SSCP Video Course
Shon Harris
30+ hours of personal video training from leading security expert Shon Harris
The fast, powerful way to prepare for your SSCP exam!
Get all the hands-on training you need to pass (ISC)²’s tough SSCP exam, get certified, and move forward in your IT security career! In this easy-to-use video, the world’s #1 information security trainer walks you through every skill and concept you’ll need to master. This video contains 30+ full hours …
SSCP Video Course
Shon Harris
30+ hours of personal video training from leading security expert Shon Harris
The fast, powerful way to prepare for your SSCP exam!
Get all the hands-on training you need to pass (ISC)²’s tough SSCP exam, get certified, and move forward in your IT security career! In this easy-to-use video, the world’s #1 information security trainer walks you through every skill and concept you’ll need to master. This video contains 30+ full hours of videos adapted from Shon Harris’s legendary five-day SSCP boot camps–including realistic labs, scenarios, case studies, and animations designed to build and test your knowledge in real-world settings!
Comprehensive coverage of all seven SSCP domains of knowledge:
. Access controls
. Analysis and monitoring
. Risk, response, and recovery
. Cryptography
. Security operations and administration
. Networking and telecom
. Malicious code
About the Shon Harris Security Series
This video is part of a complete library of books, online services, and videos designed to help security professionals enhance their skills and prepare for their certification exams. Every product in this series reflects Shon Harris’s unsurpassed experience in teaching IT security professionals.
Category: Security
System Requirements
OPERATING SYSTEM: Windows 2000, XP, or Vista; Mac OS X 10.4
(Tiger) or later
MULTIMEDIA: DVD drive; 1024 x 768 or higher display; sound card
with speakers
COMPUTER: 500MHz or higher CPU; 128MB RAM or more
Course Introduction
Introduction 00:17:17
Domain 1 - Access Controls
Access Controls 00:01:08
Definitions 00:01:05
Access Control Mechanism Examples 00:01:03
Technical Controls 00:00:54
Access Control Characteristics 00:03:25
Preventive Controls 00:00:56
Preventive – Administrative Controls 00:02:20
Detective – Administrative Control 00:02:08
Detective Examples 00:00:48
Administrating Access Control (1) 00:01:25
OS, Application, Database 00:00:36
Administrating Access Control (2) 00:01:00
Authorization Creep 00:00:59
Accountability and Access Control 00:01:26
Trusted Path 00:03:00
Fake Login Pages Look Convincing 00:01:44
Who Are You? 00:02:08
Identification Issues 00:00:48
Authentication Mechanisms Characteristics 00:00:44
Strong Authentication 00:02:01
Fraud Controls 00:02:40
Internal Control Tool: Separation of Duties 00:01:38
Biometrics Technology 00:01:32
Example (1) 00:01:12
Verification Steps 00:01:12
What a Person Is 00:01:00
Biometric Type 00:00:23
Identification or Authentication? 00:01:21
Iris Sampling 00:00:40
Finger Scan 00:00:58
Hand Geometry 00:00:39
Facial Recognition 00:01:44
Comparison 00:00:52
Biometrics Verification 00:01:42
Biometrics Error Types 00:01:59
Crossover Error Rate 00:01:45
Biometric System Types 00:02:52
Passwords 00:00:40
Password Generators 00:00:55
Password “Shoulds†00:03:02
Support Issues 00:00:29
Password Attacks 00:01:05
Attack Steps 00:02:50
Many Tools to Break Your Password 00:00:53
Rainbow Table 00:01:27
Passwords Should NOT Contain… 00:01:26
Countermeasures for Password Cracking 00:01:06
Cognitive Passwords 00:00:47
One-Time Password Authentication 00:01:36
Synchronous Token 00:01:02
One Type of Solution 00:02:34
Synchronous Steps 00:00:35
Administrator Configures 00:04:30
Asynchronous Token Device 00:00:35
Asynchronous Steps 00:02:52
Challenge Response Authentication (2) 00:01:05
Passphrase Authentication 00:01:30
Key Protection 00:02:15
Smart Card 00:00:56
Characteristics 00:01:09
Card Types 00:00:50
Smart Card Attacks 00:01:34
Software Attack 00:03:11
Microprobing 00:00:53
Identity Management 00:02:19
How Are These Entities Controlled? 00:00:55
Some Current Issues 00:01:22
Management 00:03:01
Typical Chaos 00:00:49
Different Identities 00:01:45
Identity Management Technologies 00:00:48
Directory Component 00:02:05
Directory Responsibilities 00:01:03
Authoritative Sources 00:01:47
Meta Directory 00:02:26
Directory Interactions 00:01:46
Web Access Management 00:01:27
Web Access 00:05:09
Password Management 00:02:21
Legacy Single Sign-On 00:02:47
Account Management Systems 00:02:23
Provisioning Component 00:01:56
Provisioning 00:01:59
Not Just Computers 00:00:46
Profile Update 00:01:29
Working Together 00:03:28
Enterprise Directory (2) 00:01:00
Identity Management Solution Components 00:00:36
Right for Your Company 00:02:17
Federated Identity 00:02:59
Identity Theft 00:01:19
Fake Login Tools 00:00:42
How Do These Attacks Work? 00:00:33
Attempts to Get Your Credentials 00:01:02
Instructional Emails 00:01:26
Knowing What You Are Disposing of Is Important 00:01:18
Other Examples 00:00:46
Another Danger to Be Aware of… Spyware 00:02:07
Is Someone Watching You? 00:02:11
What Does This Have to Do with My Computer? 00:01:37
New Spyware Is Being Identified Every Week 00:00:41
Spyware Comes in Many Different Forms 00:01:48
Different Technologies 00:00:56
Single Sign-on Technology 00:02:20
Directory Services as a Single Sign-on Technology 00:01:04
Active Directory 00:00:57
Security Domain 00:01:27
Domains of Trust 00:01:03
Thin Clients 00:00:59
Example (2) 00:01:13
Kerberos as a Single Sign-on Technology 00:00:52
Kerberos Components Working Together 00:01:48
Pieces and Parts 00:01:25
Kerberos Steps 00:09:08
Tickets 00:02:00
Steps of Validation 00:01:16
Kerberos Security 00:01:30
Issues Pertaining to Kerberos 00:01:25
Kerberos Issues 00:01:31
SESAME as a Single Sign-on Technology 00:00:38
SESAME Steps for Authentication 00:02:18
Combo 00:01:22
Models for Access 00:00:54
Access Control Models (1) 00:01:00
ACL Access 00:03:00
Security Issues 00:01:20
Mandatory Access Control Model 00:01:50
MAC Enforcement Mechanism – Labels 00:02:06
Formal Model 00:00:57
Software and Hardware 00:00:58
Software and Hardware Guards 00:01:09
Where Are They Used? 00:00:44
SELinux 00:00:31
MAC versus DAC 00:01:14
Role-Based Access Control 00:01:14
RBAC Hierarchy 00:01:44
RBAC and SoD 00:00:46
Acquiring Rights and Permissions 00:00:47
Rule-Based Access Control 00:02:30
Access Control Matrix (1) 00:01:37
Capability Tables 00:00:34
Temporal Access Control 00:00:54
Access Control Administration 00:00:43
Access Control Methods 00:00:36
Centralized Approach 00:00:54
Remote Centralized Administration 00:01:35
RADIUS 00:00:39
RADIUS Steps 00:00:55
RADIUS Characteristics 00:01:17
TACACS+ Characteristics 00:01:36
Diameter Characteristics 00:02:27
Diameter Protocol 00:01:01
Mobile IP 00:01:36
Diameter Architecture 00:01:41
Two Pieces 00:01:09
AVP 00:03:46
Decentralized Access Control Administration 00:01:45
Controlling Access to Sensitive Data 00:02:01
Protecting Access to System Logs 00:02:05
Accountability = Auditing Events 00:00:44
Access Control Models (2) 00:00:38
Policy versus Model 00:00:52
State Machine 00:02:17
Information Flow 00:01:38
Information Flow Model 00:00:35
Bell-LaPadula 00:05:28
Tranquility Types 00:00:55
Biba 00:01:39
Definition of Integrity 00:00:42
Biba Access Rules 00:02:01
Clark-Wilson 00:00:57
Goals of Model 00:02:03
Clark Wilson Components 00:02:33
Clark-Wilson (Cont.) 00:00:46
Clark-Wilson Model 00:01:34
Non-Interference Model 00:01:22
Lattice-Based Access Control 00:03:29
Access Control Matrix Model 00:00:52
Access Control Matrix (2) 00:01:08
Brewer and Nash Model – Chinese Wall 00:02:10
Take-Grant Model 00:01:29
Domain 1 Review 00:02:00
Domain 2 – Security Operations and Administration
Security Operations and Administration 00:01:41
Mainframe Days 00:00:50
In the Good Old Days – Who Knew? 00:02:27
Today’s Environment 00:01:36
Security Definitions 00:01:15
Vulnerabilities 00:00:46
Examples of Some Vulnerabilities that Are Not Always Obvious 00:02:10
Risk – What Does It Really Mean? 00:02:10
Relationships 00:02:02
Who Deals with Risk? 00:01:18
Overall Business Risk 00:01:30
Who? 00:00:44
AIC Triad 00:00:48
Availability 00:00:51
Integrity 00:01:06
Confidentiality 00:00:48
Who Is Watching? 00:02:05
Social Engineering 00:04:06
What Security People Are Really Thinking 00:01:14
Security Concepts 00:01:00
Security? 00:04:57
The Bad Guys Are Motivated 00:02:38
Open Standards 00:00:14
Common Open Standards 00:01:42
Without Standards 00:01:04
“Soft†Controls 00:04:42
Holistic Security 00:00:41
Not Always So Easy 00:00:40
What Is First? 00:02:17
Different Types of Law 00:03:22
How Is Liability Determined? 00:01:22
Examples of Due Diligence 00:02:01
Prudent Person Rule 00:02:31
Prudent Person 00:00:19
Components of Security Program 00:00:49
A Layered Approach 00:01:22
In Security, You Never Want Any Surprises 00:00:52
Building Foundation (1) 00:00:46
Security Roadmap 00:03:30
Functional and Assurance Requirements 00:00:56
Building Foundation (2) 00:01:27
Most Organizations 00:02:47
Silo Security Structure 00:01:22
Islands of Security Needs and Tools 00:00:33
Get Out of a Silo Approach 00:01:38
Approach to Security Management 00:01:05
Result of Battling Management 00:00:27
Industry Best Practices Standards 00:01:12
ISO/IEC 17799 00:01:12
Numbering 00:01:11
New ISO Standards 00:01:27
COBIT 00:01:14
COBIT – Control Objectives 00:01:38
Information Technology Infrastructure Library 00:01:54
Security Governance 00:05:00
Security Program Components 00:00:28
Policy Framework 00:01:04
Organizational Policy 00:00:54
Policy Approved – Now What? 00:00:52
Issue-Specific Policies 00:00:45
System-Specific Policies 00:01:38
Standards 00:02:14
Baseline (1) 00:01:18
Data Collection for Metrics (1) 00:01:16
Guidelines 00:00:34
Procedures 00:00:36
Tying Them Together 00:01:17
Program Support 00:00:42
Senior Management’s Role 00:01:05
Security Roles 00:04:07
Information Classification 00:00:55
Data Leakage 00:00:45
Do You Want to End Up in the News? 00:00:53
Types of Classification Levels 00:00:47
Data Protection Levels 00:00:53
Classification Program Steps 00:02:02
Information Classification Components 00:01:03
Classification Levels 00:00:40
Information Classification Criteria 00:01:14
Criteria Example 00:00:34
Or Not 00:00:45
Information Owner Requirements 00:00:50
Clearly Labeled 00:01:01
Testing Classification Program 00:00:59
Employee Management 00:01:13
Employee Position and Management 00:00:47
Hiring and Firing Issues 00:04:49
Security Awareness and Training 00:01:52
Training Characteristics 00:00:34
Awareness 00:00:39
Security Enforcement Issues 00:00:53
Computer Operations 00:00:57
What Do We Have? 00:00:46
Hardware Protection 00:01:01
ITIL – Problem Management 00:01:35
Problem Management Procedures for Processing Problems 00:01:26
Data Output Controls 00:00:21
Administrative Controls Personnel Controls 00:03:02
Security Operations Personnel 00:01:09
Change Control 00:00:55
Another Example 00:00:45
Agenda 1 00:00:58
Library Maintenance 00:01:06
Media Labels 00:00:30
Media Controls 00:00:50
Software Escrow 00:01:22
Media Reuse 00:02:47
Zeroization 00:02:01
Physical Destruction 00:00:45
Why Not Just Delete the Files? 00:01:46
Mainframes 00:00:59
Agenda 2 00:00:38
HSM 00:01:08
Off-Line 00:00:08
Backup Types 00:01:08
Incremental Backup 00:01:15
Incremental 00:02:35
Differential Backup 00:02:02
Backup Protection 00:01:16
Agenda 3 00:01:17
Mean Time Between Failure 00:00:59
Single Point of Failure 00:03:22
Mirroring Data 00:00:43
Disk Duplexing 00:00:43
Redundant Array of Independent Disks 00:05:37
Massive Array of Inactive Disks (MAID) 00:00:50
Redundant Array of Independent Tapes (RAIT) 00:00:34
Serial Advanced Technology Architecture 00:00:50
SAN 00:01:13
Fault Tolerance 00:02:05
Redundancy Mechanism 00:01:13
Backup Configuration Files 00:01:18
Trusted Recovery of Software 00:01:10
After System Crash 00:00:51
Security Concerns 00:01:32
Agenda 4 00:00:04
Contingency Planning 00:01:19
Agenda 5 00:03:20
Remote Access 00:01:31
Administering Systems Remotely 00:01:36
Facsimile Security 00:01:32
Support Systems 00:01:24
Configuration Management (2) 00:02:24
Change Control Roles in CM 00:03:02
Configuration Management Plan 00:01:19
Change Control-Security Environment 00:01:21
Process of Change Management 00:01:34
Baseline (2) 00:01:25
Risk-based Cost Effective Controls 00:02:44
Software Programming 00:00:31
Security Considered at Each Phase 00:04:24
Waterfall Model 00:01:41
WaterFall Stages 00:01:20
Requirement Analysis 00:01:16
Design 00:01:02
Development 00:02:07
Verification 00:01:45
Operation and Maintenance 00:02:28
Iterative Development Model 00:02:33
Exploratory Model 00:02:29
Rapid Application Development (RAD) Model 00:01:39
Spiral Model 00:04:33
Reuse Model 00:01:35
Computer Aided Software Engineering Model (CASE) 00:05:08
Extreme Programming 00:01:54
Trusted Computer System Evaluation Criteria (TCSEC) 00:01:10
TCSEC 00:00:40
TCSEC Rating Breakdown 00:01:58
Evaluation Criteria – ITSEC 00:01:21
ITSEC Ratings 00:01:12
Common Criteria 00:00:27
Security Functional Requirements 00:00:46
Common Criteria Components 00:02:03
Common Criteria Requirements 00:00:40
Common Criteria Outline 00:01:09
Certification versus Accreditation 00:00:38
Security Levels 00:01:01
Modes of Operation 00:03:13
MAC Modes (Cont.) 00:00:40
Sets of Ethics 00:03:26
Computer Ethics Institute 00:00:36
Internet Architecture Board 00:02:04
Domain 2 Review 00:01:43
Domain 3 – Risk, Response and Recovery
Risk, Response and Recovery 00:01:00
Risk Management 00:00:56
Why Is Risk Management Difficult? 00:01:24
Necessary Level of Protection Is Different for Each Organization 00:00:56
Security Team/Committee 00:01:42
Risk Management Process 00:00:44
Analysis Paralysis 00:00:51
Planning Stage – Scope 00:02:04
Planning Stage – Analysis Method 00:01:01
Risk Management Tools 00:01:50
Defining Acceptable Levels 00:02:24
Acceptable Risk Level 00:00:52
Collecting and Analyzing Data Methods 00:01:04
What Is a Company Asset? 00:00:48
Data Collection – Identify Assets 00:01:01
Data Collection – Assigning Values 00:01:34
Asset Value 00:01:03
Data Collection – Identify Threats 00:01:20
Data Collection – Calculate Risks 00:01:38
Scenario Based – Qualitative 00:00:43
Risk Approach (1) 00:00:40
Qualitative Analysis Steps 00:00:56
Want Real Answers? 00:00:53
Qualitative Risk Analysis Ratings 00:01:21
Quantitative Analysis (1) 00:01:19
How Often Will This Happen? 00:00:37
ARO Values and Their Meaning 00:06:51
ALE Calculation 00:00:56
Can a Purely Quantitative Analysis Be Accomplished? 00:01:25
Risk Types 00:00:39
Examples of Types of Losses 00:00:35
Delayed Loss 00:00:50
Cost/Benefit Analysis 00:00:58
Cost of a Countermeasure 00:01:21
Cost/Benefit Analysis Countermeasure Criteria 00:02:55
Calculating Cost/Benefit 00:01:01
Controls 00:00:30
Control Selection Requirements 00:01:31
Quantitative Analysis (2) 00:01:39
Qualitative Analysis Approach 00:00:30
Qualitative Analysis Disadvantages 00:00:49
Can You Get Rid of All Risk? 00:00:21
Calculating Residual Risk 00:02:13
Uncertainty Analysis 00:01:11
Dealing with Risk 00:01:20
Management’s Response to Identified Risks 00:01:51
Risk Acceptance 00:01:42
Risk Analysis Process Summary 00:01:08
Needs for BCP 00:00:38
Is Your Organization Prepared? 00:02:33
Is Your Company Prepared? 00:00:38
9/11 Changed Mentalities About BCP 00:00:55
Disaster Affected Many 00:00:42
America Is Rebuilding 00:00:36
Partial FEMA Disaster List for 2005 00:00:53
Do We Have a Plan? 00:02:15
What Is the Purpose of a BCP? 00:02:26
More Reasons to Have Plans in Place 00:02:02
Framework 00:00:39
BCP Is a Core Component of Every Security Program 00:01:01
Steps of BCP Process 00:01:56
Different BCP Model 00:01:15
Documentation 00:01:08
BCP Policy Outlines 00:01:43
Who Is In Charge and Who Can We Blame? 00:01:52
What’s Needed In a Team? 00:00:51
BCP Development Team 00:01:31
Project Sizing 00:01:44
Properly Determining Scope Is Important 00:00:50
BCP Risk Analysis Steps 00:02:11
BIA Steps 00:01:28
Information from Different Sources 00:01:18
Analysis 00:01:09
Critical Functions 00:03:08
Interdependencies 00:00:45
Well, Of Course an Organization Knows How It Works! 00:00:54
Business Silos 00:02:16
BIA Steps (Cont.) 00:02:26
Who Connects to Who? 00:00:38
BIA Steps (Cont.) 00:02:00
MTD 00:00:31
Example 00:01:52
MTD Definitions 00:01:15
BIA Steps (Cont.) 00:02:54
Thinking Outside of the Box What If… 00:00:55
Biological Threats 00:00:46
BIA Steps (Cont.) 00:00:56
Potential Disasters 00:02:26
Risk Approach (2) 00:00:42
Ranking by Risk Level 00:01:02
Potential Losses 00:01:14
Include All RISK Components 00:03:00
BIA Steps (Cont.) 00:01:27
Alternate Business Process Procedures 00:02:36
Business Process Reconstruction 00:02:03
Facility Recovery 00:00:38
Facility Backups – Hot Site 00:00:52
Facility Backups – Warm Site 00:00:58
Facility Backups – Cold Site 00:00:43
Compatibility Issues with Offsite Facility 00:02:04
Tertiary Sites 00:00:56
Subscription Costs 00:02:17
Multiple Processing Centers 00:00:51
Location, Location, Location 00:01:08
Other Offsite Approaches 00:01:51
Security Does Not Stop 00:01:12
More Options 00:02:01
Rolling Hot Site 00:00:58
Recovery Strategies (Cont.) 00:00:41
Supply and Technology Recovery 00:01:44
VoIP 00:01:07
Equipment Replacement 00:03:23
What Items Need to Be Considered? 00:01:31
Priorities 00:00:09
Anything Else? 00:00:42
Replacements 00:01:43
Recovery Strategies (Cont.) 00:03:14
Co-Location 00:00:51
Data Recovery 00:01:52
Backup Redundancy 00:01:52
Recovering Data 00:00:41
Automated Backup Technologies 00:02:04
Tape Vaulting 00:01:59
Data Recovery (Cont.) 00:00:41
Clustering for Fault Tolerance 00:01:30
Disk or Database Shadowing 00:01:27
Which Option to Use 00:00:31
Cost Effective Measures 00:01:14
Resources, Time, Solutions 00:00:46
Determining Recovery Solutions 00:01:31
Cost and Recovery Times 00:00:54
Proactive 00:01:10
Recovery Solutions 00:00:48
Preventative Measures 00:01:18
Reviewing Insurance 00:00:50
Results from the BIA 00:01:12
Now Ready to Develop the Plan 00:01:50
Products That Can Help 00:01:05
Plan Components 00:01:39
External Groups 00:01:25
Policy Components 00:00:43
Damage Assessment 00:01:39
Notifying Personnel 00:01:16
Plan Activation 00:00:42
Emergency Response 00:00:47
Policy Components (Cont.) 00:00:35
Recovery Procedures 00:00:45
Documentation of Recovery Steps 00:01:12
Policy Components (Cont.) 00:02:41
Returning to Original Facility 00:01:09
Disaster Hit – Now What? 00:01:05
Termination of BCP 00:01:05
Life Cycle 00:00:48
Who Has the Plan? 00:00:51
Results 00:00:32
Types of Tests to Choose From 00:03:49
Test Objectives 00:01:02
Training Requirements 00:01:22
Lessons Learned 00:00:36
What Is Success? 00:00:51
Out of Date? 00:01:01
Keeping It Current 00:00:52
Change Control 00:00:58
Resulting Plan Should Contain… 00:01:24
Phases of the BCP 00:00:54
Agenda 2 00:02:43
Countries Working Together 00:01:00
Security Principles for International Use 00:00:39
Determine If a Crime Has Indeed Been Committed 00:00:49
Bringing In Law Enforcement 00:01:41
Citizen versus Law Enforcement Investigation 00:01:50
Role of Evidence In a Trial 00:00:34
Evidence Requirements 00:00:37
Chain of Custody (1) 00:00:59
How Is Evidence Processed? 00:01:19
Hearsay Evidence 00:01:07
Agenda 3 00:02:17
Evidence Collection Topics 00:01:57
Computer Forensics 00:02:08
Hidden Secrets 00:05:26
Trying to Trap the Bad Guy 00:04:09
Companies Can Be Found Liable 00:03:06
Why Incident Response? 00:02:41
Incident Response Alarms 00:01:37
Threats 00:00:45
Incident Response Framework 00:05:04
Preparation and Planning 00:02:29
IRT – Incident Response Team 00:03:55
Incident Response Team – Mission 00:02:03
Incident Response Team – Objectives 00:04:49
Incident Response Team – Priorities 00:02:14
Incident Response Team – Liaisons 00:05:28
Detection 00:01:29
Chain of Custody (2) 00:01:34
Poking into Network Traffic 00:01:01
Snort 00:02:13
Containment 00:01:00
Containment – Some Considerations 00:02:45
Notification 00:02:18
Investigation 00:01:42
Rules of Evidence 00:02:08
Acceptable Evidence 00:02:18
Exclusionary Rules 00:00:55
Evidence Recognition 00:00:53
Evidence Discovery 00:01:46
Search and Seizure 00:02:01
Network Monitoring 00:04:48
Reviewing System Logs 00:01:52
Interviewing 00:01:16
Terminating the Investigation 00:01:21
Recovery 00:00:56
Response 00:01:18
Follow-Up 00:03:33
Electronic Forensic 00:01:57
Media Analysis Procedures 00:00:44
Media Analysis – IACIS Framework 00:02:53
Step 1 – Sterile Media 00:00:57
Step 2 – Legal Software 00:01:00
Step 3 – Physical Examination of the Evidence 00:01:51
Step 4 – Avoid Altering the Evidence 00:02:29
Step 5 – Capture Date/Time and CMOS (RTC/NVRAM) Information 00:01:56
Step 6 – Create an Exact Image 00:00:56
Step 7 – Logically Examine the Image 00:01:54
Step 8 – Examine the Boot Record Data and User-Defined Files 00:01:05
Step 9 – Recover and Examine All Deleted Files 00:01:36
Step 10 – Create a Listing of All Files 00:01:05
Step 11 – Examine Unallocated Space for Lost or Hidden Data 00:00:56
Step 12 – Examine File Slack 00:02:51
Step 13 – Examine All User Created Files 00:02:20
Step 14 – Unlock and Examine Password-Protected Files 00:01:14
Step 15 – Create Printouts of All of the Apparent Evidence 00:01:41
Step 16 – Examine Executable Files and Run Applications 00:01:32
Step 17 – Write the Forensic Analysis Report 00:01:30
Domain 3 Review 00:02:28
Domain 4 – Analysis and Monitoring
Analysis and Monitoring 00:00:47
Security Auditing 00:00:34
What Are Security Audits? 00:00:53
Why Are Security Audits Performed? 00:03:07
Audit Participant’s Role 00:01:53
Defining the Audit Scope 00:02:20
Defining the Audit Plan 00:00:47
Audit Data Collection Methods 00:03:24
Post Audit Activities 00:02:17
Controls 00:01:53
Control Checks 00:01:48
Control Checks – User Access Control 00:00:39
Control Checks – Network Access 00:02:53
Network Configurations 00:00:42
DMZ Configurations 00:03:24
Firewall Comparisons 00:04:48
Network Devices – Firewalls 00:01:52
Host Isolation – Audit Questions 00:02:22
Firewalls – Audit Questions 00:01:25
Intrusion Detection System 00:01:55
IDS – Audit Questions 00:02:11
Network Monitoring 00:01:13
Control Checks – Monitoring 00:02:02
Monitoring – Audit Questions 00:01:40
Control Checks – System Hardening 00:03:15
Patching – Audit Questions 00:01:07
Control Checks – Anti-Virus 00:01:06
Control Checks – Encryption 00:01:52
Control Checks – Logging 00:01:14
Protecting Access to System Logs 00:01:07
Audit Process 00:03:24
Security Testing 00:00:48
Overview 00:01:18
Why? 00:00:58
When? 00:01:12
Who? 00:02:30
Security Testing Goals 00:01:49
Security Testing – Tools 00:01:25
Before Carrying Out Vulnerability Testing 00:01:43
Testing for Vulnerabilities 00:01:06
Vulnerability Assessments 00:02:23
Security Testing Issues 00:05:32
Vulnerability Scanning 00:00:52
Vulnerability Scans 00:01:05
Penetration Testing (1) 00:02:28
Penetration Testing Variations 00:01:40
Types of Testing 00:03:11
Step In Attack Chart 00:04:53
Testing Steps 00:02:15
Automated Pen Testing Tools Canvasâ„¢ Operation 00:01:43
Penetration Testing (2) 00:03:15
Automated Pen Testing Tools Core Impactâ„¢ Operation 00:01:07
Test Type Chart 00:03:35
Reconnaissance 00:00:53
Reconnaissance – Social Engineering 00:00:47
Reconnaissance – WHOIS Information 00:00:42
Reconnaissance – DNS Zone Transfer 00:03:11
Network Mapping 00:01:51
Network Mapping – Host/Port Mapping 00:00:55
Vulnerability Assessment 00:01:05
Security Gateway Testing 00:00:39
Security Monitoring Testing 00:02:11
Weeding Out False Positives 00:01:18
Security Monitoring 00:00:51
Post-Testing and Assessment Steps 00:01:01
Motivation Behind Attacks 00:00:50
Intrusions 00:01:19
What Is Acceptable? 00:01:07
Security Monitoring for Everyday Life 00:00:48
Security Monitoring for Computing Systems 00:01:46
Security Monitoring Issues 00:02:47
Monitoring Terminologies 00:04:35
Intrusion Detection Systems 00:01:13
IDS Categories 00:00:56
Network-based IDS 00:01:21
Host-based IDS 00:02:33
Anomaly Detection 00:01:22
Signature-based IDS 00:01:43
IDS as a Patch for Firewall 00:01:23
Event Logging 00:01:45
Event Logging – Usefulness 00:00:54
Log Sources 00:01:24
Centralized Logging infrastructure 00:01:19
Log Reviews 00:00:47
Logging Priority 00:01:09
Secure Logging 00:01:40
Event Alerting and Interpretation 00:01:32
Accountability = Auditing Events 00:01:43
Security Monitoring Evasion 00:03:12
Obfuscation 00:01:04
Fragmentation 00:00:35
Encryption 00:02:09
Overloading 00:00:44
Slow Scans 00:00:47
Log Alteration 00:01:25
Security Monitoring Implementation Issues 00:00:47
Criticality Based Deployment 00:02:07
Maintenance and Tuning 00:00:50
Data Collection for Incident Response 00:01:00
Monitoring Response Techniques 00:01:33
Active Response Pitfalls 00:01:14
IDS 00:02:12
IDS Steps 00:01:26
Network IDS Sensors 00:02:00
Host IDS 00:01:31
Combination 00:01:38
Types of IDSs 00:02:32
Signature-Based Example 00:02:29
Behavior-Based IDS 00:03:32
Statistical Anomaly 00:01:05
Statistical IDS 00:00:45
Protocol Anomaly 00:01:45
What Is a Protocol Anomaly? 00:01:30
Protocol Anomaly Issues 00:00:48
Traffic Anomaly 00:03:47
IDS Response Mechanisms 00:01:10
Responses to Attacks 00:01:37
IDS Issues 00:01:55
Intrusion Prevention System 00:02:43
Vulnerable IDS 00:00:47
Trapping an Intruder 00:01:43
Domain 4 Review 00:01:31
Domain 5 – Cryptography
Cryptography 00:01:17
Services Provided by Cryptography 00:01:13
Cryptographic Definitions 00:01:15
Cipher 00:01:36
A Few More Definitions 00:01:09
Need Some More Definitions? 00:01:13
Symmetric Cryptography – Use of Secret Keys 00:00:46
Historical Uses of Symmetric Cryptography – Hieroglyphics 00:00:48
Scytale Cipher 00:01:03
Substitution Ciphers 00:01:55
Simple Substitution Cipher Atbash 00:01:19
Simple Substitution Cipher Caesar Cipher 00:01:59
Simple Substitution Cipher ROT13 00:01:33
Historical Uses 00:01:14
Polyalphabetic Cipher – Vigenere Cipher 00:00:38
Polyalphabetic Substitution 00:00:18
Vigenere Algorithm 00:01:54
Enigma Machine 00:02:33
U-Boats Had Enigma Machines 00:02:40
Code Book 00:03:32
Agenda 1 00:01:30
Key and Algorithm Relationship 00:02:27
Does Size Really Matter? 00:00:35
Key Space 00:01:20
Ways of Breaking Cryptosystems – Brute Force 00:01:53
Brute Force Components 00:00:44
Ways of Breaking Cryptosystems – Frequency Analysis 00:01:40
Strength of a Cryptosystem 00:01:40
Do You Know What You Are Doing? 00:00:37
Developing Cryptographic Solutions In-House 00:01:15
Characteristics of Strong Algorithms 00:02:48
Open or Closed More Secure? 00:01:23
Agenda 2 00:00:39
Type of Symmetric Cipher – Block Cipher 00:01:09
S-Boxes Used In Block Ciphers 00:01:33
Binary Mathematical Function 1 00:01:25
Type of Symmetric Cipher – Stream Cipher 00:01:43
Symmetric Characteristics 00:00:46
Initialization Vectors 00:01:42
Security Holes 00:05:07
Strength of a Stream Cipher 00:01:02
Symmetric Key Cryptography 00:01:30
Out-of-Band Transmission 00:01:57
Symmetric Key Management Issue 00:02:05
Symmetric Downfalls 00:00:46
Why? 00:00:35
Asymmetric Cryptography 00:00:57
Key Functions 00:00:55
Public Key Cryptography Advantages 00:02:53
Asymmetric Algorithm Disadvantages 00:01:14
Confusing Names 00:01:39
Symmetric versus Asymmetric 00:00:59
Questions 1 00:04:29
When to Use Which Key 00:01:44
Using the Algorithm Types Together 00:00:39
Encryption Steps 00:02:28
Receiver’s Public Key Is Used to Encrypt the Symmetric Key 00:00:42
Receiver’s Private Key Is Used to Decrypt the Symmetric Key 00:01:16
Digital Envelope 00:01:07
Secret versus Session Keys 00:01:01
Asymmetric Algorithms We Will Dive Into 00:00:07
Asymmetric Algorithm – Diffie-Hellman 00:01:22
Diffie-Hellman 00:05:06
Key Agreement Schemes 00:00:49
Asymmetric Algorithm – RSA 00:01:35
Factoring Large Numbers 00:01:57
RSA Operations 00:01:08
RSA Key Size 00:01:00
El Gamal 00:00:41
ECC 00:01:11
ECC Benefits 00:00:50
Asymmetric Mathematics 00:03:34
Asymmetric Security 00:00:46
Mathematics 00:00:43
Symmetric Ciphers We Will Dive Into 00:06:12
Block Cipher 00:01:07
Double DES 00:01:36
Evolution of DES 00:00:59
Modes of 3DES 00:01:14
Encryption Modes 00:01:42
Block Cipher Modes – CBC 00:01:42
IV and CBC 00:00:47
Different Modes of Block Ciphers – ECB 00:01:29
ECB versus CBC 00:00:31
Block Cipher Modes – CFB and OFB 00:04:06
CFB and OFB Modes 00:01:42
Counter Mode 00:02:47
Modes Summary 00:01:46
Symmetric Cipher – AES 00:01:53
IDEA 00:00:41
RC4 and RC5 00:01:10
Agenda 3 00:00:37
Data Integrity 00:00:15
Hashing Steps 00:01:06
Protecting the Integrity of Data 00:01:01
Hashing Algorithms 00:02:22
Data Integrity Mechanisms 00:01:23
Hashing Strength 00:00:35
Question 1 00:01:06
More Protection in Data Integrity 00:00:40
MAC 00:01:12
HMAC – Sender 00:00:34
HMAC – Receiver 00:01:16
Another Look 00:01:03
What Services 00:00:38
Authentication Types 00:03:06
Integrity? 00:01:00
What Services? 00:01:30
Question 2 00:01:26
Digital Signatures 00:02:07
One More Look 1 00:00:36
U.S. Government Standard 00:01:04
What Is… 00:01:12
Zero Knowledge Proof 00:01:07
Message Integrity Controls 00:01:01
Security Issues In Hashing 00:01:22
Example of a Birthday Attack 00:03:00
Birthday Attack Issues 00:00:52
Key Management 00:01:42
Key Backup 00:00:31
Key Management (Cont.) 00:00:38
Key Usage 00:01:34
Cryptoperiod 00:00:39
M-of-N 00:01:47
Key Types 00:01:22
Agenda 4 00:01:36
Components of PKI 00:00:37
PKI 00:00:47
PKI Steps 00:01:07
RA Roles 00:02:29
CA 00:00:34
Let’s Walk Through an Example 00:01:36
Digital Certificates 00:02:25
Certificate 00:00:45
Signing the Certificate 00:00:52
Verifying the Certificate 00:03:34
Trusted CA’s 00:01:30
Non-Trusted CA 00:02:49
One More Look 2 00:00:40
What Do You Do with a Certificate? 00:05:01
Components of PKI, Repository, and CRLs 00:02:21
Revoked? 00:01:50
CRL Process 00:02:45
Different Uses for Certificates 00:02:12
Cross Certification 00:02:58
PKI and Trust 00:01:41
Agenda 5 00:00:38
Historical Uses of Symmetric Cryptography – Vernam Cipher 00:00:54
Binary Mathematical Function 2 00:02:19
One-Time Pad In Action 00:00:45
One-Time Pad Characteristics 00:03:32
Steganography 00:01:57
Digital Watermarking 00:01:11
Link versus End-to-End Encryption 00:03:02
End-to-End Encryption 00:01:28
Encryption Location 00:01:14
Email Standards 00:02:16
You Decide 00:02:40
Non-Hierarchical 00:01:48
Secure Protocols 00:02:18
SSL Connection Setup 00:04:13
Example – SSL 00:01:09
Validating Certificate 00:00:58
Secure Protocols (Cont.) 00:02:16
SSL and the OSI Model 00:01:57
E-Commerce 00:04:15
How Are You Doing? 00:00:46
Hard the First Times Through 00:00:42
Secure Email Standard 00:02:05
Agenda 6 00:02:58
IPSec Key Management 00:01:48
IPSec Handshaking Process 00:01:00
VPN Establishment 00:01:54
SAs in Use 00:03:04
Key Issues Within IPSec 00:01:52
Configuration of SA Parameters 00:00:32
IPSec Configuration Options 00:00:44
IPSec Is a Suite of Protocols 00:03:17
AH and ESP Modes 00:02:13
IPSec Modes of Operation 00:01:14
VPN Establishment (Cont.) 00:02:04
Review 00:02:08
Questions 2 00:02:20
Attack Types 00:00:43
Attacks on Cryptosystems 00:01:23
Known-Plaintext Attack 00:01:53
Chosen-Plaintext Attack 00:01:11
Chosen-Ciphertext Attack 00:02:01
Adaptive Attacks 00:01:00
Side Channel Attacks 00:01:17
Domain 5 Review 00:01:30
Domain 6 – Networking and Telecom
Networking and Telecom 00:00:38
Agenda 1 00:00:31
OSI Model 00:01:39
OSI Layers 00:00:59
Networking Communications 00:00:40
An Older Model 00:01:40
Data Encapsulation 00:02:02
Application Layer 00:02:33
Presentation Layer 00:01:21
OSI – Presentation Layer 00:01:16
OSI – Session Layer 00:01:00
Client/Server Model 00:00:56
Client/Server Session Layer 00:01:15
Transport Layer 00:03:00
OSI – Network Layer 00:00:56
Here to There 00:01:06
Network Layer 00:00:44
OSI – Data Link 00:01:49
Data Link 00:02:05
Sublayers 00:01:58
OSI – Physical Layer 00:00:20
Physical Layer 00:01:13
Layers Working Together 00:00:29
Protocols at Each Layer 00:05:53
Devices Work at Different Layers 00:02:17
Types of Networks 00:01:27
Network Topologies – Physical Layer 00:00:37
Topology Type – Bus 00:00:52
Topology Type – Ring 00:01:46
Topology Type – Star 00:00:55
Network Topologies – Mesh 00:01:49
Summary of Topologies 00:01:11
Agenda 2 00:01:10
Media Access 00:00:53
One Goal of Media Access Technologies 00:00:42
Collision Domain 00:00:58
Back Off, Buddy 00:01:30
Carrier Sense Multiple Access 00:01:11
CSMA/Collision Avoidance (CSMA/CA) 00:01:24
Media Access Technologies – Ethernet 00:02:09
Media Access Technologies – Token Passing 00:02:55
Token’s Role 00:00:46
Other Technologies 00:01:07
Media Access Technologies – Polling 00:01:02
Agenda 3 00:01:39
Cabling Types – Twisted Pair 00:01:29
Cable Types 00:00:56
Multimode versus Single Mode 00:01:12
Signal and Cable Issues 00:00:52
Signaling Issues 00:01:04
Transmission Types – Analog and Digital 00:01:53
Transmission Types – Synchronous 00:00:57
Asynchronous 00:00:42
Transmission Types 00:02:08
Cabling Issues – Plenum-Rated 00:01:57
Transmission Types – Number of Receivers 00:02:30
Internet Group Management Protocol 00:00:54
Multicasting 00:00:52
Network Technologies 00:01:14
Extranet 00:00:42
Network Technologies (Cont.) 00:01:14
EDI Evolution 00:00:38
Networking Devices 00:04:04
Forwarding Table Example 00:01:21
Network Devices – Switch 00:00:55
Virtual LAN 00:01:24
VLAN 00:00:53
Interfaces and VLANs 00:02:14
Sniffers 00:03:13
Networking Devices – Router 00:02:14
Hops 00:00:56
Routers 00:00:49
Bridges Compared to Routers 00:01:29
Network Devices – Gateway 00:00:54
Agenda 4 00:02:09
Client Ports 00:01:34
Conceptual Use of Ports 00:00:47
TCP/IP Suite 00:01:09
UDP versus TCP 00:02:29
TCP Segment 00:00:50
SYN Flood 00:03:29
Teardrop Attack 00:02:05
Source Routing 00:01:03
Source Routing Types 00:00:52
IP Address Ranges 00:02:56
IPv6 00:02:35
Protocols – ARP 00:01:09
IP to MAC Mapping 00:00:50
How ARP Works 00:01:27
ARP Poisoning 00:01:13
ICMP Packets 00:01:22
A Way Hackers Use ICMP 00:01:19
Ping Steps 00:01:30
Protocols – SNMP 00:00:49
SNMP in Action 00:03:20
SNMP 00:01:48
SNMP Output 00:00:58
POP3 and SMTP 00:00:47
Protocols – SMTP 00:02:33
Protocols – FTP, TFTP, Telnet 00:02:36
Protocols – RARP and BootP 00:01:18
DHCP – Dynamic Host Configuration Protocol 00:01:04
Agenda 5 00:01:49
Network Configurations 00:01:07
DMZ Configurations 00:01:05
Firewall Comparisons 00:00:44
Network Devices – Firewalls 00:02:25
Packet Filtering Firewall 00:01:56
Packet Filtering Firewall Weaknesses 00:00:57
Packet Filtering 00:00:35
Rule Set Example 00:01:22
Firewall Types 00:07:37
Application-Layer Proxy Advantages 00:00:44
Application-Layer Proxy Disadvantages 00:01:01
Dedicated Proxy Servers 00:00:57
Firewall Types – Stateful 00:04:42
State Table 00:03:58
Firewall Types – Kernel Proxies 00:01:31
Firewall Based VPN Devices 00:00:51
Best Practices 00:02:58
Firewall Placement 00:01:18
Packet Filtering (Cont.) 00:00:36
Screened Host 00:01:14
Firewall Architecture Types – Multi- or Dual-Homed 00:01:24
Screened Subnet 00:02:25
Agenda 6 00:00:47
Dial-Up Protocol – SLIP 00:00:46
Dial-Up Protocol – PPP 00:01:01
PPP 00:00:51
PPP versus SLIP 00:01:31
Authentication Protocols – PAP 00:00:45
Authentication Protocols – CHAP 00:02:15
Authentication Protocol – EAP 00:01:24
Data Inspection 00:03:44
Virtual Private Network Technologies 00:01:18
Analogy 00:01:01
Tunneling Protocols – Examples 00:00:58
Tunneling Protocols – PPTP 00:01:08
Tunneling Protocols – L2TP 00:02:35
L2TP Encapsulation 00:00:30
Tunneling Protocols – IPSec 00:00:48
IPSec Basic Features 00:03:55
IPSec Modes 00:00:35
Security Associations (SAs) 00:04:01
Combining Sas 00:02:14
Iterated Tunnelling 00:00:28
Agenda 7 00:01:20
Layer 3 at Layer 2 00:00:59
MPLS 00:01:09
Multiprotocol Label Switching 00:01:13
Quality of Service (QoS) 00:01:48
QoS Services 00:00:49
Autonomous Systems 00:02:04
Routing Protocols 00:02:16
Routing 00:01:51
Routing Protocols (Cont.) 00:02:04
OSPF 00:01:22
IGRP 00:00:40
BGP 00:02:39
Routing Protocol Attacks 00:00:54
MAN Technologies 00:04:03
Connecting Networks 00:01:30
Network Services 00:02:47
Name Resolving Steps 00:03:32
Split DNS 00:01:02
Host Name Resolution Attacks 00:03:37
Network Service – NAT 00:04:26
NIS 00:00:43
Storing Data 00:00:45
NIS+ Authentication 00:00:38
Agenda 8 00:01:10
PSTN 00:00:58
Circuit Switching 00:00:41
Steps of Connections 00:00:45
Multiplexing 00:01:40
Types of Multiplexing 00:00:53
TDM Process 00:01:44
FDM 00:01:25
Packet Switching 00:02:28
Circuit versus Packet Switching 00:01:24
WAN Technologies – Packet Switched 00:00:17
WAN Technologies – X.25 00:00:54
X.25 00:01:09
WAN Technologies – Frame Relay 00:01:47
WAN Example 00:00:44
Frame Relay 00:05:34
WAN Technologies – ISDN 00:02:10
WAN Technologies – DSL 00:02:38
WAN Technologies – Cable Modem 00:01:37
Cable Modems 00:00:54
Cable Network 00:00:32
Satellites 00:00:39
Hybrid Connection 00:00:52
Satellite Coverage 00:00:40
Network Perimeter Security 00:01:03
Complexity Only Increases 00:01:04
A Layered Approach 00:00:37
Agenda 9 00:00:44
PSTN (Cont.) 00:01:54
Private Branch Exchange 00:01:50
PBX Vulnerabilities 00:01:33
PBX Best Practices 00:01:44
Voice Over IP 00:03:36
Media Gateways 00:00:32
PBX and VoIP 00:00:52
Voice over… 00:00:27
IP Telephony Issues 00:01:15
Telephony Protection Mechanisms 00:00:36
Telephony Security 00:02:39
IP Telephony with Wireless 00:00:32
IP Phones Security 00:02:13
Mobile Technology Generations 00:01:55
Mobile Phone Security 00:01:23
Mobile Device Security 00:01:22
Cell Phone 00:02:40
Agenda 10 00:02:18
Wireless Frequencies 00:01:10
Alphabet Soup of Standards 00:06:01
Spread Spectrum 00:05:50
OFDM 00:00:42
Where Does Spread Spectrum Work? 00:02:10
802.11n 00:01:09
Wireless Technologies – Access Point (Cont.) 00:01:01
Architectures 00:00:46
Wireless Technologies – Service Set ID 00:01:46
Authenticating to an AP 00:01:03
802.11 Authentication 00:02:27
Wireless Technologies – WEP 00:01:58
Wireless Technologies – More WEP Woes 00:02:41
Lack of Integrity 00:00:33
WEP Security Issues 00:01:11
Frequency Management 00:01:19
802.11 Security Solutions 00:04:12
802.1x 00:01:20
802.1x Authentication 00:05:08
Types of 802.11 Security 00:01:22
IEEE 802.11i Standard 00:02:07
Wireless EAP 00:05:50
Wireless Technologies – Common Attacks 00:07:29
Wireless Reconnaissance Output 00:00:34
Warchalking 00:01:33
Countermeasures 00:04:56
Wireless Attacks 00:02:10
Wormhole Attack 00:00:48
Wireless Technologies – WAP 00:00:44
Wireless Technologies – WTLS 00:01:31
i-mode 00:00:36
Bluetooth 00:01:01
Instant Messaging 00:03:02
Domain 6 Review 00:01:22
Domain 7 – Malicious Code
Malicious Code 00:01:23
Vulnerabilities at Different Layers 00:00:36
Tiered Network Architectures 00:00:53
Sensitive Data Availability 00:02:00
Cookies 00:02:35
Find Out Where You Have Been 00:00:47
Pulling Data 00:01:03
Web Server Error Pages 00:00:36
Common Web Server Flaws 00:01:53
Improper Data Validation 00:01:22
Directory Traversal 00:02:00
Buffer Overflow 00:01:59
Cross Site Scripting Attack 00:01:31
Common SQL Injection Attack 00:01:38
CGI Information 00:02:38
Logging Activities 00:01:20
Best Practices 00:03:19
Agenda (1) 00:00:36
Are ALL Patches Applied? 00:00:45
Patching Process Chart 00:02:40
Patching Issues 00:01:41
Agenda 2 00:02:11
Boot Sector Invasion 00:00:47
Types of Viruses 00:00:52
More Malware 00:01:47
Blended Malware 00:01:21
Hoaxes 00:01:00
Agenda 3 00:03:51
Attack Characteristics 00:00:57
Disclosing Data in an Unauthorized Manner 00:01:50
Covert Storage Channel 00:01:28
Covert Timing Channel 00:01:35
Circumventing Access Controls 00:01:03
Attacks 00:01:46
Attack Type – Race Condition 00:01:35
Attacking Through Applications 00:02:24
How a Buffer Overflow Works 00:01:00
Watching Network Traffic 00:01:19
Traffic Analysis 00:01:17
Functionally Two Different Types 00:03:20
Double File Extensions 00:01:53
Denial of Service Definition 00:01:37
History of Denial of Service 00:00:49
Denial of Service Attacks 00:01:11
SYN Flood 00:01:21
SYN Attacks 00:01:54
SYN Attacks Defense 00:02:26
DDoS 00:03:31
Distributed DoS 00:00:45
DoS Tools 00:01:43
Other DDoS Variations 00:01:34
DDoS Defenses 00:04:51
DDoS Countermeasures 00:00:56
RPC Null Fragment Attack 00:02:56
Another Danger to Be Aware of…Spyware 00:01:54
New Spyware Is Being Identified Every Week 00:00:55
Passwords 00:05:52
Password Generators 00:01:33
Password Attacks 00:03:09
Rainbow Table 00:02:47
Countermeasures for Password Cracking 00:05:36
Cognitive Passwords 00:01:44
One-Time Password Authentication 00:00:49
Synchronous Token 00:02:13
One Type of Solution 00:01:07
Synchronous Steps 00:01:34
Challenge/Response Authentication 00:03:45
Asynchronous Steps 00:02:14
Cryptographic Keys 00:01:39
Passphrase Authentication 00:01:37
Memory Cards 00:00:49
Smart Card 00:02:06
Characteristics 00:01:39
Card Types 00:01:04
Home Page Hijacking 00:01:53
Webpage Defacement 00:00:45
Precautions 00:00:55
Password Verifier 00:00:36
Online Attack 00:00:52
Offline Attack 00:01:35
Salt 00:02:15
Ping 00:01:35
Ping of Death 00:02:08
Session Hijacking 00:01:06
Attack Steps 00:01:26
Spoofing 00:05:46
Man-in-the-Middle (MiM) Attack 00:05:22
Mobile Code with Active Content 00:02:00
Types of Mobile Code Attacks 00:03:55
Attacks and Exploits 00:02:01
JavaScript and Visual Basic Script 00:01:51
Structure and Focus of Malicious Code Attacks 00:04:20
Phases of an Attack 00:03:28
Reconnaissance 00:02:34
DNS Commands and Tools 00:01:13
Whois Tool Screen Capture 00:01:56
Tools 00:01:01
SNMP Tools 00:01:46
Port Scanning 00:00:55
Security Probes – Nessus 00:01:02
Access and Privilege Escalation 00:02:34
Hackers 00:06:22
Motivations 00:02:33
Internal Risk 00:08:07
Defense In Depth 00:01:26
Application Defenses 00:03:53
Operating System Defenses 00:02:59
Network Defenses 00:02:38
Anti-Virus Software 00:03:32
Patch Management 00:00:50
Issues with Patches 00:01:01
Automatic Patch Management Solutions 00:02:22
Vulnerability Management 00:02:30
Network Monitors and Analyzers 00:00:50
Content/Context Filtering 00:01:32
Honeypot 00:04:35
Honeynet 00:00:58
Attack Prevention Techniques 00:01:03
Safe Recovery Techniques and Practices 00:02:42
File Backup and Restoration Plan 00:01:17
Domain 7 Review 00:01:04
Course Closure 00:19:05