Here's another in my series on reviews of the textbooks I use to teach my classes. In this case it's an A+ text from Pearson with some pretty nice online value-adds.
CompTIA® A+ 220-901 and 220-902 Cert Guide, by Mark Edward Soper
Copyright © 2017 by Pearson Education, Inc.
Early study materials for the A+ were rough and ready, often terse little volumes that assumed a lot of foreknowledge. We’ve come a long way in the 13 years I’ve held, and later taught, this certification, to the point that you can find great material in book, ebook and online course formats, covering a lot of learning styles. Mark Soper’s CompTIA® A+ 220-901 and 220-902 Cert Guide is an in-depth Cert Guide, in Pearson-speak, as opposed to their usually shorter, drill-oriented Exam Cram series. I’ve taught both formats and generally prefer the greater detail of the cert guides, but I was impressed by David Prowse’s Exam Cram ebook on this same topic.
The “value added” materials have been getting better too. Most publishers have long offered CDs with test and study materials. But as optical drives have been going out of style while online storage has come on strong, I’m seeing almost everyone leaving the CD behind, and using the CD sleeve in the back of books for a slip of paper with an Activation Code, as this book does. I initially thought, Oh, there go the goodies, but I’ve found the reverse is true. More on this below.
Prose style really matters, too. My students make loud noises if reading the text gives them headaches, which magically transfers the headaches to me. From an earlier review:
When it comes to highly technical books, there are plenty of them that are written by committee, and read like it. I’ve got nothing against a dry, factual style, but my students seem to be more willing to read single-author books with a breezier prose style. [Prowse’s] book falls into the second category, and has the kind of comfortable, personable text that makes reading 982 pages a lot less of a chore. By comparison, the 901-902 text by Mike Meyers runs 1472 pages of chatty first-person conversation, while the text from Docter, Dulaney and Skandier is 1312 pages of formal discussion (what did I say about writing by committee?).
The previous edition of this Cert Guide was written by Soper, Prowse and Scott Mueller, and was my text of choice teaching my A+ 801-802 classes. It ran to 950 pages of text, plus end material (and included a CD). In the current edition, Soper goes it alone while Prowse works on the video course and the Exam Cram book, and Mueller apparently works on the 23rd edition of his amazing Upgrading and Repairing PCs series. I wondered if the quality would suffer or improve, and if the character of the book would change, but Soper keeps up the really excellent written material thickly scattered with high-res grayscale photos, screen shots and key topics tables. Possibly to the down side, the book now contains about 1150 pages of text, plus end material. It’s still one of the shorter texts, but they are all becoming behemoths.
I have to say I like Soper’s prose. He sticks to shorter sentences and obviously has a talent for stating things clearly. There is a minority among my students who like the more chatty, informal and sometimes funny language of Meyers, but they have to be willing to make a 1500-page commitment to that book.
Chapters are laid out clearly, and divided into topics with plenty of illustrations. Every book on this topic has to decide how deeply to descend into details. Do students need to know the specifics of the latest upcoming Intel memory controller topology? The hard-core geeks are going to love it. Others are going to find those details quickly obsolete, but do need to understand how the once-literal North and South Bridges are now mostly theoretical, with chipsets doing all kinds of things differently.
What really matters is that the materials match up to the A+ test objectives, which this book does quite well. Ending each chapter are the Exam Preparation Tasks, which include memory tasks like definitions alongside exercises like using diagnostic tools to research hardware details and upgrade options. Then come Review Questions, with Answers and Explanations conveniently following. The explanations are nice, because they’re really explanations, unlike too many of the ones I see on sample tests.
One of the biggest changes for the new certification is the much-changed list of operating systems covered. XP is out, finally, but Vista lingers on, along with Windows 7, 8 and 8.1. Windows 10 is not covered. But OSX is getting a lot more discussion, which matches the workplace I see, mostly Windows but with a contingent of determined Mac users.
Here, each book handles this differently. The Exam Cram splits OS topics out among the main test topics, so there’s not one place that solely discusses Windows 7, for instance.
Docter, Dulaney and Skandier do the opposite, with 50-60 page chapters on each major OS, which might be a good idea for organization, but leads to a lot of duplicate discussions of installation and deployment, for instance.
In this book Soper manages to cover the same detail in about 35 pages each for the OSX/Linux chapter and the iOS/Android chapter, with less obvious duplication. Depending on whether you’re using the textbook later as a reference (go with duplication) or as a learning tool (don’t torture me when I have to read the whole book), this book may be the best option for students.
The most important work students can do for certification exams is taking lots of sample tests. There are resources online, of course, and many are quite good. Brain dumps, on the other hand, are worse than useless because they’ll mislead you or invite you to believe wrong answers. Note that tests and questions provided by real CompTIA Authorized Partners (like Pearson) tend to be much more realistic and closely aligned with the actual test questions, for instance the frequent use of scenario questions. There are lots of practice sites and sources of sample questions online, and students should use them – with a healthy awareness that sometimes these questions are wrong: wrongly worded, contradictory or just plain far off topic. Once you’re so advanced that you can spot these errors, generic online practice tests can be useful for learning to spot B.S.
Getting access to Pearson’s online materials takes a few steps, but isn’t any harder than registering for Facebook. You’ll download the Pearson test engine, fire it up, and use the Activation procedure to get and install the sample tests for this book. There are a total of four tests, which you can further tune to concentrate on questions by chapter/objective. Mix and match until you’ve seen every question several times. I always recommend saving at least one of these tests as a final proving challenge before taking the real certification exam; if you can ace a test you haven’t seen before, you’re likely ready for the real test.
Back in the book, there are also some memory drills, but the nicest value-add-on is the three hours of video you can watch from Prowse’s video course. They are highly worth the investment in time, I guarantee.
So I come to the things that matter when I choose a text for my A+ classes.
First, the price. At $60 this book isn’t cheap, but it’s not stratospheric for a college-level text either. Its main competitors are in the $50-60 zone.
Next, does it align closely with the CompTIA A+ Objectives? This book covers them without going in-depth on topics or technologies that will never show up on the test.
Then, how long is it? 1000 pages is tough, and 1500 pages is a huge task for my students, but few books in this area are smaller. At least this one is on the light end of the scale.
Finally, what’s it like to read the actual prose? Does it sound like it was written by an engineer or a lawyer, or is it more like a friendly discussion of interesting technology? Soper does very well in this area.
Ultimately, you can’t go wrong with this book. All by itself it’s good; with the online materials it’s top-notch. I’ll be trying it out in my next round of classes.
Disclaimer: Obviously I am a teacher, working with two major universities and many smaller clients. Some of the books I review are provided by my employers, but many of them come to me directly through my reviewer accounts with Pearson, Microsoft and Cisco (as this book did). They all know that sending me books is no guarantee mercy on my part.
* * *
Don't you hate those clickbait "10 Great Pictures of ..." or "10 Mistakes Men Make," etc. etc.?
I say, as always, consider the source. For instance, TechRepublic is a pretty darn reliable, high-quality site for the hard-core geek (and you are one if you're here reading this).
Whether trying to diagnose a single device or dealing with the urgency of a company-wide outage, there are solid best practices on what NOT to do. With that in mind, here are 10 things to avoid doing, so you can limit the pain and keep things running as smoothly as possible....
Yes! Exactly! Please show me your painful mistakes so I can wince and try to avoid them forever (at least try). Check out the list and see what you think:
* * *
I see rough issues coming for A+ students in terms of identifying the sudden proliferation of USB versions and ports, Thunderbolt versions, "alternate modes" and "multiplex modes." Consumers are going to face lots of compatibility problems, because there are so many modes: some cables do one thing, while other cables that look identical do different things. And how about Thunderbolt over USB? Nightmare is a legitimate description.
* * *
Recently my friend and fellow IT consultant Marc Mintz (Mintz Infotech, https://mintzit.com/) asked me to clarify some of what I do for his clients. Here's his question:
Glenn: I don’t know if my target market really understands pen and vulnerability testing, but since they should, I’d like to have some information for them.
I. What is Pen and Vulnerability testing
II. What are the benefits of Pen and Vulnerability testing.
III.What businesses are required to have this security testing?
IV. What is involved - what does it look like and how is your organization impacted during the process.
V.Costs, both in down time and $$$
VI. Everything else I don’t know enough to include.
So here's my response:
Often shortened to "pen testing," this is a limited subset of security analysis. In the certification world, you'll find distinctions between Pen Testers and Security Analysts, with pen testers being more glorified but analysts doing the real work.
Pen testers look for openings they can penetrate. Simple as that. Except it's not simple. The real question is, what are you testing
The critical consideration is the scope of the pen testing. For a web application, the app itself, its hosting and its web server software would be the scope. Notice that this is very limited: it does not include, for instance, any email services that may be involved - and may be critical.
For a corporate network, the scope might include all external IP addresses, all external email, chat, messaging, voicemail and VOIP services, all hosting arrangements, all data network providers - or only a subset of these, or even perhaps far more than these, depending on the proposed scope of the pen test.
PEN TESTING, VULNERABILITY TESTING AND SECURITY ANALYSIS
Are you just looking for potential vulnerable points, or are you actually trying to perform a penetration? These are two very different things. Real pen testing might actually bring your business down (I might break things trying to get in), while simply scanning for vulns shouldn't (unless badly done, which is a real possibility). But finding a list of vulns does *not* actually determine if your business can be penetrated; in fact, thinking you're safe if you fix that list is a big vulnerability of its own.
If you really want to know that you're cast-iron set-in-concrete secure, turn me loose to do full pen testing, and I'll let 'er rip. I'll find a hole somewhere, in the network layers or at the human layer (depending on scope). Hardly anyone actually does this except the government. Most people want vuln testing, which gives them a solid to-do list of things to fix. This is the way to go for proof of compliance or due diligence or similar legal concepts. Security? You likely get a little security out of vuln testing, though not as much as some people think. But if you're really getting ferocious about security, you want something much deeper generally called security analysis. A security analyst might note, for instance, that your firewall device has a hardware fault or your email server is an open relay, and that you should fix them.
There are somewhat similar requirements across several industries, but of course specifics have to be slavishly followed. For HIPAA-compliant organizations, an annual Risk Analysis includes things like pen testing, auditing and user training. For schools, for the most part, they only need to deal with simple records storage security under FERPA. Military and mil-contractor organizations, on the other hand, have to follow FIPS guidelines, which require frequent and fearsome pen testing. Business and financial outfits have various Dodd-Frank and Gramm–Leach–Bliley security requirements that include risk analysis, which in turn includes pen testing, user training, auditing and so much more.
My point is that pen testing is one tool in the box for proof of compliance, but it's not the only one. Not by a long shot.
Any hacker worth his/her salt is going to work in ways they hope they won't be detected, assuming data theft is the goal. Pen testing, on the other hand, is frequently (dismayingly) done during business hours, very much to the detriment of the business's operations. That's why I see statements in contracts like "testing must be halted immediately if the customer's operations are affected." I'm sorry, but this is ignorant.
On the other hand, denial of service is a legitimate goal, though you don't really want to test it. You'll just be testing the resilience of your data and hosting providers' networks, and that is a very big no-no. Pen testing that results in DOS, then, is extremely, specifically bad. If you're signing a contract for pen testing, make sure it includes provisions that testing be done during non-business hours, if you have off hours.
Costs are always an issue of balance: What does it cost you to fail to comply? You'd better be very clear on your legal requirements to answer that question. What does it cost you to audit or pen test? Probably, but not certainly, less. The issue is that you're not playing poker, where there are odds and perhaps sustainable losses. You're playing Russian roulette, where loss means the potential for total destruction of your business or even more devastating losses for your customers, clients or patients. If you think I'm trying to scare you to lessen any sticker shock, I am.
For a full-scale, mil-spec pen test against a large organization, expect price tags somewhere in the $15,000-25,000 (each) range for mandatory thrice-annual tests. The critical thing here is that setup is the biggest expense (i.e. takes the longest time), so a single-incident pen test for a smaller business could easily approach or surpass this price tag, depending on the scope of testing. This makes understanding your scope, which is to say your compliance requirements, the critical point.
Even more, because pen testers are in strong demand, at least in certain sectors, most of them don't want to deal with smaller businesses. The risks aren't worth the legal issues, which are substantial. This means those smaller orgs are often better served by training internal staff to perform pen testing than they are by hiring outside contractors. In some cases this doesn't fulfill legal requirements for testing to be performed by a separate institution, but if you're at a scale that requires full-scale external-provider pen testing for compliance, you already know this.
The landscape is changing very rapidly here. If you're hosting all your servers and services internally, serious pen testing could temporarily shatter your working infrastructure. Do not ask me how I know this. In some situations this in unavoidable because extreme security or data location requirements force you to do your own hosting this way.
On the other hand, if you're utilizing contemporary infrastructure there's no reason you should have significant or any downtime. Host your documentation on Google and your pen tester is testing Google, not you (which will get them in some serious trouble). Host your servers on Amazon and they're testing Amazon's cloud resiliency, and asking for some very unwelcome attention.
Yes, keep your secret sauce on your own hardware, but otherwise don't run your own steam engines, generators or servers. Don't worry, though. One round of pen testing (really, vuln testing) will show you where the easy openings are. Just remember that if your pen testers bring you down during operating hours, they're doing their job poorly (with the notable exception of 24-hour operations).
Marc is, and you, gentle reader, are also welcome to contact me if you have questions, want to know more, or need pen testing or training services.
* * *
One major Hacker Highschool lesson we projected was Lesson 22, Cyberbullying. At SchoolforHackers.com we'll move forward at a much faster pace on this issue, particularly if we keep getting good submissions.
Material dealing with cyberbullying is available by the ton on the Internet, but as with all subjects, separating the wheat from the chaff is difficult.
Some authorities suggest reporting bullying immediately; here in New Mexico, that will get you branded as a snitch, which will not be good for your future health. Others suggest turning the tables and finding ways to turn the brutality back on the bully. While this may be satisfying, it also simply perpetuates bullying.
How about one of the popular trends in training, "game-ification?" WiredSafety.org is trying this approach, as Hope Gillette reports on Voxxi.com:
Alex Wonder Kid Cyberdetective is a new game introduced by WiredSafety.org designed to help children safely navigate the Internet. Children follow the adventures of Alex Wonder as he helps children learn to identify the warning signs of cyberbullying and learn how to responsibly use the Internet.
The basic technique is "stop, block and tell." I personally become immediately skeptical, for the reason I mention above. But the game-based learning style may be effective. You can download the game from StopCyberbullying.org; it requires that Adobe Air be installed.
If you give it a try please drop me a line and tell me what you think.
The people at CallerSmart.com have an interesting piece, "What is Cyberbullying and How to Stop It" (https://www.callersmart.com/articles/49/What-Is-Cyberbullying-and-How-to-Stop-It). There are some excellent charts about the laws on bullying and sexting in the different US states, and my particular interest, some discussion of tactics for dealing with bullying.
My question to my readers is: Will these methods work? Do you know of any, or of better ones? Register to comment on SchoolforHackers.com and tell us what you think.
- Tech in the Workplace
- Pete Herzog removed my name as contributor from the Hacker Highschool lessons!
- OSSTMM Links and Information
- Contributor Article: Business Networking and job search aggregators like Nuevoo
- [ Book Review ] :: A+ Exam Cram from David Prowse, eBook Version
- [ Book Review ] :: Pearson IT Certification CompTIA A+ 220-901 Complete Video Course
- [ Book Review ] :: CISSP Training Kit (Microsoft Press Training Kit) 1st Edition
- [ Hacking Tools ] : sqlmap
- A dictionary of Unix commands
- Playing with the Raspberry Pi