GSEC GIAC Security Essentials Certification Exam Guide

587 Pages·2014·17.84 MB·English

by  Ric Messier

ALL IN ONE
GSEC GIAC® Security Essentials Certification
EXAM GUIDE
Ric Messier

New York • Chicago • San Francisco • Athens • London
Madrid • Mexico City • Milan • New Delhi
Singapore • Sydney • Toronto
McGraw-Hill Education is an independent entity from Global Information Assurance Certification (GIAC) and is not affiliated with GIAC
in any manner. This study/training guide and/or material is not sponsored by, endorsed by, or affiliated with GIAC in any manner. This
publication and digital content may be used in assisting students to prepare for the GIAC Security Essentials (GSEC) exam. Neither GIAC
nor McGraw-Hill Education warrant that use of this publication and digital content will ensure passing any exam. GIAC is a registered
trademark of Global Information Assurance Certification in the United States and certain other countries. All other trademarks are
trademarks of their respective owners.
Copyright © 2014 by McGraw-Hill Education (Publisher). All rights reserved. Printed in the United States of America. Except as
permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or
stored in a database or retrieval system, without the prior written permission of publisher, with the exception that the program listings may
be entered, stored, and executed in a computer system, but they may not be reproduced for publication.
ISBN: 978-0-07-182090-5
MHID: 0-07-182090-6
®
e-book conversion by Cenveo Publisher Services
Version 1.0
The material in this e-book also appears in the print version of this title: ISBN: 978-0-07-182091-2, MHID: 0-07-182091-4
McGraw-Hill Education e-books are available at special quantity discounts to use as premiums and sales promotions, or for use in
corporate training programs. To contact a representative, please visit the Contact Us pages at www.mhprofessional.com.
Information has been obtained by McGraw-Hill Education from sources believed to be reliable. However, because of the possibility of
human or mechanical error by our sources, McGraw-Hill Education, or others, McGraw-Hill Education does not guarantee the accuracy,
adequacy, or completeness of any information and is not responsible for any errors or omissions or the results obtained from the use of
such information.
All trademarks or copyrights mentioned herein are the possession of their respective owners and McGraw-Hill Education makes no claim
of ownership by the mention of products that contain these marks.
Images reproduced here are subject to the terms of their individual license and their use here does not imply endorsement from the author
of those images. See page 505 for credits.
TERMS OF USE
This is a copyrighted work and McGraw-Hill Education (“McGraw-Hill”) and its licensors reserve all rights in and to the work. Use of
this work is subject to these terms. Except as permitted under the Copyright Act of 1976 and the right to store and retrieve one copy of the
work, you may not decompile, disassemble, reverse engineer, reproduce, modify, create derivative works based upon, transmit,
distribute, disseminate, sell, publish or sublicense the work or any part of it without McGraw-Hill’s prior consent. You may use the work
for your own noncommercial and personal use; any other use of the work is strictly prohibited. Your right to use the work may be
terminated if you fail to comply with these terms.
THE WORK IS PROVIDED “AS IS.” McGRAW-HILL AND ITS LICENSORS MAKE NO GUARANTEES OR WARRANTIES AS
TO THE ACCURACY, ADEQUACY OR COMPLETENESS OF OR RESULTS TO BE OBTAINED FROM USING THE WORK,
INCLUDING ANY INFORMATION THAT CAN BE ACCESSED THROUGH THE WORK VIA HYPERLINK OR OTHERWISE,
AND EXPRESSLY DISCLAIM ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. McGraw-Hill and its licensors do not
warrant or guarantee that the functions contained in the work will meet your requirements or that its operation will be uninterrupted or
error free. Neither McGraw-Hill nor its licensors shall be liable to you or anyone else for any inaccuracy, error or omission, regardless
of cause, in the work or for any damages resulting therefrom. McGraw-Hill has no responsibility for the content of any information
accessed through the work. Under no circumstances shall McGraw-Hill and/or its licensors be liable for any indirect, incidental, special,
punitive, consequential or similar damages that result from the use of or inability to use the work, even if any of them has been advised of
the possibility of such damages. This limitation of liability shall apply to any claim or cause whatsoever whether such claim or cause
arises in contract, tort or otherwise.
This book is dedicated to Kathleen, without whom I would not be on this path.
ABOUT THE AUTHOR

Ric Messier, GSEC, CEH, CISSP, is an IT security professional who first experienced worldwide
networking on the BITNET in the early 1980s. Since that time, he has been heavily involved with
networking and security. Through a career of programming, testing, systems administration, network
management, penetration testing, project management, and architecture and design, security has been
a core and guiding principle behind it all. Ric has worked with the largest service providers, leading
teams that developed security products, and providing security leadership to other development
teams, including teams working on Voice over IP service offerings. He has also managed small
business networks and consulted for a number of small business owners. He operates a small
consulting business, working with customers such as Fortune 500 businesses, with a range of security
and networking needs. Ric has been a contributor to Hakin9 and PenTest magazines and has spoken at
Interop, New York. Ric currently teaches networking and security courses to graduate students at
Brandeis University and undergraduates at Champlain College. He has also developed video training
titles on ethical hacking, computer forensics, and networking with TCP/IP.
About the Technical Editor
Brice “Kelly” Sparks, CEH, CISSP, is the Information Assurance Manager (IAM) for the United
States Missile Defense Agency Test Directorate and has more than 30 years’ experience in the
Information Assurance and Network Security field. Kelly’s experience includes 20 years in the U.S.
Air Force specializing in Electronic Systems Security Assessment, Information Operations,
Electronic Warfare training, and Operations Security. Prior to joining the Missile Defense Agency, he
served as the Senior Principle Cyber Security Analyst with Dynetics Inc. for nine years, specializing
in Certification and Accreditation, Network Vulnerability Assessment, and Penetration Testing,
providing service to multiple Department of Defense and commercial technology clients. He has
more than eight years of teaching experience as an adjunct faculty member at University of Alabama
in Huntsville, has been technical trainer for the U.S. Air Force Information Operations School, and
been technical trainer for the U.S. Navy Network Security and Vulnerability technician course. Kelly
holds an Associate’s Degree in Intelligence Analysis from the Community College of the Air Force, a
bachelor ’s degree in computer science from Park University, and a master ’s degree in network
security from Capitol College.
CONTENTS AT A GLANCE

Chapter 1 Information Security and the GIAC Security Essentials Certification

Chapter 2 Networking Fundamentals

Chapter 3 Network Design

Chapter 4 Authentication and Access Control

Chapter 5 Network Security

Chapter 6 Linux

Chapter 7 Windows

Chapter 8 Encryption

Chapter 9 Risk Management

Chapter 10 Virtual Machines

Chapter 11 Vulnerability Control

Chapter 12 Malware

Chapter 13 Physical Security

Chapter 14 Wireless Technologies

Chapter 15 VoIP

Appendix A About the Download

Appendix B Practice Exam

Permissions

Index
CONTENTS

Acknowledgments
Introduction
Chapter 1 Information Security and the GIAC Security Essentials Certification
The Evolution and Importance of Security
Types of Security Threats
Malware
Identity Theft
Mobile Devices
Denial of Service
Insider Threats
About SANS
About the GSEC Certification
Who the Exam Is For
About the Exam
The Purpose of This Book
Chapter 2 Networking Fundamentals
History of TCP/IP
Networking Stacks
The OSI Model
TCP/IP Architecture
Protocols
Internet Protocol
IP Version 4 Headers
Addressing
Fragmentation
Internet Protocol Version 6
Internet Control Message Protocol (ICMP)
Transmission Control Protocol (TCP)
Reliable Delivery
The Mitnick–Shimomura Attack
User Datagram Protocol (UDP)
Domain Name System (DNS)
Chapter Review
Questions
Answers
Exercise Answers
Chapter 3 Network Design
Cable Types
Coaxial Cable
Twisted Pair
Fiber Optics
Topologies
Bus Topology
Star Topology
Mesh Topology
Full Mesh Topology
Ring Topology
Switching
Ethernet
Asynchronous Transfer Mode (ATM)
Hubs, Bridges, and Switches
Routing
Distance Vector Routing
Link-State Routing
Security Mechanisms
Routers
Firewalls
Intrusion Detection Systems
Chapter Review
Questions
Answers
Exercise 3-1 Answer
Chapter 4 Authentication and Access Control
Authentication
Credentials
Token-Based Authentication
Biometrics
RADIUS
TACACS/TACACS+
Web-Based Authentication
Basic Authentication
Multifactor Authentication
Authorization
Principle of Least Privilege
Accounting
Access Control
Discretionary Access Control
Mandatory Access Control
Role-Based Access Control
Attribute-Based Access Control
Single Sign-On
Chapter Review
Questions
Answers
Exercise 4-1 Answer
Chapter 5 Network Security
Common Attacks
Protocol Attacks
Malware
Network Attacks
Web-Based Attacks
Phishing and Drive-by Downloading
Defense in Depth
Security Through Obscurity
Firewalls
Network-Based Firewalls
Host-Based Firewalls
Intrusion Defense
Intrusion Detection
Intrusion Prevention
Anti-Virus Software
Vulnerability Management
Honeypots
Chapter Review
Questions
Answers
Exercise 5-2 Answer
Chapter 6 Linux
UNIX History
GNU
The Kernel
Filesystem Layout
Using Linux
General Utilities
File Management
Process Management
Networking
Software Management
Debian
RedHat/CentOS
Slackware
Boot Process
Process Management
Processes and Threads
Process Tools
Signals
System Management
Backups
Patch Management
Job Scheduling
User Management
Configuration
Logging and Log Management
Security Tools
SELinux
TripWire
iptables
AppArmor
Chapter Review
Questions
Answers
Exercise Answers
Chapter 7 Windows
Windows History
Windows 3.x and Windows NT 3.x
Windows 9x, NT 4.0, and Windows 2000
Windows XP and Beyond
Windows Networking
Basic Configuration
Networking Utilities
Securing Windows Networking
Resource Management
Windows Workgroups vs. Windows Domains
Active Directory
Users and Groups
Resource Sharing
Policies and Policy Management
Windows Management
Automation
Configuration
Auditing
User Rights
Permissions
Registry
Windows Security
EFS and BitLocker
Updates and Hotfixes
Service Packs
Backups
Security Templates
Securing Windows Services
Securing Windows Services
IIS
SQL Server
Terminal Services
Chapter Review
Questions
Answers
Answers to Exercises
Chapter 8 Encryption
Important Dates in Cryptography History
Foundations
Diffie-Hellman
RSA
Digest Algorithms
Cryptographic Attacks
X.509 Certificates
Public Key Infrastructure (PKI)
S/MIME
Pretty Good Privacy (PGP)
Symmetric Encryption
DES and Triple DES
AES
Asymmetric Encryption
SSL and TLS
Virtual Private Networks (VPNs)
IPSec
Steganography
Kerberos
Chapter Review
Questions
Answers
Exercise Answers
Chapter 9 Risk Management
Regulatory
Risk Management
Cost-Benefit Analysis
Quantitative Risk Assessment
Qualitative Risk Assessment
Risk Management Strategies
Security Policies
Data at Rest
Contingency Plans
Disaster Recovery
Incident Handling
The Legal Impact of Incidents
Information Warfare
OPSEC
Chapter Review
Questions
Answers
Exercise 9-1 Answer
Chapter 10 Virtual Machines
Virtual Machine History
Emulation and the PC Era
Application Virtualization
Virtual Memory
Paging Algorithms
Security Implications
Reasons for Virtualizing
Hypervisors
Virtual Resources