Presenter: Mark Ciampa, Western Kentucky University
Teaching Security+ requires students to have practical hands-on experience in order to help students understand security concepts and so they will be prepared for the CompTIA performance-based certification exam questions. There are a wide variety of tools that can be used, many of which are free. In this presentation we will explore tools for teaching Security+ as well as learn from each other to teach Security+. In addition we will preview the forthcoming DTI IT_Labworks for Security+ that uses a game-playing simulation for teaching Security+.
Office Mix is retiring on May 1, 2018. Starting April 6, 2018 you will no longer be able to upload new or update existing recordings using the Office Mix add-in for PowerPoint. Learn More
Presenter: Mark Ciampa, Western Kentucky University
Teaching Security+ requires students to have practical hands-on experience in order to help students understand security concepts and so they will be prepared for the CompTIA performance-based certification exam questions. There are a wide variety of tools that can be used, many of which are free. In this presentation we will explore tools for teaching Security+ as well as learn from each other to teach Security+. In addition we will preview the forthcoming DTI IT_Labworks for Security+ that uses a game-playing simulation for teaching Security+.
Click Extract files box for 32-bit or 64-bit operating systems
Check Start Portable-VirtualBox after the extract and/or compress
IMPORTANT: Click OK button in bottom left corner (NOT Exit button)
2015 Cengage Learning Computing Conference
10
Slide 11 - Create & Run VM from USB Flash Drive
Launch Portable-VirtualBox.exe to enter VirtualBox
Network and USB support are disabled by default
Can create VM of Windows, Linux Mint (http://www.linuxmint.com/), Android (https://code.google.com/p/android-x86/downloads/list)
Can also be used in Chapter 10 Mobile Device Security
2015 Cengage Learning Computing Conference
11
Slide 12 - Chapter 2Malware & Social Engineering Attacks
Tools for Teaching Security+
2015 Cengage Learning Computing Conference
12
Slide 13 - Chapter 2 Projects Security+ Guide 5e
Project 2-1: Write-Protecting and Disabling a USB Flash Drive (Thumbscrew)
Project 2-2: Scan for Rootkits Using a Basic Tool (TDSSKiller)
Project 2-3: Scan for Rootkits Using an Advanced Tool (GMER)
Project 2-4: Use a Software Keylogger (Spyrix)
2015 Cengage Learning Computing Conference
13
Slide 14
2015 Cengage Learning Computing Conference
14
Slide 15 - RawDisk
“RawDisk library offers software developers direct access to files, disks and partitions of the disks (hard drives, flash disks etc.) for user-mode applications, bypassing security limitations of Windows operating systems”
Direct access to disks and protected files from user-mode applications in Windows 8/7/Vista/XP
Can read/write disks sector by sector without operating-system-imposed restrictions
“Comes in handy for development of data recovery, undelete and forensic applications”
https://www.eldos.com/rawdisk/
2015 Cengage Learning Computing Conference
15
Slide 16 - Microsoft Attack Surface Analyzer
“Understand how the attack surface of Windows systems change as a result of installing software”
Can take snap shot of multiple security related information elements on a system, then after the system changes can take another snap shot;
Compares the before and after snap shots and show what changed in an HTML report
Project 6-3: Viewing Digital Certificate Revocation Lists (CRL) and Untrusted Certificates
Project 6-4: Downloading and Installing a Digital Certificate
Project 6-5: Using a Digital Certificate for Signing Documents
2015 Cengage Learning Computing Conference
31
Slide 32 - Virtru
End-to-end email and attachment encryption using existing email (Chrome, Firefox, Outlook, Mac Mail, iOS and Android)
Install Virtru in browser, mobile device, or email application using Trusted Data Format (TDF)
When composing “flip the Virtru switch” to encrypt message and attachments
Recipients can read your message without installing software after verify identity
Sender can revoke messages at any time, see and control forwarding, set expiration dates
https://www.virtru.com/get-secure-email
2015 Cengage Learning Computing Conference
32
Slide 33 - End-To-End
End-To-End is Chrome extension to encrypt, decrypt, digital sign, and verify signed messages within the browser using OpenPGP
Built on JavaScript-based crypto library
Enables key generation, encryption, decryption, digital signature, and signature verification
https://github.com/google/end-to-end
2015 Cengage Learning Computing Conference
33
Slide 34 - Fiddler
Web Debugging - Debug traffic to ensure the proper cookies, headers and cache directives are transferred between the client and server (supports .NET, Java, Ruby, etc. framework)
Performance Testing – View HTTP caching and compression
HTTP/HTTPS Traffic Recording - Web debugging proxy that logs all HTTP(s) traffic between computer and Internet
Web Session Manipulation - Edit web sessions by setting breakpoint to pause the processing of the session and permit alteration of the request/response; can also compose own HTTP requests to run through Fiddler
http://www.telerik.com/fiddler
2015 Cengage Learning Computing Conference
34
Slide 35 - Chapter 7Network Security Fundamentals
Tools for Teaching Security+
2015 Cengage Learning Computing Conference
35
Slide 36 - Chapter 7 Projects Security+ Guide 5e
Project 7-1: Configuring the Windows Firewall
Project 7-2: Using Behavior-Based Monitoring Tools
Project 7-3: Using an Internet Content Filter
Project 7-4: Configure a Windows Client for Network Access Protection
2015 Cengage Learning Computing Conference
36
Slide 37 - GlassWire
Network monitor - Visualizes current and past network activity by traffic type, application, geographic location; can go back in time up to 30 days
Threat monitoring - Reveals hosts that are known threats, unexpected network system file changes, unusual application changes, ARP spoofing, DNS changes; can remotely monitor servers or other computers and block activity
Firewall – Shows new application or service accessing the Internet for the first time
Detailed log - Shows current and past servers communicating with
Remote server monitoring - Monitor all server network activity
Internet/Bandwidth usage monitoring - Can see amount bandwidth using; can block bandwidth hogging apps or privacy violators
Incognito mode – Prevents network activity from being logged
https://www.glasswire.com/
2015 Cengage Learning Computing Conference
37
Slide 38 - Chapter 8Administering a Secure Network
Tools for Teaching Security+
2015 Cengage Learning Computing Conference
38
Slide 39 - Chapter 8 Projects Security+ Guide 5e
Project 8-1: Using an Application Sandbox
Project 8-2: Create a Virtual Machine from a Physical Computer
Project 8-3: Load the Virtual Machine
Project 8-4: View SNMP Management Information Base (MIB) Elements
Project 8-5: Viewing Logs Using the Microsoft Windows Event Viewer
Project 8-6: Creating a Custom View in Microsoft Windows Event Viewer
Project 8-7: Creating a Subscription in Microsoft Windows Event Viewer
2015 Cengage Learning Computing Conference
39
Slide 40 - DNS Services
Recursive (not authoritative) DNS services are “middlemen” between browser and website content with offer additional functionality for both users and network administrators
Content filtering - Block adult sites and other unwanted content, while requiring no software on the computers and devices
Malware and phishing blocking - Block sites containing malware, scams and other dangerous content
Protection against botnets - Blocks communication with known botnet servers
Advertisement blocking - Another type of content filtering
URL typo correction – Change gogle.com correct to google.com
2015 Cengage Learning Computing Conference
40
Slide 41 - DNS Services
Commodo Secure DNS (https://www.comodo.com/secure-dns/)
Dyn Internet Guide (http://dyn.com/labs/dyn-internet-guide/)
Reaver implements a brute force attack against Wi-Fi Protected Setup (WPS) registrar PINs in order to recover WPA/WPA2 passphrases
On average Reaver can recover the target AP's plain text WPA/WPA2 passphrase in 4-10 hours
May only take half this time to guess the correct WPS pin and recover the passphrase
https://code.google.com/p/reaver-wps/
2015 Cengage Learning Computing Conference
52
Slide 53 - Wifiphisher
Social engineering attack that as easy way for obtaining credentials from captive portals and third party login pages or WPA/WPA2 secret passphrases.
Attack in three phases:
Victim deauthenticated from AP: Wifiphisher continuously jams all target AP devices by sending deauth packets to the client from the AP, to AP from client, and to broadcast address
Victim joins a rogue access point: Wifiphisher copies target AP settings to creates rogue AP; sets up a NAT/DHCP server and forwards the right ports so clients start connecting to the rogue AP
Victim served a realistic router configuration page: Wifiphisher sets up web server that responds to HTTP & HTTPS requests; when victim requests Internet page Wifiphisher responds with a realistic fake page that asks for credentials due to router firmware upgrade
Project 10-4: Installing Security Apps Using Bluestacks Android Emulator
2015 Cengage Learning Computing Conference
55
Slide 56 - Mobile Tracking Software
Monitoring Software
mSpy (www.mspy.com)
MobileSpy (http://www.mobile-spy.com/)
Mobistealth (http://www.mobistealth.com/)
MBL Stealth (http://www.mblstealth.com/main/)
2015 Cengage Learning Computing Conference
56
Slide 57 - Prey
Lock down devices
Delete stored passwords
https://preyproject.com/
2015 Cengage Learning Computing Conference
57
Slide 58 - Confide
Free iOS & Android app
Can send email along with an attached document/photo (Word, Excel, PowerPoint and PDF files stored on Dropbox, Box, Google Drive, OneDrive and other document-storage services) that gets encrypted
When the recipient opens it the content is blurry and unreadable
Can only be read by touching the screen, and only the line under the finger is readable
If someone snaps a picture of the screen only the one exposed line is captured (cannot see whole message at once)
When recipient finished and taps "close" message is deleted irretrievably
2015 Cengage Learning Computing Conference
58
Slide 59 - Confide
If recipient not have Confide app installed a button on the message opens the Apple App Store or Google Play Store on the Confide page so can download
Both the recipient and the sender have the ability to delete a message
Sender can change the amount of time a message will last before it self-destructs (set message to be viewable for week but change mind after sending it you can adjust life span remotely or instantly delete it
Confide for Business will have address book integration, distribution lists and other features and desktop version coming
https://getconfide.com/
2015 Cengage Learning Computing Conference
59
Slide 60 - Dstrux
Dstrux similar to Confide to send messages & documents encrypted and self-destructing
It enables sharing over Facebook or Twitter, but only a link to the secure content in the cloud is shared
Can apply controls to a message before you send it (how long before it self-destructs, whether it's blurry upon opening, if recipient can forward)
Message can be viewed, but not printed, copied, saved or captured with a screen capture
2015 Cengage Learning Computing Conference
60
Slide 61 - Dstrux
Before sending decide how long the message will last before it self-destructs (days, hours or minutes), to blur content, allow/disallow forwarding
To see a full image have to rapidly swipe all over the screen, then look fast before it vanishes
Confide more polished, Dstrux more options
https://dstrux.com/
2015 Cengage Learning Computing Conference
61
Slide 62 - Disconnect
Blocks malicious tracking and malvertising threats disguised as legitimate ads
Privacy icons - See how websites collect and use data
Disconnect - Visualize & block invisible websites that track
https://disconnect.me/disconnect
2015 Cengage Learning Computing Conference
62
Slide 63 - Other Android Apps
VT View Source – View HTML, CSS, JavaScript, XML sources of webpages and remotely located files (https://play.google.com/store/apps/details?id=com.tozalakyan.viewsource)
kWS Android Web Server - https://play.google.com/store/apps/details?id=org.xeustechnologies.android.kws
Hacker’s Keyboard – Full keyboard (https://play.google.com/store/apps/details?id=org.pocketworkstation.pckeyboard&feature=search_result)
2015 Cengage Learning Computing Conference
63
Slide 64 - Chapter 11Access Control Fundamentals
Tools for Teaching Security+
2015 Cengage Learning Computing Conference
64
Slide 65 - Chapter 11 Projects Security+ Guide 5e
Project 11-1: Using Windows Local Group Policy Editor
Project 11-2: Using Discretionary Access Control to Share Files in Windows
Project 11-3: Enabling IEEE 802.1x
Project 11-4: Explore User Account Control (UAC)
2015 Cengage Learning Computing Conference
65
Slide 66 - Chapter 12Authentication and Account Management
Tools for Teaching Security+
2015 Cengage Learning Computing Conference
66
Slide 67 - Chapter 12 Projects Security+ Guide 5e
Project 12-1: Use an Online Rainbow Table Cracker
Project 12-2: Keystroke Dynamics
Project 12-3: Download and Install a Password Management Program
682
Presentation
Video
