CompTIA Security+ Quotes

“A clean desk policy directs users to keep their areas organized and free of papers. The primary security goal is to reduce threats of security incidents by ensuring the protection of sensitive data.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“Wildcard certificates use a * for child domains to reduce the administrative burden of managing certificates.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“Key escrow is the process of placing a copy of a private key in a safe environment. This is useful for recovery.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“A digital signature is an encrypted hash of a message.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“Perfect forward secrecy is an important characteristic that ephemeral keys comply with in asymmetric encryption. Perfect forward secrecy indicates that a cryptographic system generates random public keys for each session and it doesn’t use a deterministic algorithm to do so. In other words, given the same input, the algorithm will create a different public key. This helps ensure that systems do not reuse keys.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“by adding redundancy into your systems and networks, you can increase the reliability of your systems even when they fail. By increasing reliability, you increase one of the core security goals: availability.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“security is never finished.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“A threat vector (also called an attack vector) refers to the method used to activate the threat”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“Amazon will use the session ID to identify the user and enhance the browsing experience. However, if the user makes a purchase, Amazon requires the user to authenticate again.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“The smurf attack spoofs the source IP. If the source IP address isn’t changed, the computer sending out the broadcast ping will get flooded with the ICMP replies. Instead, the smurf attack substitutes the source IP with the IP address of the victim, and the victim gets flooded with these ICMP replies.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“A beacon is a link included in the email that links to an image stored on an Internet server. The link includes unique code that identifies the receiver’s email address. For the email application to display the image, it must retrieve the image from the Internet server. When the server hosting the image receives the request, it logs the user’s email address, indicating it’s valid. This is one of the reasons that most email programs won’t display images by default.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“Stuxnet is a computer worm designed to attack a specific embedded system, used in one of Iran’s nuclear enrichment facilities. It caused centrifuges to spin fast enough to tear themselves apart and some reports indicated it destroyed as many 20 percent of these centrifuges.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“VM escape is an attack that allows an attacker to access the host system from within the virtual system.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“In an IV attack, the attacker uses packet injection, increasing the number of packets to analyze, and discovers the encryption key.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“disabling the SSID makes it a little more difficult for attackers to find your network, but not much. It’s almost like locking the front door of your house, but leaving the key in the lock.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“This is like a friend extending his hand to shake hands with you, you extending your hand in response, and then, at the last instant, the friend pulls his hand away. Although you or I would probably stop extending our hand back to someone doing this, the server doesn’t know any better and keeps answering every SYN packet with a SYN/ACK packet.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“Please Do Not Throw Sausage Pizza Away” (for Physical, Data Link, Network, Transport, Session, Presentation, and Application).”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“The Secretary of Defense directed members of different services to “secure that building.” Navy personnel turned off the lights and locked the doors. The Army occupied the building and ensured no one could enter. The Marines attacked it, captured it, and set up defenses to hold it. The Air Force secured a two-year lease with an option to buy.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“ARP poisoning uses ARP packets to give clients false hardware address updates and attackers use it to redirect or interrupt network traffic.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“A credential is a collection of information that provides an identity (such as a username) and proves that identity (such as with a password).”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“The card doesn’t require its own power source. Instead, the electronics in the card include a capacitor and a coil that can accept a charge from the proximity card reader. When you pass the card close to the reader, the reader excites the coil and stores a charge in the capacitor. Once charged, the card transmits the information to the reader using a radio frequency.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“Hardening is the practice of making a system or application more secure than its default configuration.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“HOTP and TOTP are both open source standards used to create one-time use passwords. HOTP creates a one-time use password that does not expire. TOTP creates a one-time password that expires after 30 seconds.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“When implementing password history, it’s best to include a minimum password age setting.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“Creating Strong Passwords One method used to make passwords more secure is to require them to be strong. A strong password is at least eight characters in length, doesn’t include words found in a dictionary or any part of a user’s name, and combines three of the four following character types: Uppercase characters (26 letters A–Z) Lowercase characters (26 letters a–z) Numbers (10 numbers 0–9) Special characters (32 printable characters, such as !, $, and *) A complex password uses multiple character types, such as Ab0@. However, a complex password isn’t necessarily strong. It also needs to be sufficiently long. It’s worth noting that recommendations for the best length of a strong password vary depending on the type of account.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“Identity proofing is the process of verifying that people are who they claim to be prior to issuing them credentials, or if they later lose their credentials.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“Risk is the likelihood that a threat will exploit a vulnerability. Risk mitigation reduces the chances that a threat will exploit a vulnerability, or reduces the impact of the risk, by implementing security controls.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“Some basic guidelines are: Don’t click on links within emails from unknown sources (no matter how curious you might be). Don’t open attachments from unknown sources (malware can be embedded into many different files, such as Portable Document Format (PDF) files, Word documents, Zip files, and more). Be wary of free downloads from the Internet (Trojans entice you with something free but include malware). Limit information you post on social media sites (criminals use this to answer password reset questions). Back up your data regularly (unless you’re willing to see it disappear forever). Keep your computer up to date with current patches (but beware of zero-day exploits). Keep antivirus software up to date (but don’t depend on it to catch everything).”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“Educating users about new viruses, phishing attacks, and zero-day exploits helps prevent incidents. Zero-day exploits take advantage of vulnerabilities that aren’t known by trusted sources, such as operating system vendors and antivirus vendors.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

“The most effective protection against unwanted adware is the use of pop-up blockers in web browsers. Many pop-up blockers support lists of URLs that allow pop-ups.”
― Darril Gibson, CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide