CIW: Web Security Associate (1D0-671)

What Is Security?

• What Is Security?
• Network Security Background
• Wireless Network Technologies and Security
• IEEE 802.11 Wireless Standards
• Wireless Network Security Problems
• Wireless Network Security Solutions
• Convergence Networking and Security
• Firewall Practices Applied to Virtual LANs (VLANs)
• Cyber-attacker Statistics
• The Myth of 100-Percent Security
• Attributes of an Effective Security Matrix
• What You Are Trying to Protect
• Lesson Summary

Security Threats

• Who Is the Threat?
• Security Threats from Trusted Users
• Anonymous Downloads and Indiscriminate Link-Clicking
• Security Standards
• Wireless Networking Modes
• Wireless Application Protocol (WAP)
• Site Surveys
• Web Technologies
• Greynet Applications
• Sensitive Data and Data Classifications
• Vulnerabilities with Data at Rest
• Data and Drive Sanitizing
• Lesson Summary
• Optional Lab

Elements of Security

• Security Elements and Mechanisms
• Security Policy
• Determining Backups
• Encryption
• Authentication
• Specific Authentication Techniques
• Access Control
• Auditing
• Security Tradeoffs
• Defense in Depth Strategy
• Lesson Summary
• Optional Lab

Applied Encryption

• Reasons to Use Encryption
• Creating Trust Relationships
• Symmetric-Key Encryption
• Symmetric Algorithms
• One-Way (Hash) Encryption
• Asymmetric-Key Encryption
• Applied Encryption Processes
• Encryption Review
• Certification Authority (CA)
• Full/Whole Disk Encryption
• Lesson Summary
• Optional Lab

Types of Attacks

• Network Attack Categories
• Brute-Force, Dictionary, and Password Spraying Attacks
• Rainbow Tables, Pass-the-Hash, and Birthday Attacks
• Password Storage Techniques
• System Bugs and Back Doors
• Malware (Malicious Software)
• TLS encryption
• Social Engineering Attacks
• Denial-of-Service (DoS) Attacks
• Distributed Denial-of-Service (DDoS) Attacks
• Spoofing Attacks
• Scanning Attacks
• Man-in-the-Middle Attacks
• Bots and Botnets
• Ransomware
• SQL Injection
• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF)
• Auditing
• Lesson Summary
• Optional Lab

General Security Principles

• Common Security Principles
• Be Paranoid
• You Must Have a Security Policy
• No System or Technique Stands Alone
• Minimize the Damage
• Deploy Companywide Enforcement
• Provide Training
• Use an Integrated Security Strategy
• Place Equipment According to Needs
• Identify Security Business Issues
• Consider Physical Security
• Lesson Summary
• Optional lab

Protocol Layers and Security

• TCP/IP Security Introduction
• OSI Reference Model Review
• Data Encapsulation
• The TCP/IP Stack and the OSI Reference Model
• Link/Network Access Layer
• Network/Internet Layer
• Transport Layer
• Application Layer
• Protocol Analyzers
• Domain Name Service
• Trusted Platform Modules and Microsoft BitLocker
• Change Management
• Lesson Summary
• Optional Lab

Securing Resources

• TCP/IP Security Vulnerabilities
• Implementing Security
• Resources and Services
• Protecting TCP/IP Services
• Simple Mail Transfer Protocol (SMTP)
• Bring Your Own Device (BYOD)
• Internet of Things (IoT)
• Communication Systems
• Physical Security
• Testing Systems
• Security Testing Software
• Security Assessments
• Security and Repetition
• Lesson Summary
• Optional Lab

Firewalls and Virtual Private Networks

• Access Control Overview
• Definition and Description of a Firewall
• The Role of a Firewall
• Firewall Terminology
• Operating System and Network Device Hardening
• Firewall Configuration Defaults
• Packet Filter Rules
• Packet Filter Advantages and Disadvantages
• Configuring Proxy Servers
• URL Filtering
• Remote Access and Virtual Private Networks (VPNs)
• Public Key Infrastructure (PKI)
• Cloud Computing and Virtualization
• Lesson Summary
• Optional Lab

Levels of Firewall Protection

• Designing a Firewall
• Types of Bastion Hosts
• Hardware Issues
• Common Firewall Designs
• Putting It All Together
• Lesson Summary
• Optional Lab

Detecting and Distracting Cyber-Attackers

• Proactive Detection
• Distracting the Cyber-Attacker
• Deterring the Cyber-Attacker
• Lesson Summary

Incident Response

• Risk Management, Mitigation, and Incident Response
• Creating an Incident Response Policy
• Determining If an Attack Has Occurred
• Executing the Response Plan
• Analyzing and Learning
• Lesson Summary

Appendix A: Web Security Associate-v2.0 Objectives and Locations

Appendix B: Works Cited