You're reading from CompTIA CASP+ CAS-004 Certification Guide

Product type Book

Published in Mar 2022

Publisher Packt

ISBN-13 9781801816779

Pages 654 pages

Edition 1st Edition

Languages

Concepts

Cybersecurity

Author (1):

Mark Birch

Table of Contents (23) Chapters

Preface

1. Section 1: Security Architecture

2. Chapter 1: Designing a Secure Network Architecture

3. Chapter 2: Integrating Software Applications into the Enterprise

4. Chapter 3: Enterprise Data Security, Including Secure Cloud and Virtualization Solutions

5. Chapter 4: Deploying Enterprise Authentication and Authorization Controls

6. Section 2: Security Operations

7. Chapter 5: Threat and Vulnerability Management

8. Chapter 6: Vulnerability Assessment and Penetration Testing Methods and Tools

9. Chapter 7: Risk Mitigation Controls

10. Chapter 8: Implementing Incident Response and Forensics Procedures

11. Section 3: Security Engineering and Cryptography

12. Chapter 9: Enterprise Mobility and Endpoint Security Controls

13. Chapter 10: Security Considerations Impacting Specific Sectors and Operational Technologies

14. Chapter 11: Implementing Cryptographic Protocols and Algorithms

15. Chapter 12: Implementing Appropriate PKI Solutions, Cryptographic Protocols, and Algorithms for Business Needs

16. Section 4: Governance, Risk, and Compliance

17. Chapter 13: Applying Appropriate Risk Strategies

18. Chapter 14: Compliance Frameworks, Legal Considerations, and Their Organizational Impact

19. Chapter 15: Business Continuity and Disaster Recovery Concepts

20. Chapter 16: Mock Exam 1

21. Chapter 17: Mock Exam 2

22. Other Books You May Enjoy

Indicators of compromise

There are many events that would take place on a busy network. Events can be recorded in logs (where an event is unusual) or coupled with another event that itself appears unusual. This could be an indicator of compromise (IOC). Another example of an IOC could be several unsuccessful attempts to connect using SSH to a core network appliance, followed by a successful authentication attempt from an unusual or gray-listed IP address. It is important for the security operation center to be able to identify attacks or threats. To identify IOCs, we need inputs in the form of logs and captured network traffic.

Packet capture

Packet capture (PCAP) files use a standard log format. They allow us to capture real-time data. Captured data can be analyzed using Wireshark, tcpdump, or tshark. See Wireshark capture in Figure 5.7:

Figure 5.7 – PCAP file

The PCAP format allows logs to be analyzed using different vendor tools and platforms...