘ or ‘1’=’1’ -- is a SQL injection attack. ·          SELECT * FROM ·          Prevented by o    Input validation o    Removing semi-colons, dashes, quotations, & commas o    Stored procedures

 XSS (Cross-Site Scripting) XSS (Cross-Site Scripting) Client-side attack JavaScript HTML iFrame URL ends in .js Percent encoding %C (<) & %3E (>)

 HSTS HTTP Strict Transport Security (HSTS) is a web security policy mechanism that forces web browsers to interact with a website using only HTTPS (secure HTTP) connections, preventing man-in-the-middle attacks and protocol downgrade attacks. It achieves this by sending a "Strict-Transport-Security" HTTP response header from the server to the browser, instructing it to always use HTTPS for future visits to that site and its subdomains (if specified).  Here's a more detailed explanation: How HSTS Works: 1. Initial HTTPS Connection: The first time a user accesses a website with HSTS enabled, they must connect using HTTPS, and the server sends back an HSTS header.  2. HSTS Header: The header includes a max-age directive, specifying how long (in seconds) the browser should remember to use HTTPS for that domain. It may also include includeSubDomains to apply the rule to all subdomains, and preload to allow the site to be included in a browser's built-in list of HSTS sites...

 USB Data Blocker / Prevent Juice Jacking A USB data blocker, often referred to as a "USB condom," is a small device designed to protect your devices from potential security threats when charging via public USB ports. Here's a detailed explanation: What is a USB Data Blocker? A USB data blocker is a device that connects between your device (like a smartphone or tablet) and a USB charging port. Its primary function is to block data transfer while allowing power to pass through, ensuring that your device charges safely without the risk of data theft or malware infection. How Does a USB Data Blocker Work? USB cables have multiple pins that serve different functions, including data transfer and power delivery. A USB data blocker disables the pins responsible for data transfer, allowing only the power pins to function. This means that while your device can still receive power and charge, no data can be transferred to or from the device. Why Do You Need a USB Data Blocker? Publ...

  Juice Jacking Juice jacking is a type of cyber-attack that targets devices like smartphones and tablets when they are charged via public USB ports. Here's a detailed explanation: What is Juice Jacking? Juice jacking occurs when a malicious actor uses a compromised USB charging port or cable to either install malware on a device or steal data from it. This attack exploits the fact that USB cables can transfer both power and data. How Does Juice Jacking Work? When you plug your device into a public USB charging station, such as those found in airports, cafes, or other public places, you might unknowingly connect to a compromised port. The attacker can use this connection to: Install Malware: Malicious software can be installed on your device, which can then be used to steal data, track your activities, or even take control of your device. Steal Data: Sensitive information such as contacts, emails, photos, and passwords can be copied from your device without your knowledge. Types o...

  Regulations and Standards to know for the exam      NIST RMF: Supply chain risks ISO 27001: Organization meets the security standards ISO 27002: Classifies security controls ISO 27017 & 27018: Cloud security ISO 27701: Personal data & privacy ISO 31000 / 31K: Risk assessments GDPR: European Union / International Standards ·          Data owners, data controllers, data processors, & data protection officer ·          Data owner: responsible for determining how the data may be used ·          Data controller: responsible for the protection of privacy & website user rights ·          Data Protection Officer: Independent advocate for care & use of customer information, & responsible for ensuring the organization is complying with relevant laws PCI DSS: ·      ...

 2-Step Verification or Out-of-Band This process is completed by generating a software token on a server and sending it to a user. The token can be sent via: SMS (Short Message Service):  The code is sent to a registered phone number Email: The code is emailed to a registered email account Push Notification: The code is sent to an authenticator app on a smartphone or PC. This is seamless. The user does not have to enter the code; just tap the notification.  Phone call: The code is sent as an automated phone call (voice) to a registered phone number

 WIRESHARK / TCPDUMP Wireshark is a free download in GUI format. The sniffer winpcap captures the traffic, and Wireshark analyzes it.  With Wireshark, you can capture specific protocols or IP addresses. It also offers many different options for viewing protocols, flags, and the direction of the data stream.  With Linux, you can use a command-line protocol analyzer, tcpdump . If the capture is saved as a .pcap file, it can be imported into Wireshark, making it easier to read.  Specific ports can be port mirrored to capture that traffic. The NIC (Network Interface card) must have promiscuous mode enabled. On a Linux system, this can be enabled with the following command: "ifconfig eth0 promisc".

ISO 27001/27002/27017/27701/31000 27001 - Provides requirements for an information security system. This lets other organizations know that your company meets security standards. 27002 - Classifies security controls 27017 - Guidelines for information security controls for cloud services 27701 - Focuses on personal data and privacy 31000 - Standards related to risk management, also referred to as ISO 31K

 Requirements for PCI DSS compliance 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor-supplied defaults for system passwords and other security parameters 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open, public networks 5. Use and regularly update anti-virus software or programs 6. Develop and maintain secure systems and applications 7. Restrict access to cardholder data by business need-to-know 8. Assign a unique ID to each person with computer access 9. Restrict physical access to cardholder data 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes 12. Maintain a policy that addresses information security for employees and contractors