WIXLIB

CompTIA Advanced Security Practitioner (CASP) (Exam CAS-002)Course OutlineCourse IntroductionCourse Introduction4mLesson 01 - The Enterprise Security ArchitectureTopic A: The Basics of Enterprise SecurityThe EnterpriseEnterprise SecurityBusiness Goals and SecurityCommon Enterprise Security PrinciplesEnterprise Threat IntelligenceWhat to Protect?Defense in DepthCommon Components of an Enterprise Security SolutionsPolicies, Standards, and ProceduresEnterprise Policy TypesTopic B: The Enterprise StructureOrganizational StructuresThe Management TeamNetwork AdministratorThe DBAProgrammersStakeholdersFinanceHuman ResourcesPhysical Security and Facilities RolesDiscipline CollaborationTopic C: Enterprise Security RequirementsLegal CompliancePIIPrivacy RequirementsOrganizational Security RequirementsLesson 01 Review1h 29mLesson 02 - The Enterprise Security TechnologyTopic A: Common Network Security Components and TechnologiesCommon Enterprise Security ComponentsVoIP IntegrationIPv6 Migration and IntegrationVLAN IntegrationDNS Security TechniquesSecure Directory ServicesNIDSNIPS2h 45m

The NIPS ProcessESBThe ESB ProcessDAMTopic B: Communications and Collaboration SecurityUC SecurityUC AttacksUC ComponentsTraffic Prioritization (QoS)Security Solutions for Data FlowVoIP SecurityThe VoIP Implementation ProcessVoIP Implementation ConsiderationsRemote Access SecurityVPN SolutionsExternal Communications SecurityCollaboration Platform Security IssuesDemo - Least PrivilegeCommon Mobile DevicesEnterprise Security Methods for Mobile DevicesTopic C: Cryptographic Tools and TechniquesCryptography in the EnterpriseConsiderations for Cryptography in the EnterpriseDemo - File EncryptionCryptographic Methods and DesignBasic Approaches to EncryptionTransport Encryption MethodsSecurity Implications for EncryptionDigital Signature TechniquesAdvanced PKI ComponentsCode SigningAttestationEntropyPRNGPFSConfusion and DiffusionTopic D: Advanced AuthenticationAdvanced Authentication Within the EnterpriseCertificate-Based AuthenticationSAMLSPMLXACMLSOAPWSSLesson 02 ReviewLesson 03 - Enterprise Resource TechnologyTopic A: Enterprise Storage Security IssuesCommon Enterprise Storage TechnologiesNAS Security Implications1h 54m

SAN Security ImplicationsvSAN Security ImplicationsVirtual StorageSecurity Implications of Virtual StorageCloud StorageSecurity Implications of Cloud StotageData WarehousingSecurity Implications of Data WarehousingData ArchivingSecurity Implications of Data ArchivingiSCSI Security ImplicationsiSCSISecurity Implications of iSCSIFCoE Security ImplicationsFCoESecurity Implications of FCoEvSANSecurity Implications of vSANLUNLUN Masking in the Security ArchitectureRedundancyDynamic Disk PoolsLUN Masking and MappingHBA AllocationsMultipathOffsite and Multisite ReplicationAdditional Storage Security ImplicationsSnapshotsDeduplicationGuidelines for Ensuring Secure Storage ManagementTopic B: Distributed, Shared, and Virtualized ComputingWhy Virtualization?Advantages of VirtualizationVLANsVMsVDITerminal ServicesVirtualization VulnerabilitiesVulnerabilities of Hosting VMs for Multiple CompaniesVirtual Environment Security MethodsTopic C: Cloud Computing and SecurityCloud ComputingCloud Computing Service ModelsCloud Storage ConsiderationsSecurity Vulnerabilities of Cloud ComputingSecure Use of Cloud Computing Within the EnterpriseLesson 03 Review

Lesson 04 - Security Design and SolutionsTopic A: Network Security DesignNetwork Design Types and TechniquesNetwork Design ConsiderationsData Network TypesA Data Network TopologyData Network Topology TypesA Network DiagramData Network Media TypesNetwork Transmission MethodologiesPhysical SecurityBuilding LayoutFacilities ManagementUnified Threat ManagementNIDSNIPSInline Network EncryptorSecurity Information and Event ManagementSIEM CapabilitiesNetwork-Attached HSMApplication and Protocol Aware TechnologiesVirtual Networking and Security ComponentsDevice PlacementGuidelines for Analyzing Network Security Components and DevicesGuidelines for Analyzing Network Security Components and Devices (Cont.)Building Automation SystemsHardware AttacksEnvironmental Threats and VulnerabilitiesSensorsPhysical Access Control SystemsScientific and Industrial EquipmentA/V SystemsIP VideoNetwork AttacksSCADASecure Infrastructure DesignStorage Integration ConsiderationsGuidelines for Analyzing Network-Enabled DevicesRemote AccessIPv6 and Associated Transitional TechnologiesNetwork Authentication802.1XSoftware-Defined NetworkingCloud-Managed NetworksGuidelines for Analyzing Advanced Network DesignNetwork BaseliningConfiguration LockdownChange MonitoringAvailability ControlsACLs4h 37m

DMZSeparation of Critical AssetsData Flow EnforcementNetwork Device ConfigurationNetwork Access ControlCritical Infrastructure and Industrial Control SystemsNetwork Management and Monitoring ToolsGuidelines for Configuring Controls for Network SecurityTopic B: Conduct a Security AssessmentMalware SandboxingMemory DumpingRuntime DebuggingVulnerability AssessmentPenetration TestingHacking StepsPenetration Testing TechniquesFingerprintingTypes of Social EngineeringVulnerability ScannersPort ScannersProtocol AnalyzersNetwork EnumeratorsPassword CrackersFuzzersHTTP InterceptorsExploitation Tools and FrameworksPassive Reconaissance and Intelligence Gathering ToolsCode Review MethodsA Social Engineering TestSecurity Assessment ToolsHow to Conduct a Security AssessmentTopic C: Host SecurityHost-Based Security ControlsHost-Based FirewallsFirewall RulesDemo - FirewallsTPMTrusted OSEndpoint SecurityEndpoint Security SoftwareGuidelines for Selecting Host Hardware and SoftwareSecurity and Group Policy ImplementationsStandard Operating EnvironmentCommand Shell RestrictionsPatch ManagementOut-of-Band CommunicationPeripheral RestrictionsCommunications Protocols Used by PeripheralsFull Disk EncryptionTrusted OS (Cont.)

Endpoint Security (Cont.)Anti-Malware SoftwareHost HardeningGuidelines for Hardening HostsOperating System SecurityHost Hardening Action StepsAsset ManagementHIDSHIPSHost MonitoringVirtualization PlatformsHypervisorsContainer-Based VirtualizationVDISecurity Implications of VDITerminal ServicesApplication Delivery ServicesvTPMVM VulnerabilitiesGuidelines for Virtualizing Servers and DesktopsCloud ServicesCloud Security ServicesHash MatchingContent FilteringGuidelines for Implementing Cloud Augmented Security ServicesBIOSUEFISecure BootMeasured LaunchIMALesson 04 ReviewLesson 05 - Managing Risk in ProjectsTopic A: Create a Risk Management PlanRiskRisk ExposureRisk Analysis MethodsRisks Facing an EnterpriseProject BufferClassification of RisksBusiness Risk vs. Insurable RiskRisk ToleranceProbability ScaleImpact ScaleRBSEnterprise Security Architecture FrameworksESA Framework Assessment ProcessNew Products and TechnologiesNew and Changing Business ModelsPartnership Model1h 53m

Outsourcing ModelCloud ModelMergersDemergers and DivestituresIntegration of Diverse IndustriesThird-Party ProvidersInternal and External InfluencesDe-perimeterizationRisk DeterminationsGuidelines for Assessing RiskClasses of InformationClassification of Information Types into CIA LevelsStakeholder Input for CIA DecisionsTechnical ControlsAggregate CIA ScoreExtreme Scenario Planning and Worst Case ScenariosSystem-Specific Risk AnalysisRisk Response TechniquesRisk Management ProcessesContinuous Monitoring and ImprovementRisk ManagementThe Risk Management PlanComponents of a Risk Management PlanHow to Create a Risk Management PlanIT GovernanceGuidelines for Mitigating RiskPolicy DevelopmentProcess and Procedure DevelopmentBest Practices to Incorporate in Security Policies and ProceduresLegal Compliance and AdvocacyGeneral Privacy PrinciplesTopic B: Identify Risks and Their CausesTriggersInformation Gathering TechniquesDocumentation ReviewsSWOT AnalysisRisk AnalysisRisk RegisterComponents of a Risk RegisterRisk CategoriesHow to Identify Risks and Their CausesTopic C: Analyze RisksQualitative Risk AnalysisQuantitative Risk AnalysisRisk Probability and Impact AssessmentThe Probability and Impact Risk Rating MatrixThe Ongoing Risk Assessment ProcessProject Risk RankingData Collection and Representation TechniquesBasics of Probability

Probability DistributionQuantitative Analysis MethodsQualitative Analysis MethodsRisk Data Quality AssessmentRisk Urgency AssessmentSimulationMonte Carlo AnalysisHow to Analyze RisksTopic D: Develop a Risk Response PlanNegative RisksNegative Risk StrategiesPositive RisksPositive Risk StrategiesContingency PlanThe BCPDRPContingency ReserveRisk-Related Contract DecisionsHow to Develop a Risk Response PlanLesson 05 ReviewLesson 06 - Integrating Advanced Authentication and Authorization TechniquesTopic A: Implement Authentication and Authorization TechnologiesAuthenticationCertificate-Based AuthenticationSSOAuthorizationOAuthThe OAuth ProcessXACMLSPMLTrust ModelsRADIUS ConfigurationsLDAPActive DirectoryKerberosGuidelines for Implementing Authentication and AuthorizationTopic B: Implement Advanced Identity ManagementAttestationIdentity PropagationIdentity FederationIdentity Federation MethodsGuidelines for Implementing Advanced Identity ManagementLesson 06 Review27m

Lesson 07 - Implementing Cryptographic TechniquesTopic A: Describe Cryptographic ropyConfusionDiffusionChain of TrustRoot of TrustSteganographyAdvanced PKI ConceptsTopic B: Choose Cryptographic TechniquesCryptographic ApplicationsCryptographic MethodsBlock Cipher ModesCryptographic Design ConsiderationsTransport EncryptionTransport Encryption ProtocolsData at Rest EncryptionHashingHash FunctionsKey StretchingDigital SignaturesCode SigningPseudorandom Number GenerationPerfect Forward SecrecyGuidelines for Choosing Cryptographic TechniquesTopic C: Choose Cryptographic ImplementationsDRMDigital WatermarkingSSL/TLSSSHPGP and GPGS/MIMEGuidelines for Choosing Cryptographic ImplementationsLesson 07 Review57mLesson 08 - Integrating Hosts, Storage, Networks, and Applications in a SecureEnterprise ArchitectureTopic A: Implement Security Standards in the EnterpriseStandardsCategories of StandardsInteroperability IssuesData Flow SecurityGuidelines for Implementing Standards in the EnterpriseTopic B: Select Technical Deployment ModelsDeployment ModelsCloud and Virtualization and Hosting OptionsElastic Cloud Computing1h 11m

Data Remnants in the CloudData AggregationData IsolationResource Provisioning and De-provisioningVirtual Machine VulnerabilitiesVirtual Environment SecurityVirtual Environment Security (Cont.)Network SegmentationNetwork DelegationMergers and AcquisitionsGuidelines for Selecting Technical Deployment ModelsTopic C: Secure the Design of the Enterprise InfrastructureInfrastructure Design SecurityDeployment DiagramsStorage IntegrationGuidelines for Securing the Design of the Enterprise InfrastructureTopic D: Secure Enterprise Application Integration EnablersCustomer Relationship ManagementEnterprise Resource PlanningGovernance, Risk, and ComplianceEnterprise Service BusService Oriented ArchitectureDirectory ServicesDomain Name SystemConfiguration Management DatabaseContent Management SystemGuidelines for Securing Enterprise Application Integration EnablersLesson 08 ReviewLesson 09 - Security Research and AnalysisTopic A: Perform an Industry Trends and Impact AnalysisIndustry Best PracticesDemo - Security ResearchResearch MethodsTechnology EvolutionNew Technologies, Security Systems, and ServicesNew Security Technology TypesGlobal IA Industry and CommunitySecurity Requirements for ContractsGuidelines for Determining Industry Trends and Effects on the EnterpriseSituational AwarenessSituational Awareness ConsiderationsEmerging Business ToolsSocial Media as an Emerging Business ToolMobile Devices as Emerging Business ToolsEmerging Security IssuesThe Global Impact Analysis IndustrySecurity Requirements for Business ContractsHow to Perform an Industry Trends Impact AnalysisTopic B: Perform an Enterprise Security Analysis1h 7m