Sign In Start Free Trial

Book Overview & Buying
Table Of Contents
Feedback & Rating

Cybersecurity - Attack and Defense Strategies

By : Yuri Diogenes, Dr. Erdal Ozkaya

4.7 (33)

Cybersecurity - Attack and Defense Strategies

4.7 (33)

By: Yuri Diogenes, Dr. Erdal Ozkaya

Overview of this book

The book will start talking about the security posture before moving to Red Team tactics, where you will learn the basic syntax for the Windows and Linux tools that are commonly used to perform the necessary operations. You will also gain hands-on experience of using new Red Team techniques with powerful tools such as python and PowerShell, which will enable you to discover vulnerabilities in your system and how to exploit them. Moving on, you will learn how a system is usually compromised by adversaries, and how they hack user's identity, and the various tools used by the Red Team to find vulnerabilities in a system. In the next section, you will learn about the defense strategies followed by the Blue Team to enhance the overall security of a system. You will also learn about an in-depth strategy to ensure that there are security controls in each network layer, and how you can carry out the recovery process of a compromised system. Finally, you will learn how to create a vulnerability management strategy and the different techniques for manual log analysis.

Preface

Preface

Who this book is for

What this book covers

To get the most out of this book

Get in touch

Free Chapter

Security Posture

Security Posture

The current threat landscape

Cybersecurity challenges

Enhancing your security posture

The Red and Blue Team

References

Summary

Incident Response Process

Incident Response Process

Incident response process

Handling an incident

Post-incident activity

Incident response in the cloud

References

Summary

Understanding the Cybersecurity Kill Chain

Understanding the Cybersecurity Kill Chain

External reconnaissance

Access and privilege escalation

Exfiltration

Sustainment

Assault

Obfuscation

Threat life cycle management

References

Summary

Reconnaissance

Reconnaissance

External reconnaissance

Internal reconnaissance

Conclusion of the reconnaissance chapter

References

Summary

Compromising the System

Compromising the System

Analyzing current trends

Phishing

Exploiting a vulnerability

Zero-day

Performing the steps to compromise a system

References

Summary

Chasing a User's Identity

Chasing a User's Identity

Identity is the new perimeter

Strategies for compromising a user's identity

Hacking a user's identity

References

Summary

Lateral Movement

Lateral Movement

Infiltration

Performing lateral movement

References

Summary

Privilege Escalation

Privilege Escalation

Infiltration

Avoiding alerts

Performing privilege escalation

Conclusion and lessons learned

References

Summary

Security Policy

Security Policy

Reviewing your security policy

Educating the end user

Policy enforcement

Monitoring for compliance

References

Summary

Network Segmentation

Network Segmentation

Defense in depth approach

Physical network segmentation

Securing remote access to the network

Virtual network segmentation

Hybrid cloud network security

References

Summary

Active Sensors

Active Sensors

Detection capabilities

Intrusion detection systems

Intrusion prevention system

Behavior analytics on-premises

Behavior analytics in a hybrid cloud

References

Summary

Threat Intelligence

Threat Intelligence

Introduction to threat intelligence

Open source tools for threat intelligence

Microsoft threat intelligence

Leveraging threat intelligence to investigate suspicious activity

References

Summary

Investigating an Incident

Investigating an Incident

Scoping the issue

Investigating a compromised system on-premises

Investigating a compromised system in a hybrid cloud

Lessons learned

References

Summary

Recovery Process

Recovery Process

Disaster recovery plan

Live recovery

Contingency planning

Best practices for recovery

References

Summary

Vulnerability Management

Vulnerability Management

Creating a vulnerability management strategy

Implementation of vulnerability management

Best practices for vulnerability management

Implementing vulnerability management with Nessus

Flexera (Secunia) Personal Software Inspector

Conclusion

References

Summary

Log Analysis

Log Analysis

Data correlation

Operating system logs

Firewall logs

Web server logs

References

Summary

Other Books You May Enjoy

Other Books You May Enjoy

Leave a review - let other readers know what you think

Customer Reviews

4.7 (33)

5 star

81.8%

4 star

12.1%

3 star

0

2 star

3%

1 star

3%

Summary

In this chapter, you learned about the importance of data correlation while reviewing logs in different locations. You also read about relevant security-related logs in Windows and Linux.

Next, you learned how to read firewall logs using Check Point, NetScreen, iptables, and Windows Firewall as examples.

At the end of this chapter, you learned about web server logs, using IIS and Apache as examples.

As you finish reading this chapter, and this book, it's time to step back and reflect on this cybersecurity journey. It is very important to take the theory that you learned here, aligned with the practical examples that were used throughout this book, and apply it to your environment or to your customer's environment. While there is no such thing as one size fits all in cybersecurity, the lessons learned here can be used as a foundation for your future work. The...

Search

Your notes and bookmarks