Cybersecurity – Attack and Defense Strategies电子书

Title Page

Copyright and Credits

Cybersecurity – Attack and Defense Strategies

Packt Upsell

Why subscribe?

PacktPub.com

Contributors

About the authors

About the reviewers

Packt is searching for authors like you

Preface

Who this book is for

What this book covers

To get the most out of this book

Download the color images

Conventions used

Get in touch

Reviews

Security Posture

The current threat landscape

The credentials – authentication and authorization

Apps

Data

Cybersecurity challenges

Old techniques and broader results

The shift in the threat landscape

Enhancing your security posture

The Red and Blue Team

Assume breach

References

Summary

Incident Response Process

Incident response process

Reasons to have an IR process in place

Creating an incident response process

Incident response team

Incident life cycle

Handling an incident

Best practices to optimize incident handling

Post-incident activity

Real-world scenario

Lessons learned

Incident response in the cloud

Updating your IR process to include cloud

References

Summary

Understanding the Cybersecurity Kill Chain

External reconnaissance

Scanning

NMap

Metasploit

John the Ripper

THC Hydra

Wireshark

Aircrack-ng

Nikto

Kismet

Cain and Abel

Access and privilege escalation

Vertical privilege escalation

Horizontal privilege escalation

Exfiltration

Sustainment

Assault

Obfuscation

Threat life cycle management

References

Summary

Reconnaissance

External reconnaissance

Dumpster diving

Social media

Social engineering

Pretexting

Diversion theft

Phishing

Phone phishing (vishing)

Spear phishing

Water holing

Baiting

Quid pro quo

Tailgating

Internal reconnaissance

Sniffing and scanning

Prismdump

tcpdump

NMap

Wireshark

Scanrand

Cain and Abel

Nessus

Metasploit

Aircrack-ng

Wardriving

Conclusion of the reconnaissance chapter

References

Summary

Compromising the System

Analyzing current trends

Extortion attacks

Data manipulation attacks

IoT device attacks

Backdoors

Mobile device attacks

Hacking everyday devices

Hacking the cloud

Phishing

Exploiting a vulnerability

Zero-day

Fuzzing

Source code analysis

Types of zero-day exploits

Buffer overflows

Structured exception handler overwrites

Performing the steps to compromise a system

Deploying payloads

Installing and using a vulnerability scanner

Using Metasploit

Compromising operating systems

Compromising systems using Kon-Boot or Hiren's BootCD

Compromising systems using a Linux Live CD

Compromising systems using preinstalled applications

Compromising systems using Ophcrack

Compromising a remote system

Compromising web-based systems

SQL injection

Cross-site scripting

Broken authentication

DDoS attacks

References

Summary

Chasing a User's Identity

Identity is the new perimeter

Strategies for compromising a user's identity

Gaining access to the network

Harvesting credentials

Hacking a user's identity

Brute force

Social engineering

Pass the hash

Other methods to hack identity

References

Summary

Lateral Movement

Infiltration

Network mapping

Avoiding alerts

Performing lateral movement

Port scans

Sysinternals

File shares

Remote Desktop

PowerShell

Windows Management Instrumentation

Scheduled tasks

Token stealing

Pass-the-hash

Active Directory

Remote Registry

Breached host analysis

Central administrator consoles

Email pillaging

References

Summary

Privilege Escalation

Infiltration

Horizontal privilege escalation

Vertical privilege escalation

Avoiding alerts

Performing privilege escalation

Exploiting unpatched operating systems

Access token manipulation

Exploiting accessibility features

Application shimming

Bypassing user account control

DLL injection

DLL search order hijacking

Dylib hijacking

Exploration of vulnerabilities

Launch daemon

Hands-on example of privilege escalation on a Windows 8 target

Conclusion and lessons learned

References

Summary

Security Policy

Reviewing your security policy

Educating the end user

Social media security guidelines for users

Security awareness training

Policy enforcement

Application whitelisting

Hardening

Monitoring for compliance

References

Summary

Network Segmentation

Defense in depth approach

Infrastructure and services

Documents in transit

Endpoints

Physical network segmentation

Discovering your network

Securing remote access to the network

Site-to-site VPN

Virtual network segmentation

Hybrid cloud network security

References

Summary

Active Sensors

Detection capabilities

Indicators of compromise

Intrusion detection systems

Intrusion prevention system

Rule-based detection

Anomaly-based detection

Behavior analytics on-premises

Device placement

Behavior analytics in a hybrid cloud

Azure Security Center

References

Summary

Threat Intelligence

Introduction to threat intelligence

Open source tools for threat intelligence

Microsoft threat intelligence

Azure Security Center

Leveraging threat intelligence to investigate suspicious activity

References

Summary

Investigating an Incident

Scoping the issue

Key artifacts

Investigating a compromised system on-premises

Investigating a compromised system in a hybrid cloud

Search and you shall find it

Lessons learned

References

Summary

Recovery Process

Disaster recovery plan

The disaster recovery planning process

Forming a disaster recovery team

Performing risk assessment

Prioritizing processes and operations

Determining recovery strategies

Collecting data

Creating the disaster recovery plan

Testing the plan

Obtaining approval

Maintaining the plan

Challenges

Live recovery

Contingency planning

IT contingency planning process

Development of the contingency planning policy

Conducting business impact analysis

Identifying the critical IT resources

Identifying disruption impacts

Developing recovery priorities

Identifying the preventive controls

Developing recovery strategies

Backups

Alternative sites

Equipment replacement

Plan testing, training, and exercising

Plan maintenance

Best practices for recovery

References

Summary

Vulnerability Management

Creating a vulnerability management strategy

Asset inventory

Information management

Risk assessment

Scope

Collecting data

Analysis of policies and procedures

Vulnerability analysis

Threat analysis

Analysis of acceptable risks

Vulnerability assessment

Reporting and remediation tracking

Response planning

Vulnerability management tools

Asset inventory tools

Peregrine tools

LANDesk Management Suite

StillSecure

Foundstone's Enterprise

Information management tools

Risk assessment tools

Vulnerability assessment tools

Reporting and remediation tracking tools

Response planning tools

Implementation of vulnerability management

Best practices for vulnerability management

Implementing vulnerability management with Nessus

Flexera (Secunia) Personal Software Inspector

Conclusion

References

Summary

Log Analysis

Data correlation

Operating system logs

Windows logs

Linux logs

Firewall logs

Web server logs

References

Summary

Other Books You May Enjoy

Leave a review - let other readers know what you think