Senior Acquisitions Editor: Kenyon Brown

Development Editor: Gary Schwartz

Technical Editors: Russ Christy and Brent Hamilton

Senior Production Editor: Christine O'Connor

Copy Editor: Judy Flynn

Editorial Manager: Pete Gaughan

Production Manager: Kathleen Wisor

Executive Editor: Jim Minatel

Book Designers: Judy Fung and Bill Gibson

Proofreader: Nancy Carrasco

Indexer: Johnna VanHoose Dinse

Project Coordinator, Cover: Brent Savage

Cover Designer: Wiley

Cover Image: Getty Images Inc./Jeremy Woodhouse

Published simultaneously in Canada

ISBN: 978-1-119-47764-8

ISBN: 978-1-119-47771-6 (ebk.)

ISBN: 978-1-119-47767-9 (ebk.)

Manufactured in the United States of America

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Web site may provide or recommendations it may make. Further, readers should be aware that Internet Web sites listed in this work may have changed or disappeared between when this work was written and when it is read.

For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at (877) 762-2974, outside the U.S. at (317) 572-3993 or fax (317) 572-4002.

Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com.

Library of Congress Control Number: 2018967329

TRADEMARKS: Wiley, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. CompTIA and CASP are registered trademarks of CompTIA Properties, LLC. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book.

About the Authors

Jeff Parker resides on the Canadian east coast, but he works for an IT consultancy firm in Virginia where he specializes in IT risk management and compliance. Jeff started in information security while working as a software engineer for HP in Boston, Massachusetts. Jeff then took the role of a global IT risk manager for Deutsche Post to enjoy Prague in the Czech Republic with his family for several years. There he developed and oversaw implementation of a new IT risk management strategy. Today, Jeff most enjoys time with his two children in Nova Scotia.

Jeff maintains several certifications, including CISSP, CompTIA CASP+, CySA+, and ITT+. He also co-authored the book Wireshark for Security Professionals: Using Wireshark and the Metasploit Framework (Wiley, 2017) with Jessey Bullock. Jeff also wrote practice exam books for the CompTIA certifications CySA+ and the A+, out in 2018 and 2019, respectively.

Michael Gregg is the founder and CEO of Superior Solutions, Inc., a security consulting firm based in Houston, Texas. Superior Solutions performs security assessments and penetration testing for Fortune 1000 firms. The company has performed security assessments for private, public, and governmental agencies. Its Houston-based team travels the United States to assess, audit, and provide training services.

Michael is responsible for working with organizations to develop cost-effective and innovative technology solutions to security issues and for evaluating emerging technologies. He has more than 20 years of experience in the IT field and holds two associate's degrees, a bachelor's degree, and a master's degree. In addition to co-writing the first, second, and third editions of Security Administrator Street Smarts, Michael has written or co-written 14 other books, including Build Your Own Security Lab: A Field Guide for Network Testing (Wiley, 2008), Hack the Stack: Using Snort and Ethereal to Master the 8 Layers of an Insecure Network (Syngress, 2007), Certified Ethical Hacker Exam Prep 2 (Pearson, 2006), and Inside Network Security Assessment: Guarding Your IT Infrastructure (Sams Publishing, 2005).

Michael has been featured on Fox News, CBS News, CNN, and other TV outlets as well as in the New York Times and other print publications, and he has testified before US Congress as an industry/cybersecurity expert. Michael has created over a dozen training security classes and training manuals and has created and performed video instruction on many security topics such as cybersecurity, CISSP, CISA, Security+, and others.

When not consulting, teaching, or writing, Michael enjoys 1960s muscle cars and giving back to the community. He is a member of the board of Habitat for Humanity.

CONTENTS

Cover

Acknowledgments

About the Authors

Table of Exercises

Introduction

Before You Begin the CompTIA CASP+ Certification Exam
Who Should Read This Book
What You Will Learn
How This Book Is Organized
How to Use This Book
Tips for Taking the CASP+ Exam
How to Contact the Author
The CASP+ (2018 Edition) Exam Objective Map

Assessment Test

Answers to Assessment Test

Chapter 1 Cryptographic Tools and Techniques

The History of Cryptography
Cryptographic Services
Symmetric Encryption
Asymmetric Encryption
Hybrid Encryption
Hashing
Digital Signatures
Public Key Infrastructure
Implementation of Cryptographic Solutions
Cryptographic Attacks
Summary
Exam Essentials
Review Questions

Chapter 2 Comprehensive Security Solutions

Advanced Network Design
TCP/IP
Secure Communication Solutions
Secure Facility Solutions
Secure Network Infrastructure Design
Summary
Exam Essentials
Review Questions

Chapter 3 Securing Virtualized, Distributed, and Shared Computing

Enterprise Security
Cloud Computing
Virtualization
Virtual LANs
Virtual Networking and Security Components
Enterprise Storage
Summary
Exam Essentials
Review Questions

Chapter 4 Host Security

Firewalls and Network Access Control
Host-Based Firewalls
Persistent Agent
Non-Persistent Agent
Agent-Based Technology
Agentless-Based Technology
Trusted Operating Systems
Endpoint Security Solutions
Anti-Malware
Host Hardening
Asset Management
Data Exfiltration
Intrusion Detection and Prevention
Network Management, Monitoring, and Security Tools
Summary
Exam Essentials
Review Questions

Chapter 5 Application Security and Penetration Testing

Application Security Design Considerations
Specific Application Issues
Application Sandboxing
Application Security Frameworks
Software Assurance
Development Approaches
Secure Coding Standards
Documentation
Validation and Acceptance Testing
Application Exploits
Privilege Escalation
Improper Storage of Sensitive Data
Secure Cookie Storage and Transmission
Context-Aware Management
Malware Sandboxing
Pivoting
Open-Source Intelligence
Memory Dumping
Client-Side Processing vs. Server-Side Processing
Security Assessments and Penetration Testing
Red, Blue, and White Teaming
Vulnerability Assessment Areas
Security Assessment and Penetration Test Tools
Summary
Exam Essentials
Review Questions

Chapter 6 Risk Management

Risk Terminology
Identifying Vulnerabilities
Operational Risks
The Risk Assessment Process
Best Practices for Risk Assessments
Summary
Exam Essentials
Resources
Review Questions

Chapter 7 Policies, Procedures, and Incident Response

A High-Level View of Documentation
Business Documents Used to Support Security
Documents and Controls Used for Sensitive Information
Training and Awareness for Users
Auditing Requirements and Frequency
The Incident Response Framework
Incident and Emergency Response
Summary
Exam Essentials
Review Questions

Chapter 8 Security Research and Analysis

Applying Research Methods to Determine Industry Trends and Their Impact on the Enterprise
Analyze Scenarios to Secure the Enterprise
Summary
Exam Essentials
Review Questions

Chapter 9 Enterprise Security Integration

Integrate Enterprise Disciplines to Achieve Secure Solutions
Integrate Hosts, Storage, Networks, and Applications into a Secure Enterprise Architecture
Integrate Mobility Management
Summary
Exam Essentials
Review Questions

Chapter 10 Security Controls for Communication and Collaboration

Selecting the Appropriate Control to Secure Communications and Collaboration Solutions
Integrate Advanced Authentication and Authorization Technologies to Support Enterprise Objectives
Implement Security Activities across the Technology Life Cycle
Physical Security Tools for Security Assessment
Summary
Exam Essentials
Review Questions

Appendix A Answers to Review Questions

Chapter 1: Cryptographic Tools and Techniques
Chapter 2: Comprehensive Security Solutions
Chapter 3: Securing Virtualized, Distributed and Shared Computing
Chapter 4: Host Security
Chapter 5: Application Security and Penetration Testing
Chapter 6: Risk Management
Chapter 7: Policies, Procedures, and Incident Response
Chapter 8: Security Research and Analysis
Chapter 9: Enterprise Security Integration
Chapter 10: Security Controls for Communication and Collaboration

Appendix B CASP+ Lab Manual

What You’ll Need
Lab A1: Verifying a Baseline Security Configuration
Lab A2: Introduction to a Protocol Analyzer
Lab A3: Performing a Wireless Site Survey
Lab A4: Using Windows Remote Access
Lab A5: Configuring a VPN Client
Lab A6: Using the Windows Command-Line Interface (CLI)
Lab A7: Cisco IOS Command-Line Basics
Lab A8: Shopping for Wi-Fi Antennas
Lab A9: Cloud Provisioning
Lab A10: Introduction to Windows Command-Line Forensic Tools
Lab A11: Introduction to Hashing Using a GUI
Lab A12: Hashing from the Command Line
Lab A13: Cracking Encrypted Passwords
Lab A14: Threat Modeling
Lab A15: Social Engineering
Lab A16: Downloading, Verifying, and Installing a Virtual Environment
Lab A17: Exploring Your Virtual Network
Lab A18: Port Scanning
Lab A19: Introduction to the Metasploit Framework
Lab A20: Sniffing NETinVM Traffic with Wireshark
Suggestions for Further Exploration of Security Topics

Index

Advert

End User License Agreement

List of Illustrations

Chapter 1

Figure 1.1 A rail-fence cipher (an example of a transposition cipher)
Figure 1.2 Symmetric encryption process
Figure 1.3 Asymmetric encryption
Figure 1.4 Hybrid encryption
Figure 1.5 Hashing process
Figure 1.6 An example of a cryptographic hash on a software product
Figure 1.7 Digital signature creation
Figure 1.8 Hierarchical trust model
Figure 1.9 An example of an X.509 certificate
Figure 1.10 An example of a chain of trust

Chapter 2

Figure 2.1 CHAP authentication
Figure 2.2 Packet filter firewall
Figure 2.3 Screened host firewall
Figure 2.4 DMZ firewall design
Figure 2.5 Defense-in-depth firewall design
Figure 2.6 Basic SCADA system
Figure 2.7 VoIP in the protocol stack
Figure 2.8 TCP/IP protocol stack
Figure 2.9 MAC address capture
Figure 2.10 IPv4 header
Figure 2.11 IPv6 header
Figure 2.12 TCP startup
Figure 2.13 UDP header
Figure 2.14 Topology of Remotely Triggered Black Hole Filtering

Chapter 3

Figure 3.1 Some of the components of enterprise security
Figure 3.2 Some of the components of enterprise security
Figure 3.3 Evolution of cloud services
Figure 3.4 VDI infrastructure
Figure 3.5 Type 1 hypervisor
Figure 3.6 Type 2 hypervisor
Figure 3.7 Traditional vs. converged infrastructure
Figure 3.8 Enterprise storage
Figure 3.9 Files.com uploaded file browse

Chapter 4

Figure 4.1 Firewall placement and design
Figure 4.2 Basic network with firewall
Figure 4.3 Defense in depth and multiple layers of protection
Figure 4.4 Spam filter operation
Figure 4.5 Network-based IDS placement
Figure 4.6 HIDS placement

Chapter 5

Figure 5.1 Burp Proxy cookie capture
Figure 5.2 Input validation error
Figure 5.3 Rings of protection
Figure 5.4 Example of pivoting
Figure 5.5 Buffer overflow
Figure 5.6 Integer overflow example
Figure 5.7 Examining a DNS query in Wireshark

Chapter 6

Figure 6.1 Vulnerability window
Figure 6.2 Cloud-based service providers
Figure 6.3 Risk-ranking matrix

Chapter 7

Figure 7.1 Components of a good information security policy
Figure 7.2 Policy and subdocument structure
Figure 7.3 Available nbtstat switches
Figure 7.4 Available Foremost switches

Chapter 8

Figure 8.1 National Institute of Standards and Technology’s National Vulnerability Database website
Figure 8.2 Cain & Abel Sniffer tab showing hosts
Figure 8.3 Wireshark IPv4
Figure 8.4 Wireshark IPv6
Figure 8.5 Policy structure
Figure 8.6 Facebook.js, used by Firesheep to capture cookies
Figure 8.7 Botnet command and control structure
Figure 8.8 Corporate Facebook page
Figure 8.9 DEF CON 2018 home page
Figure 8.10 LulzSec

Chapter 9

Figure 9.1 The security triad
Figure 9.2 Building security controls
Figure 9.3 Security governance
Figure 9.4 Basic security controls
Figure 9.5 OODA model
Figure 9.6 Typical organizational chart
Figure 9.7 Drivers of change
Figure 9.8 Layered access control

Chapter 10

Figure 10.1 Back Orifice
Figure 10.2 TSweb Remote Desktop Web Connection
Figure 10.3 Structure of a PPP header
Figure 10.4 Example network data flow diagram
Figure 10.5 SOAP layers
Figure 10.6 X.509 digital certificate
Figure 10.7 Security Considerations in the Information System Development Life Cycle
Figure 10.8 Security requirements traceability matrix

Table of Exercises

Exercise 2.1 Sniffing VoIP Traffic
Exercise 2.2 Spoofing MAC Addresses with SMAC
Exercise 2.3 Sniffing IPv4 with Wireshark
Exercise 2.4 Capturing a Ping Packet with Wireshark
Exercise 2.5 Capturing a TCP Header with Wireshark
Exercise 2.6 Using Men & Mice to Verify DNS Configuration
Exercise 2.7 Attempting a Zone Transfer
Exercise 3.1 What Services Should Be Moved to the Cloud?
Exercise 3.2 Identifying Risks and Issues with Cloud Computing
Exercise 3.3 Turning to the Cloud for Storage and Large File Transfer
Exercise 3.4 Creating a Virtual Machine
Exercise 3.5 Understanding Online Storage
Exercise 4.1 Reviewing and Assessing ACLs
Exercise 4.2 Configuring iptables
Exercise 4.3 Testing Your Antivirus Program
Exercise 4.4 Taking Control of a Router with Physical Access
Exercise 4.5 Running a Security Scanner to Identify Vulnerabilities
Exercise 4.6 Bypassing Command Shell Restrictions
Exercise 5.1 Identifying Testing Types at Your Organization
Exercise 5.2 Downloading and Running Kali Linux
Exercise 5.3 Performing Passive Reconnaissance on Your Company or Another Organization
Exercise 5.4 Performing TCP and UDP Port Scanning
Exercise 6.1 Tracking Vulnerabilities in Software
Exercise 6.2 Outsourcing Issues to Review
Exercise 6.3 Calculating Annualized Loss Expectancy
Exercise 7.1 Reviewing Security Policy
Exercise 7.2 Reviewing Documents
Exercise 7.3 Reviewing the Employee Termination Process
Exercise 7.4 Exploring Helix, a Well-Known Forensic Tool
Exercise 8.1 Using WinDump to Sniff Traffic
Exercise 8.2 Exploring the Nagios Tool
Exercise 8.3 Using Ophcrack
Exercise 8.4 Installing Cookie Cadger
Exercise 8.5 Identifying XSS Vulnerabilities
Exercise 9.1 Reviewing Your Company’s Acceptable Use Policy
Exercise 10.1 Eavesdropping on Web Conferences
Exercise 10.2 Sniffing Email with Wireshark
Exercise 10.3 Sniffing VoIP with Cain & Abel

CompTIA^®

CASP+^® Advanced Security
Practitioner
Study Guide Exam CAS-003

Acknowledgments

About the Authors

Table of Exercises