CompTIA Security+ Guide to Network Security Fundamentals, 8th Edition

Mark Ciampa

Copyright 2025
{{checkPublicationMessage('Published', '2024-01-01T00:00:00+0000')}}

Starting At £53.00 See pricing and ISBN options

Instructor Next Steps

Students: Buy now

CompTIA Security+ Guide to Network Security Fundamentals 8th Edition by Mark Ciampa

Quick Navigation

Overview
Meet the Author
Features
Table of Contents
Pricing

Overview

Mapped to the new CompTIA Security+ SY0-701 Certification Exam, Ciampa's COMPTIA SECURITY+ GUIDE TO NETWORK SECURITY FUNDAMENTALS, 8th Edition, thoroughly prepares readers for professional certification and career success. The text covers general security concepts, threats, vulnerabilities and mitigations, security architecture, security operations and security program management and oversight. It also includes expansive coverage of attack vectors and attack surfaces, social engineering attacks, data controls, endpoint vulnerabilities and defenses, identity and access management, infrastructure and wireless security, cloud and virtualization security, artificial intelligence and vulnerability management. New Hands-On Projects, case activities and virtual online cybersecurity lab exercises help readers put what they learn into practice.

Meet the Authors

{{collapseContainerClosed['meet-the-author'] ? 'Show More' : 'Show Less'}}

Mark Ciampa

Dr. Mark Ciampa is a professor of information systems in the Gordon Ford College of Business at Western Kentucky University in Bowling Green, Kentucky. Prior to this current role, he served as an associate professor and the director of academic computing at Volunteer State Community College in Gallatin, Tennessee, for 20 years. Dr. Ciampa has worked in the IT industry as a computer consultant for businesses, government agencies and educational institutions. He has published more than 20 articles in peer-reviewed journals and has written more than 25 technology textbooks, including CompTIA CySA+ Guide to Cybersecurity Analyst, Security+ Guide to Network Security Fundamentals, Security Awareness: Applying Practical Security in Your World, CWNA Guide to Wireless LANS, and Guide to Wireless Communications. Dr. Ciampa holds a Ph.D. in technology management with a specialization in digital communication systems from Indiana State University and has certifications in security and healthcare.

Features

{{collapseContainerClosed['features'] ? 'Show More' : 'Show Less'}}

This text is completely revised and updated with expanded coverage on attacks and defenses, helping instructors teach the most current cybersecurity information.
New module units: Security Foundations, Cryptography, Device Security, Infrastructure and Architectures and Operations and Management help instructors and students cover topics in an easy-to-understand sequencing.
All new “#TrendingCyber” openers in each module help generate student interest with real-world examples that relate to the module’s content.
All new Two Rights & a Wrong self-assessments help students quickly assess their understanding of the topics.
All new live virtual machine labs help students refine the hands-on skills needed to master today’s cybersecurity toolset and learn hands-on skills in a live environment.
New and updated Hands-On Projects cover some of the latest security software and help demonstrate the topics covered in the modules.
All new introductions to the Hands-On Projects and Case Projects provide time estimates, objectives and project descriptions and help students and instructors understand the purpose of the activity and the length of time required to complete.
A new sequencing of modules helps facilitate learning with a scaffolding approach to ensure that foundational topics are covered first in order to form the basis for more advanced topics later.
An updated module on “Identity and Access Management (IAM)” teaches the latest password attacks and new defensive technologies such as passwordless systems, ensuring that students are up to date with the latest material.
A new module that includes “Security Operations” covers automation, orchestration, threat hunting and artificial intelligence as they apply to information security. This advanced material occurs later in the sequence of modules to provide advanced material for students to understand how security is applied in an enterprise-level security operations center (SOC).
Updated Live Virtual Machine Labs within MindTap give learners hands-on practice troubleshooting, exploring and trying different solutions in a safe, sandbox environment using real hardware and virtualized operating systems.
All content is up to date and mapped to the new CompTIA Security+ SY0-701 exam through highlighted chapter certification icons, a detailed mapping grid and a quick reference guide.
Helping instructors and students maximize course success, numerous special features throughout the text support effective teaching and learning, including review questions, illustrations of security vulnerabilities, attacks and defenses, case studies highlighting real-world security scenarios and hands-on projects that enable readers to apply what they have learned to real-life practice.
Ciampa's clear, engaging writing style makes even difficult concepts and complex processes easier for readers to understand, making the text an ideal resource for classroom instruction, self-paced learning or professional reference.

{{collapseContainerClosed['table-of-contents'] ? 'Show More' : 'Show Less'}}

I. SECURITY FOUNDATIONS.
1. Introduction to Information Security.
a. What is Information Security?
i. Understanding Security.
ii. Principles of Security.
iii. Cybersecurity Versus Information Security.
iv. Defining Information Security.
b. Threat actors and Their Motivations.
i. Unskilled Attackers.
ii. Shadow IT.
iii. Organized Crime.
iv. Insider Threats.
v. Hacktivists.
vi. Nation-state Actors.
vii. Other Threat Actors.
c. How Attacks Occur.
i. Threat Vectors and Attack Surfaces.
ii. Categories of Vulnerabilities.
iii. Impacts of Attacks.
d. Information Security Resources.
i. Frameworks.
ii. Regulations.
iii. Legislation.
iv. Standards.
v. Benchmarks/Secure Configuration Guides.
vi. Information Sources.
2. Pervasive Attack Surfaces and Controls.
a. Social Engineering Attacks.
i. Examples of Human Manipulation.
ii. Types of Social Engineering Attacks.
b. Physical Security Controls.
i. Perimeter Defenses.
ii. Preventing Data Leakage.
iii. Computer Hardware Security.
c. Data Controls.
i. Data Classifications.
ii. Types of Data.
iii. Data Breach Consequences.
iv. Protecting Data.
II. CRYPTOGRAPHY.
3. Fundamentals of Cryptography.
a. Defining Cryptography.
i. Steganography: Hiding the message.
ii. Cryptography: Hiding the meaning.
iii. Benefits of Cryptography.
b. Cryptographic Algorithms.
i. Variations of Algorithms.
ii. Hash Algorithms.
iii. Symmetric Cryptographic Algorithms.
iv. Asymmetric Cryptographic Algorithms.
c. Using Cryptography.
i. Encryption Through Software.
ii. Hardware Encryption.
iii. Blockchain.
d. Cryptographic Limitations and Attacks.
i. Limitations of Cryptography.
ii. Attacks on Cryptography.
4. Advanced Cryptography.
a. Digital Certificates.
i. Defining Digital Certificates.
ii. Managing Digital Certificates.
iii. Types of Digital Certificates.
b. Public Key Infrastructure (PKI).
i. What is Public Key Infrastructure (PKI)?
ii. Trust Models.
iii. Managing PKI.
iv. Key Management.
c. Secure Communication and Transport Protocols.
i. Transport Layer Security (TLS).
ii. IP Security (IPSec).
iii. Other Protocols.
d. Implementing Cryptography.
i. Key Strength.
ii. Secret Algorithms.
iii. Block Cipher Modes of Operation.
III. DEVICE SECURITY.
5. Endpoint Vulnerabilities, Attacks, and Defenses.
a. Malware Attacks.
i. Kidnap.
ii. Eavesdrop.
iii. Masquerade.
iv. Launch.
v. Sidestep.
vi. Indicator of Attack (IoA).
b. Application Vulnerabilities and Attacks.
i. Application Vulnerabilities.
ii. Application Attacks.
c. Securing Endpoint Devices.
i. Protecting Endpoints.
ii. Hardening Endpoints.
6. Mobile and Embedded Device Security.
a. Securing Mobile Devices.
i. Introduction to Mobile Devices.
ii. Mobile Device Risks.
iii. Protecting Mobile Devices.
b. Embedded Systems and Specialized Devices.
i. Types of Devices.
ii. Security Considerations.
c. Application Security.
i. Application Development Concepts.
ii. Secure Coding Techniques.
iii. Code Testing.
7. Identity and Access Management (IAM).
a. Types of Authentication Credentials.
i. Something You Know: Passwords.
ii. Something You Have: Tokens and Security Keys.
iii. Something You Are: Biometrics.
iv. Something You Do: Behavioral biometrics.
b. Authentication Best Practices.
i. Securing Passwords.
ii. Secure Authentication Technologies.
c. Access Controls.
i. Access Control Schemes.
ii. Access Control Lists.
IV. INFRASTRUCTURE AND ARCHITECTURES.
8. Infrastructure Threats and Security Monitoring.
a. Attacks on Networks.
i. On-Path Attacks.
ii. Domain Name System (DNS) Attacks.
iii. Distributed Denial of Service (DDoS).
iv. Malicious Coding and Scripting Attacks.
v. Layer 2 Attacks.
vi. Credential Relay Attacks.
b. Security Monitoring and Alerting.
i. Monitoring Methodologies.
ii. Monitoring Activities.
iii. Tools for Monitoring and Alerting.
c. Email Monitoring and Security.
i. How Email Works.
ii. Email Threats.
iii. Email Defenses.
9. Infrastructure Security.
a. Security Appliances.
i. Common Network Devices.
ii. Infrastructure Security Hardware.
b. Software Security Protections.
i. Web Filtering.
ii. DNS Filtering.
iii. File Integrity Monitoring (FIM).
iv. Extended Protection and Response.
c. Secure Infrastructure Design.
i. What is Secure Infrastructure Design?
ii. Virtual LANs (VLANs).
iii. Demilitarized Zone (DMZ).
iv. Zero Trust.
d. Access Technologies.
i. Virtual Private Network (VPN).
ii. Network Access Control (NAC).
10. Wireless Network Attacks and Defenses.
a. Wireless Attacks.
i. Cellular Networks.
ii. Bluetooth Attacks.
iii. Near Field Communication (NFC) Attacks.
iv. Radio Frequency Identification (RFID) Attacks.
v. Wireless Local Area Network Attacks.
b. Vulnerabilities of WLAN Security.
i. Wired Equivalent Privacy (WEP).
ii. Wi-Fi Protected Setup (WPS).
iii. MAC Address Filtering.
iv. Wi-Fi Protected Access (WPA).
c. Wireless Security Solutions.
i. Wi-Fi Protected Access 2 (WPA2).
ii. Wi-Fi Protected Access 3 (WPA3).
iii. Additional Wireless Security Protections.
11. Cloud and Virtualization Security.
a. Introduction to Cloud Computing.
i. What is Cloud Computing?
ii. Types of Clouds.
iii. Cloud Locations.
iv. Cloud Architecture.
v. Cloud Models.
vi. Cloud Management.
vii. Cloud-native Microservices.
b. Cloud Computing Security.
i. Cloud-based Security.
ii. Cloud Vulnerabilities.
iii. Cloud Security Controls.
c. Virtualization Security.
i. Defining Virtualization.
ii. Infrastructure as Code.
iii. Security Concerns for Virtual Environments.
V. OPERATIONS AND MANAGEMENT.
12. Vulnerability Management.
a. Vulnerability Scanning.
i. Vulnerability Scan Basics.
ii. Sources of Threat Intelligence.
iii. Scanning Decisions.
iv. Running a Vulnerability Scan.
v. Analyzing Vulnerability Scans.
vi. Addressing Vulnerabilities.
b. Audits and Assessments.
i. Internal Audits.
ii. External Assessments.
iii. Penetration Testing.
13. Incident Preparation and Investigation.
a. Preparatory Plans.
i. Business Continuity Planning.
ii. Incident Response Planning.
b. Resilience Through Redundancy.
i. Servers.
ii. Drives.
iii. Networks.
iv. Power.
v. Sites.
vi. Clouds.
vii. Data.
c. Incident Investigation.
i. Data Sources.
ii. Digital forensics.
14. Oversight and Operations.
a. Administration.
i. Governance.
ii. Compliance.
b. Security Operations.
i. Automation.
ii. Orchestration.
iii. Threat Hunting.
iv. Artificial Intelligence.
15. Information Security Management.
a. Asset Protection.
i. Asset Management.
ii. Change Management.
b. Risk Management.
i. Defining Risk.
ii. Analyzing Risks.
iii. Managing Risks.