by Integrity Training | Publisher: Stone River eLearning | Release Date: March 2019 | ISBN: 300000006CA312

The CompTIA Advanced Security Practitioner course is a preparatory course for the exam CAS-003 conducted by The Computing Technology Industry Association (CompTIA). It covers the exam topics in detail and prepares the students in the areas of risk management; enterprise security operations and architecture; research and collaboration; and integration of enterprise security. This certification course covers the technical knowledge and skills required to conceptualize, design, and engineer secure solutions across complex enterprise environments. It involves applying critical thinking and judgment across a broad spectrum of security disciplines to propose and implement solutions that map to enterprise drivers, while managing risk. There is no required prerequisite for this course however, the CASP certification is intended to follow CompTIA Security+ or equivalent experience and has a technical, hands-on focus at the enterprise level. We recommend that students have a minimum of ten years of experience in IT administration, including at least five years of hands-on technical security experience.

1. Course Introduction
   • Course Introduction 00:03:23
   • Instructor Introduction 00:01:35
2. Chapter 01 - Understanding Risk Management
   • Chapter Introduction 00:02:15
   • Topic A: Understanding Business and Industry Influences 00:00:10
   • Ongoing Risk Management 00:01:17
   • New Products and User Behaviors 00:03:43
   • Business Models and Strategies 00:03:26
   • Cloud Technologies 00:04:47
   • Acquisitions and Mergers 00:03:08
   • Due Diligence Team 00:01:06
   • Data Ownership 00:01:30
   • Data Reclassification 00:01:00
   • Integrating Diverse Industries 00:05:02
   • Common Regulations 00:05:09
   • Geographic Differences 00:02:25
   • Data Sovereignty 00:00:54
   • Internal and External Influences 00:05:33
   • De-perimeterization 00:01:07
   • Understand Changes in Network Boundaries 00:06:54
   • Topic B: Policies and Procedures 00:00:23
   • Understanding Policies and Procedures 00:01:34
   • Policy Life Cycle 00:01:29
   • Process Life Cycle 00:01:31
   • Reviewing Policies and Processes 00:03:45
   • Common Business Documents 00:04:45
   • Security for Contracts 00:01:14
   • Contract Requirements 00:01:55
   • General Privacy Principles 00:01:14
   • Standard Security Practices 00:11:29
   • Demo - Examining Security Policies 00:07:11
   • Topic C: Risk Mitigation and Control 00:00:25
   • Introduction to Risk Mitigation 00:01:01
   • Categorizing Data 00:03:49
   • Incorporating Stakeholder Input 00:01:18
   • Aggregate CIA Scores 00:01:37
   • Selecting and Implementing Controls 00:04:11
   • Security Control Frameworks 00:00:51
   • Options for Frameworks 00:04:40
   • Extreme Scenario Planning 00:02:41
   • System-Specific Risk Analysis 00:01:13
   • Qualitative Risk Analysis 00:01:40
   • Quantitative Risk Analysis 00:01:06
   • Risk Impact 00:03:09
   • Likelihood of Threat 00:00:49
   • Return on Investment 00:01:52
   • Understanding Payback 00:02:05
   • Total Cost of Ownership 00:01:24
   • TCO Guidelines 00:01:23
   • Translate to Business Terms 00:01:31
   • Risk Management Strategies 00:02:09
   • Risk Management Processes 00:01:06
   • Information and Asset Value and Costs 00:00:49
   • Vulnerabilities and Threat Identification 00:01:06
   • Additional Factors 00:01:34
   • Topic D: Business Continuity Planning 00:00:22
   • Continuity Planning 00:00:20
   • BCP Components 00:01:51
   • BCP Steps 00:02:39
   • Additional Plans 00:01:49
   • Conducting Business Impact Analysis 00:04:58
   • Chapter 01 Review 00:01:03
3. Chapter 02 - Network and Security Components and Architecture
   • Chapter Introduction 00:00:34
   • Topic A: Physical and Virtual Network Security Devices 00:00:16
   • Unified Threat Management 00:01:19
   • Analyzing UTM 00:01:31
   • Intrusion Detection and Prevention 00:05:13
   • In-Line Network Encryptor 00:01:32
   • Network Access Control 00:03:02
   • SIEM 00:01:16
   • Firewalls 00:07:06
   • Firewall Architecture 00:05:16
   • Wireless Controller 00:01:49
   • Routers and Switches 00:02:09
   • Proxy Servers 00:01:30
   • Topic B: Application and Protocol Level Security 00:00:29
   • Web Application Firewalls 00:01:46
   • Hardware Security Modules 00:01:51
   • Vulnerability Scanners 00:02:11
   • Topic C: Advanced Network Design 00:00:32
   • Virtual Private Networks 00:02:51
   • VPN Protocols 00:01:58
   • IP Security (IPSec) 00:03:01
   • IPSec Modes 00:01:02
   • Demo - Examining IPSec Policies 00:09:29
   • Secure Sockets Layer (SSL) 00:01:45
   • Transport Layer Security (TLS) 00:01:01
   • Additional Security Protocols 00:03:26
   • Authentication Protocols 00:04:46
   • Topic D: Network Solutions for Data Flow 00:00:36
   • Data Loss Prevention 00:02:49
   • Data Flow Enforcement 00:02:01
   • Network Flow 00:01:32
   • Topic E: Secure Baselines of Networking and Security Components 00:00:31
   • Securing Device Configurations 00:00:26
   • Access Control Lists (ACLs) 00:00:43
   • ACL Rule Sets 00:02:05
   • Change Monitoring 00:01:31
   • Configuration Lockdown 00:00:51
   • Availability Controls 00:03:30
   • Disk Availability 00:03:57
   • Key Availability Terms 00:01:25
   • Topic F: Advanced Configuration of Network Devices 00:00:17
   • Additional Configurations 00:00:49
   • Transport Security 00:01:45
   • Trunking Security 00:03:47
   • Port Security 00:02:20
   • Ports and Sockets 00:03:37
   • Security Zones 00:01:30
   • Network Segmentation 00:01:24
   • Network Access Control 00:02:53
   • NAC Concepts 00:02:54
   • Network Enabled Devices 00:02:21
   • Automation Systems 00:01:23
   • Physical Security 00:02:17
   • Chapter 02 Review 00:01:16
4. Chapter 03 - Implementing Advanced Authentication and Cryptographic Techniques
   • Chapter Introduction 00:00:56
   • Topic A: Understanding Authentication and Authorization Concepts 00:00:20
   • Authentication 00:04:42
   • The Importance of Identity 00:07:43
   • Additional Password Options 00:00:55
   • Demo - Enforcing Strong Passwords 00:10:04
   • Biometric Authentication 00:02:50
   • Biometric Considerations 00:01:35
   • Beyond Single Factor 00:01:39
   • Certificate Authentication 00:03:02
   • Authorization 00:07:42
   • Open Authorization 00:01:08
   • XACML 00:01:56
   • SPML 00:01:06
   • Authorization Concepts 00:04:02
   • Trust Models 00:01:53
   • Topic B: Cryptographic Techniques 00:00:27
   • Introduction to Cryptography 00:01:20
   • Cryptographic Techniques 00:00:52
   • Key Stretching 00:00:59
   • Hashing 00:03:15
   • Message Digest (MD) Algorithms 00:01:37
   • Secure Hash Algorithm (SHA) 00:01:31
   • Digital Signatures 00:02:01
   • Message Authentication 00:01:18
   • Code Signing 00:00:45
   • Additional Concepts 00:02:12
   • Protecting Data in Transit 00:02:02
   • Protecting Data in Memory 00:01:13
   • Protecting Data at Rest 00:03:44
   • Symmetric Algorithms 00:04:08
   • Asymmetric Algorithms 00:03:00
   • Encryption Methods 00:03:23
   • Topic C: Cryptographic Implementations 00:00:28
   • Crypto Options 00:02:09
   • Additional Crypto Options 00:02:42
   • Cryptographic Applications 00:01:06
   • Crypto Considerations 00:01:27
   • Stream vs. Block Ciphers 00:01:48
   • Block Cipher Modes 00:00:25
   • Public Key Infrastructure 00:05:41
   • Primary PKI Functions 00:02:10
   • Additional PKI Concepts 00:01:42
   • Chapter 03 Review 00:01:05
5. Chapter 04 - Implementing Security for Systems, Applications, and Storage
   • Chapter Introduction 00:00:57
   • Topic A: Security for Host Devices 00:00:25
   • Trusted OS 00:02:14
   • Trusted OS Options 00:03:12
   • Security Software 00:06:06
   • Additional Host-Based Software Options 00:02:24
   • Demo - Configuring a Host-Based Firewall 00:07:43
   • Auditing 00:02:09
   • Demo - Configuring Audit Policies 00:08:15
   • Endpoint Detection Response 00:01:01
   • Host Hardening 00:04:01
   • Group Policy 00:02:20
   • Demo - Configuring Group Policy Security 00:04:44
   • Command Shell Restrictions 00:02:18
   • Out-of-Band Management 00:02:12
   • Dedicated Interfaces 00:02:35
   • External I/O Restrictions 00:01:54
   • Wireless Technologies 00:05:03
   • Wi-Fi Components 00:02:00
   • 802.11 Standards 00:03:21
   • Wireless Security 00:05:40
   • Securing Other Host Devices 00:03:18
   • Boot Security 00:02:07
   • Additional Boot Security Options 00:04:31
   • Topic B: Mobile Device Security 00:00:41
   • Enterprise Mobility Management 00:01:18
   • MDM Concepts 00:02:56
   • Management Options 00:03:32
   • Context Aware Management 00:03:57
   • Security and Privacy 00:04:16
   • Physical Security Options 00:01:27
   • Additional Mobile Device Concepts 00:06:08
   • Authentication Options 00:02:22
   • Mobile Devices 00:04:47
   • Wearable Security Implications 00:01:39
   • Topic C: Software Security Controls 00:00:26
   • Application Security Design Considerations 00:03:03
   • Application Issues 00:06:31
   • Application Issues (cont...) 00:08:19
   • Data Remnants 00:01:41
   • Securing Applications 00:02:34
   • Using JSON and REST 00:01:39
   • Browser Extensions 00:02:40
   • Application Vulnerabilities 00:01:58
   • Chapter 04 Review 00:01:06
6. Chapter 05 - Implementing Security for Cloud and Virtualization Technologies
   • Chapter Introduction 00:02:21
   • Topic A: Cloud and Virtualization Technology 00:01:22
   • Cloud Computing and Virtualization 00:05:49
   • Cloud Options 00:10:38
   • Security Considerations 00:04:36
   • Cloud Service Models 00:07:40
   • Demo - Examining Cloud Service Models 00:09:14
   • Security and Virtualization 00:05:47
   • Cloud-Augmented Security Services 00:07:25
   • Security as a Service 00:01:54
   • Virtualization Vulnerabilities 00:03:41
   • Topic B: Securing Remote Access and Collaboration 00:00:37
   • Remote Access 00:01:10
   • Dial-Up Access 00:03:10
   • Virtual Private Networks 00:01:50
   • Remote Access Purposes 00:03:05
   • Security Considerations 00:02:09
   • Unified Collaboration Tools 00:01:08
   • Web Conferencing 00:04:44
   • Video Conferencing 00:03:07
   • Storage and Document Collaboration 00:03:12
   • Unified Communication 00:01:44
   • Instant Messaging 00:03:01
   • Presence 00:03:13
   • E-Mail 00:11:55
   • Chapter 05 Review 00:01:05
7. Chapter 06 - Utilizing Security Assessments and Incident Response
   • Chapter Introduction 00:01:09
   • Topic A: Security Assessments 00:00:20
   • Importance of Security Assessments 00:00:40
   • Malware Sandboxing 00:02:30
   • Memory Dumping 00:01:36
   • Runtime Debugging 00:01:26
   • Reconnaissance 00:01:20
   • Fingerprinting 00:02:30
   • Code Review 00:02:47
   • Social Engineering 00:12:48
   • Public Information 00:11:15
   • Demo - Accessing Public Information 00:06:36
   • Penetration Test 00:05:42
   • Vulnerability Assessment 00:03:34
   • Assessment Styles 00:04:30
   • Topic B: Security Assessment Tools 00:00:35
   • Network Tool Types 00:04:39
   • Security Content Automation Protocol (SCAP) 00:02:03
   • Common Vulnerability Scoring System (CVSS) 00:03:16
   • Fuzzing 00:00:51
   • Exploit Kits 00:01:07
   • Host Tools 00:07:25
   • Additional Host Tools 00:03:40
   • Physical Security Tools 00:03:23
   • Topic C: Incident Response and Recovery 00:05:37
   • E-discovery 00:05:37
   • Data Breach 00:01:24
   • Incident Response Process 00:04:30
   • Chapter 06 Review 00:00:56
   • Course Closure 00:02:36