CCNP And CCIE Security Core SCOR 350-701 Official Cert .

CCNPand CCIESecurityCoreSCOR 350-701Official Cert GuideOMAR SANTOSCisco Press221 River St.Hoboken, NJ 07030 USA

iiCCNP and CCIE Security Core SCOR 350-701 Official Cert GuideCCNP and CCIE Security CoreSCOR 350-701 Official Cert GuideOmar SantosCopyright 2020 Cisco Systems, Inc.Published by:Cisco Press221 River St.Hoboken, NJ 07030 USAAll rights reserved. This publication is protected by copyright, and permission must be obtained from thepublisher prior to any prohibited reproduction, storage in a retrieval system, or transmission in any formor by any means, electronic, mechanical, photocopying, recording, or likewise. For information regardingpermissions, request forms, and the appropriate contacts within the Pearson Education Global Rights &Permissions Department, please visit www.pearson.com/permissions.No patent liability is assumed with respect to the use of the information contained herein. Althoughevery precaution has been taken in the preparation of this book, the publisher and author assume noresponsibility for errors or omissions. Nor is any liability assumed for damages resulting from the use ofthe information contained herein.ScoutAutomatedPrintCodeLibrary of Congress Control Number: 2020901233ISBN-10: 0-13-597197-7ISBN-13: 978-0-13-597197-0Trademark AcknowledgmentsAll terms mentioned in this book that are known to be trademarks or service marks have beenappropriately capitalized. Cisco Press cannot attest to the accuracy of this information. Use of a term inthis book should not be regarded as affecting the validity of any trademark or service mark.

iiiFeedback InformationAt Cisco Press, our goal is to create in-depth technical books of the highest quality and value. Each bookis crafted with care and precision, undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community.Readers' feedback is a natural continuation of this process. If you have any comments regarding how wecould improve the quality of this book, or otherwise alter it to better suit your needs, you can contact usthrough email at feedback@ciscopress.com. Please make sure to include the book title and ISBN in yourmessage.We greatly appreciate your assistance.Editor-in-Chief: Mark TaubTechnical Editor: John StuppiAlliances Manager, Cisco Press: Arezou GolEditorial Assistant: Cindy TeetersDirector, Product Manager: Brett BartowDesigner: Chuti PrasertsithManaging Editor: Sandra SchroederComposition: codeMantraDevelopment Editor: Christopher A. ClevelandIndexer: Ken JohnsonProject Editor: Mandie FrankProofreader: Abigail ManheimCopy Editor: Bart Reed

ivCCNP and CCIE Security Core SCOR 350-701 Official Cert GuideCreditsFigure 1-1 Screenshot of The Exploit Database (Exploit-DB) OffSec ServicesLimited 2020Figure 1-2 Screenshot of Using searchsploit OffSec Services Limited 2020Figure 1-4Screenshot of Ghidra Software Reverse Engineering Framework, ghidraFigure 1-6Screenshot of SQL injection vulnerability Webgoat SQL InjectionFigure 3-27 Screenshot of Installing the Python requests package using pip PythonSoftware FoundationFigure 3-28 Screenshot of Using the Python requests package Python SoftwareFoundationFigure 3-29Screenshot of Using curl to obtain information from an API GitHub, Inc.Figure 3-30 Screenshot of Using curl to obtain additional information from the Deckof Cards API GitHub, Inc.Figure 9-11Screenshot of AWS Lamda 2020, Amazon Web Services, IncFigure 9-14Screenshot of Docker 2020 Docker Inc.Figure 9-15Screenshot of Docker 2020 Docker Inc.Figure 9-16Screenshot of Docker 2020 Docker Inc.Figure 9-17Deploying your first app on Kubernetes, Google Inc.Figure 9-19Screenshot of The Kubernetes Authors Google Inc.Figure 9-20Screenshot of The Kubernetes Authors Google Inc.Figure 9-21Screenshot of The Kubernetes Authors Google Inc.Figure 10-2Screenshot of macOS Apple 2019The International Organization for Standardization (ISO), ISO/IEC 27001:2005(en)The International Organization for Standardization (ISO)Malware Tunneling in IPv6, June 22, 2012. United States Department of HomelandSecurityThe International Organization for Standardization (ISO)NIST Special Publication 800-61NIST Special Publication 800-61NIST Special Publication 800-61NIST Special Publication 800-61US-CERT Description Document - RFC 2350Cybersecurity and Infrastructure Security Agency (CISA), U.S. Department of HomelandSecurityNIST Special Publication 800-63B

vContents at a GlanceIntroductionxxvChapter 1Cybersecurity Fundamentals 2Chapter 2Cryptography 78Chapter 3Software-Defined NetworkingSecurity and Network Programmability 106Chapter 4Authentication, Authorization, Accounting (AAA) and IdentityManagement 150Chapter 5Network Visibility and SegmentationChapter 6Infrastructure Security 306Chapter 7Cisco Next-Generation Firewalls andCisco Next-Generation Intrusion Prevention SystemsChapter 8Virtual Private Networks (VPNs) 464Chapter 9Securing the Cloud 548Chapter 10Content SecurityChapter 11Endpoint Protection and DetectionChapter 12Final Preparation220392600634658Glossary of Key Terms660Appendix AAnswers to the “Do I Know This Already?”Quizzes and Q&A Sections 678Appendix BCCNP Security Core SCOR (350-701) Exam Updates 686Index688

viCCNP and CCIE Security Core SCOR 350-701 Official Cert GuideContentsIntroduction xxvChapter 1Cybersecurity Fundamentals 2“Do I Know This Already?” QuizFoundation Topics36Introduction to Cybersecurity6Cybersecurity vs. Information Security (InfoSec)7The NIST Cybersecurity Framework 7Additional NIST Guidance and Documents7The International Organization for Standardization (ISO) 8Defining What Are Threats, Vulnerabilities, and Exploits 8What Is a Threat? 9What Is a Vulnerability?What Is an Exploit?910Risk, Assets, Threats, and Vulnerabilities12Defining Threat Actors 13Understanding What Threat Intelligence Is 14Viruses and Worms 16Types and Transmission MethodsMalware PayloadsTrojans161718Trojan Types 18Trojan Ports and Communication MethodsTrojan Goals 20Trojan Infection MechanismsEffects of Trojans22Distributing Malware 22Ransomware 23Covert CommunicationKeyloggers 25Spyware26Analyzing Malware 27Static Analysis 27Dynamic Analysis 28232019

ContentsCommon Software and Hardware Vulnerabilities 30Injection Vulnerabilities30SQL Injection 30HTML Injection 32Command Injection 32Authentication-based Vulnerabilities 32Credential Brute Force Attacks and Password CrackingSession Hijacking3334Default Credentials34Insecure Direct Object Reference Vulnerabilities 35Cross-site Scripting (XSS)35Cross-site Request Forgery 37Cookie Manipulation Attacks37Race Conditions 38Unprotected APIs 38Return-to-LibC Attacks and Buffer OverflowsOWASP Top 103940Security Vulnerabilities in Open Source Software 40Confidentiality, Integrity, and Availability40What Is Confidentiality? 40What Is Integrity?42What Is Availability?43Talking About Availability, What Is a Denial-of-Service (DoS) Attack?Access Control ManagementCloud Security Threats4547Cloud Computing Issues and Concerns 48Cloud Computing Attacks50Cloud Computing SecurityIoT Security ThreatsIoT Protocols515153Hacking IoT Implementations54An Introduction to Digital Forensics and Incident Response 55ISO/IEC 27002:2013 and NIST Incident Response GuidanceWhat Is an Incident?5556False Positives, False Negatives, True Positives, and True Negatives 57Incident Severity Levels58How Are Incidents Reported?5844vii

viiiCCNP and CCIE Security Core SCOR 350-701 Official Cert Guide60What Is an Incident Response Program?The Incident Response Plan60The Incident Response Process61Tabletop Exercises and Playbooks 63Information Sharing and Coordination64Computer Security Incident Response Teams 64Product Security Incident Response Teams (PSIRTs) 66The Common Vulnerability Scoring System (CVSS) 67National CSIRTs and Computer Emergency Response Teams (CERTs) 71Coordination Centers 72Incident Response Providers and Managed Security Service Providers(MSSPs) 73Key Incident Management PersonnelSummary7374Exam Preparation Tasks74Review All Key Topics 74Define Key Terms 76Review QuestionsChapter 276Cryptography 78“Do I Know This Already?” Quiz 78Foundation Topics 80Introduction to Cryptography 80CiphersKeys8081Block and Stream Ciphers 82Symmetric and Asymmetric AlgorithmsHashes8284Hashed Message Authentication Code 86Digital Signatures86Key Management89Next-Generation Encryption ProtocolsIPsec8990SSL and TLS 91Fundamentals of PKI93Public and Private Key Pairs93More About Keys and Digital Certificates 93Certificate Authorities 94Root Certificates95

ContentsIdentity Certificates 96X.500 and X.509v397Authenticating and Enrolling with the CAPublic Key Cryptography Standards9899Simple Certificate Enrollment Protocol 99Revoking Digital Certificates 99Digital Certificates in PracticePKI Topologies100101Single Root CA 101Hierarchical CA with Subordinate CAs101Cross-Certifying CAs 102Exam Preparation Tasks102Review All Key Topics 102Define Key Terms 103Review QuestionsChapter 3103Software-Defined NetworkingSecurity and Network Programmability106“Do I Know This Already?” Quiz 106Foundation Topics 108Introduction to Software-Defined NetworkingTraditional Networking Planes108109So What’s Different with SDN? 110Introduction to the Cisco ACI Solution 110VXLAN and Network Overlays 112Micro-Segmentation115Open Source Initiatives117More About Network Function VirtualizationNFV MANOContiv118119120Cisco Digital Network Architecture (DNA) 121Cisco DNA Policies123Cisco DNA Group-Based Access Control PolicyCisco DNA IP-Based Access Control PolicyCisco DNA Application Policies 126Cisco DNA Traffic Copy Policy 127Cisco DNA Center Assurance Solution 128Cisco DNA Center APIs 130Cisco DNA Security Solution 132126124ix

xCCNP and CCIE Security Core SCOR 350-701 Official Cert Guide132Cisco DNA Multivendor SupportIntroduction to Network Programmability132Modern Programming Languages and ToolsDevNet133136Getting Started with APIs136REST APIs 137Using Network Device APIs 139YANG ModelsNETCONFRESTCONF139141143OpenConfig and gNMIExam Preparation Tasks145146Review All Key Topics 146Define Key Terms 147Review QuestionsChapter 4147Authentication, Authorization,Accounting (AAA) and Identity Management 150“Do I Know This Already?” Quiz 151Foundation Topics 154Introduction to Authentication, Authorization, and AccountingThe Principle of Least Privilege and Separation of DutiesAuthentication 155Authentication by Knowledge156Authentication by Ownership or PossessionAuthentication by Characteristic 158Multifactor Authentication 159Duo Security159Zero Trust and BeyondCorp161Single Sign-On 164Authorization 167Mandatory Access Control (MAC)168Discretionary Access Control (DAC)168Role-Based Access Control (RBAC) 168Rule-Based Access Control169Attribute-Based Access ControlAccounting169169Infrastructure Access Controls 170Access Control Mechanisms170157154155

ContentsAAA Protocols 172RADIUS173TACACS Diameter802.1X174176178180Network Access Control List and FirewallingVLAN ACLs 181Security Group–Based ACL 181Downloadable ACL 181Cisco Identity Services Engine (ISE)181Cisco Platform Exchange Grid (pxGrid)182Cisco ISE Context and Identity Services184Cisco ISE Profiling Services 184Cisco ISE Identity Services 187Cisco ISE Authorization Rules 188Cisco TrustSec190Posture Assessment 192Change of Authorization (CoA)193Configuring TACACS Access 196Configuring RADIUS Authentication 202Configuring 802.1X Authentication 205Additional Cisco ISE Design Tips 211Advice on Sizing a Cisco ISE Distributed DeploymentExam Preparation Tasks214214Review All Key Topics 214Define Key Terms 216Review QuestionsChapter 5216Network Visibility and Segmentation“Do I Know This Already?” Quiz220221Foundation Topics 224Introduction to Network Visibility 224NetFlow225The Network as a Sensor and as an EnforcerWhat Is a Flow?226227NetFlow for Network Security and Visibility229NetFlow for Anomaly Detection and DDoS Attack MitigationData Leak Detection and Prevention231229xi