Computer security Books
John Wiley & Sons Inc ISC2 CCSP Certified Cloud Security Professional
Book SynopsisTable of ContentsIntroduction xv Chapter 1 Domain 1: Cloud Concepts, Architecture, and Design 1 Chapter 2 Domain 2: Architecture and Design 23 Chapter 3 Domain 3: Cloud Platform and Infrastructure Security 45 Chapter 4 Domain 4: Cloud Application Security 65 Chapter 5 Domain 5: Cloud Security Operations 85 Chapter 6 Domain 6: Legal, Risk, and Compliance 105 Chapter 7 Practice Test 1 125 Chapter 8 Practice Test 2 151 Appendix Answers to Review Questions 175 Chapter 1: Domain 1: Cloud Concepts, Architecture, and Design 176 Chapter 2: Domain 2: Architecture and Design 188 Chapter 3: Domain 3: Cloud Platform and Infrastructure Security 198 Chapter 4: Domain 4: Cloud Application Security 213 Chapter 5: Domain 5: Cloud Security Operations 223 Chapter 6: Domain 6: Legal, Risk, and Compliance 232 Chapter 7: Practice Test 1 245 Chapter 8: Practice Test 2 259 Index 273
£27.99
Pearson Education Computer Security Principles and Practice Global
Book SynopsisDr. William Stallings has authored 19 titles and, counting revised editions, more than 40 books on computer security, computer networking and computer architecture. His writings have appeared in numerous publications, including the Proceedings of the IEEE, ACM Computing Reviews and Cryptologia. He has 13 times received the award for the best Computer Science textbook of the year from the Text and Academic Authors Association. In over 30 years in the field, he has been a technical contributor, technical manager and an executive with several high-technology firms. He has designed and implemented both TCP/IP-based and OSI-based protocol suites on a variety of computers and operating systems, ranging from microcomputers to mainframes. As a consultant, he has advised government agencies, computer and software vendors, and major users on the design, selection and use of networking software and products. He created and maintains the
£71.24
Scribe Publications The Devil Takes Bitcoin
£10.44
Union Square & Co. Internet Password Keeper
Book SynopsisKeep all your passwords, usernames and web addresses together in this easy-to-use logbook, which also features important tips from an internet security expert.
£11.01
John Wiley & Sons Inc DataDriven Security
Book SynopsisUncover hidden patterns of data and respond with countermeasures Security professionals need all the tools at their disposal to increase their visibility in order to prevent security breaches and attacks. This careful guide explores two of the most powerful data analysis and visualization. You''ll soon understand how to harness and wield data, from collection and storage to management and analysis as well as visualization and presentation. Using a hands-on approach with real-world examples, this book shows you how to gather feedback, measure the effectiveness of your security methods, and make better decisions. Everything in this book will have practical application for information security professionals. Helps IT and security professionals understand and use data, so they can thwart attacks and understand and visualize vulnerabilities in their networks Includes more than a dozen real-world examples and hands-on exercises that demonstrate hTable of ContentsIntroduction xv Chapter 1 The Journey to Data-Driven Security 1 A Brief History of Learning from Data 2 Nineteenth Century Data Analysis 2 Twentieth Century Data Analysis 3 Twenty-First Century Data Analysis 4 Gathering Data Analysis Skills 5 Domain Expertise 6 Programming Skills 8 Data Management 10 Statistics 12 Visualization (aka Communication) 14 Combining the Skills 15 Centering on a Question 16 Creating a Good Research Question 17 Exploratory Data Analysis 18 Summary 18 Recommended Reading 19 Chapter 2 Building Your Analytics Toolbox: A Primer on Using R and Python for Security Analysis 21 Why Python? Why R? And Why Both? 22 Why Python? 23 Why R? 23 Why Both? 24 Jumpstarting Your Python Analytics with Canopy 24 Understanding the Python Data Analysis and Visualization Ecosystem 25 Setting Up Your R Environment 29 Introducing Data Frames 33 Organizing Analyses 36 Summary 37 Recommended Reading 38 Chapter 3 Learning the "Hello World" of Security Data Analysis 39 Solving a Problem 40 Getting Data41 Reading In Data 43 Exploring Data 47 Homing In on a Question 58 Summary 70 Recommended Reading 70 Chapter 4 Performing Exploratory Security Data Analysis 71 Dissecting the IP Address73 Representing IP Addresses 73 Segmenting and Grouping IP Addresses 75 Locating IP Addresses 77 Augmenting IP Address Data80 Association/Correlation, Causation, and Security Operations Center Analysts Gone Rogue 86 Mapping Outside the Continents90 Visualizing the ZeuS Botnet 92 Visualizing Your Firewall Data 98 Summary 100 Recommended Reading101 Chapter 5 From Maps to Regression 103 Simplifying Maps 105 How Many ZeroAccess Infections per Country? 108 Changing the Scope of Your Data 111 The Potwin Effect 113 Is This Weird? 117 Counting in Counties 120 Moving Down to Counties 122 Introducing Linear Regression 125 Understanding Common Pitfalls in Regression Analysis 130 Regression on ZeroAccess Infections 131 Summary 136 Recommended Reading 136 Chapter 6 Visualizing Security Data 137 Why Visualize? 138 Unraveling Visual Perception 139 Understanding the Components of Visual Communications 144 Avoiding the Third Dimension 144 Using Color 146 Putting It All Together 148 Communicating Distributions 154 Visualizing Time Series 156 Experiment on Your Own 157 Turning Your Data into a Movie Star 158 Summary 159 Recommended Reading 160 Chapter 7 Learning from Security Breaches 161 Setting Up the Research 162 Considerations in a Data Collection Framework 164 Aiming for Objective Answers 164 Limiting Possible Answers 164 Allowing "Other," and "Unknown" Options 164 Avoiding Conflation and Merging the Minutiae 165 An Introduction to VERIS 166 Incident Tracking 168 Threat Actor 168 Threat Actions 169 Information Assets 173 Attributes 173 Discovery/Response 176 Impact 176 Victim 177 Indicators 179 Extending VERIS with Plus 179 Seeing VERIS in Action 179 Working with VCDB Data 181 Getting the Most Out of VERIS Data 185 Summary 189 Recommended Reading 189 Chapter 8 Breaking Up with Your Relational Database 191 Realizing the Container Has Constraints 195 Constrained by Schema 196 Constrained by Storage 198 Constrained by RAM 199 Constrained by Data 200 Exploring Alternative Data Stores 200 BerkeleyDB 201 Redis 203 Hive 207 MongoDB 210 Special Purpose Databases 214 Summary 215 Recommended Reading 216 Chapter 9 Demystifying Machine Learning 217 Detecting Malware 218 Developing a Machine Learning Algorithm 220 Validating the Algorithm 221 Implementing the Algorithm 222 Benefiting from Machine Learning 226 Answering Questions with Machine Learning 226 Measuring Good Performance 227 Selecting Features 228 Validating Your Model 230 Specific Learning Methods 230 Supervised 231 Unsupervised 234 Hands On: Clustering Breach Data 236 Multidimensional Scaling on Victim Industries 238 Hierarchical Clustering on Victim Industries 240 Summary 242 Recommended Reading 243 Chapter 10 Designing Effective Security Dashboards 245 What Is a Dashboard, Anyway? 246 A Dashboard Is Not an Automobile 246 A Dashboard Is Not a Report 248 A Dashboard Is Not a Moving Van 251 A Dashboard Is Not an Art Show 253 Communicating and Managing "Security" through Dashboards 258 Lending a Hand to Handlers 258 Raising Dashboard Awareness 260 The Devil (and Incident Response Delays) Is in the Details 262 Projecting "Security" 263 Summary 267 Recommended Reading 267 Chapter 11 Building Interactive Security Visualizations 269 Moving from Static to Interactive270 Interaction for Augmentation 271 Interaction for Exploration 274 Interaction for Illumination 276 Developing Interactive Visualizations 281 Building Interactive Dashboards with Tableau 281 Building Browser-Based Visualizations with D3 284 Summary 294 Recommended Reading 295 Chapter 12 Moving Toward Data-Driven Security 297 Moving Yourself toward Data-Driven Security 298 The Hacker 299 The Statistician 302 The Security Domain Expert 302 The Danger Zone 303 Moving Your Organization toward Data-Driven Security 303 Ask Questions That Have Objective Answers 304 Find and Collect Relevant Data 304 Learn through Iteration 305 Find Statistics 306 Summary 308 Recommended Reading 308 Appendix A Resources and Tools 309 Appendix B References 313 Index 321
£36.09
O'Reilly Media Learning Serverless Security
a huge range and FREE tracked UK delivery on ALL orders.
£41.99
Rheinwerk Verlag GmbH Hardware Security
£57.60
Oxford University Press Blackstones Handbook of Cyber Crime Investigation
Book SynopsisThis authoritative Handbook provides a clear and detailed introduction to cyber crime, offering you an effective operational guide to the complexities and challenges of investigating cyber-related crimes. Written by a team of cyber crime experts, this unique book provides all police practitioners and partners with an operational reference and resource addressing all manner of cyber crime threats, including online anti-social behaviour, hate crime, organised cyber crime, fraud, online child exploitation, and cyber terrorism and the terrorist use of the internet. Presented in three main parts, Part 1 offers an overview of the different types of cyber crime along with explanations of the national structures and strategies in place to combat them, as well as case studies and scenarios. Part 2 offers practical guidance on the different categories of cyber crime and features contributions from organizations such as the National Crime Agency, and Part 3 covers the key legislation, police poweTable of ContentsPART I: UNDERSTANDING THE THREAT FROM CYBER CRIME; PART II: RESPONDING TO CYBER CRIME; PART III: INVESTIGATING CYBER CRIMES; PART IV: CYBER LAW; APPENDICES
£36.09
John Wiley & Sons Inc Cybersecurity Essentials
Book SynopsisAn accessible introduction to cybersecurity concepts and practices Cybersecurity Essentials provides a comprehensive introduction to the field, with expert coverage of essential topics required for entry-level cybersecurity certifications.Table of ContentsIntroduction xix PART I SECURING THE INFRASTRUCTURE 1 Chapter 1 Infrastructure Security in the Real World 3 Security Challenges 3 Infrastructure Security Scenario 1 4 Infrastructure Security Scenario 2 6 Summary 8 Chapter 2 Understanding Access-Control and Monitoring Systems 9 A Quick Primer on Infrastructure Security 9 Access Control 12 Security Policies 14 Physical Security Controls 15 Locks and Keys 16 Standard Key-Locking Deadbolts 17 Solenoid-Operated Deadbolt Locks 18 Cipher Locks 19 Access-Control Gates 20 Sliding Gates 20 Swinging Gates 21 Control Relays 21 Authentication Systems 23 Magnetic Stripe Readers 24 Smart Cards 25 RFID Badges 26 Biometric Scanners 27 Remote-Access Monitoring 29 Opened- and Closed-Condition Monitoring 30 Automated Access-Control Systems 32 Hands-On Exercises 33 Discussion 34 Procedure 35 Review Questions 43 Chapter 3 Understanding Video Surveillance Systems 45 Video Surveillance Systems 45 Cameras 46 Hands-On Exercises 60 Discussion 61 Procedure 61 Review Questions 69 Chapter 4 Understanding Intrusion-Detection and Reporting Systems 71 Intrusion-Detection and Reporting Systems 71 Security Controllers 74 Sensors 77 Vehicle-Detection Sensors 82 Fire-Detection Sensors 85 Output Devices 87 Hands-On Exercises 90 Discussion 90 Procedure 92 Review Questions 94 Chapter 5 Infrastructure Security: Review Questions and Hands-On Exercises 97 Summary Points 97 Security Challenge Scenarios 101 Infrastructure Security Scenario 1 101 Infrastructure Security Scenario 2 102 Professional Feedback 102 Review Questions 107 Exam Questions 109 PART II SECURING LOCAL HOSTS 113 Chapter 6 Local Host Security in the Real World 115 Security Challenges 115 Computing Device Security Scenario 1 116 Computing Device Security Scenario 2 117 Summary 120 Chapter 7 Securing Devices 121 The Three Layers of Security 121 Securing Host Devices 123 Securing Outer-Perimeter Portals 124 Additional Inner-Perimeter Access Options 127 Hands-On Exercises 137 Objectives 137 Procedure 137 Review Questions 148 Chapter 8 Protecting the Inner Perimeter 149 The Inner Perimeter 149 Operating Systems 151 Operating System Security Choices 168 Common Operating System Security Tools 169 Using Local Administrative Tools 177 Implementing Data Encryption 182 Hands-On Exercises 188 Objectives 188 Resources 188 Discussion 189 Procedures 190 Tables 200 Lab Questions 201 Chapter 9 Protecting Remote Access 203 Protecting Local Computing Devices 203 Using a Secure Connection 204 Establishing and Using a Firewall 204 Installing and Using Anti-Malware Software 205 Removing Unnecessary Software 205 Disabling Nonessential Services 205 Disabling Unnecessary OS Default Features 205 Securing the Web Browser 205 Applying Updates and Patches 206 Requiring Strong Passwords 206 Implementing Local Protection Tools 206 Software-Based Local Firewalls 207 Using Local Intrusion-Detection Tools 209 Profile-Based Anomaly-Detection Systems 210 Threshold-Based Anomaly-Detection Systems 211 Configuring Browser Security Options 211 Configuring Security Levels 213 Configuring Script Support 214 Defending Against Malicious Software 218 Using Antivirus Programs 220 Using Antispyware 221 Hardening Operating Systems 222 Service Packs 222 Patches 222 Updates 223 Overseeing Application Software Security 223 Software Exploitation 223 Applying Software Updates and Patches 224 Hands-On Exercises 225 Objectives 225 Resources 225 Discussion 225 Procedures 226 Tables 241 Lab Questions 242 Chapter 10 Local Host Security: Review Questions and Hands-On Exercises 243 Summary Points 243 Security Challenge Scenarios 248 Computing Device Security Scenario 1 248 Computing Device Security Scenario 2 248 Professional Feedback 248 Review Questions 257 Exam Questions 259 PART III SECURING LOCAL NETWORKS 263 Chapter 11 Local Network Security in the Real World 265 Security Challenges 266 Local Network Security Scenario 1 266 Local Network Security Scenario 2 270 Summary 272 Chapter 12 Networking Basics 273 Understanding the Basics of Networking 273 Campus Area Networks or Corporate Area Networks (CANs) 274 Metropolitan Area Networks (MANs) 274 Wireless Local Area Networks (WLANs) 274 Storage Area Networks (SANs) 274 The OSI Networking Model 275 Layer 1: Physical 276 Layer 2: Data Link 276 Layer 3: Network 276 Layer 4: Transport 276 Layer 5: Session 276 Layer 6: Presentation 277 Layer 7: Application 277 Data Transmission Packets 277 OSI Layer Security 278 Network Topologies 280 Bus Topology 280 Ring Topology 280 Star Topology 281 Mesh Topology 282 Logical Topologies 282 Hands-On Exercises 283 Objectives 283 Resources 283 Discussion 283 Procedure 284 Lab Questions 295 Lab Answers 295 Chapter 13 Understanding Networking Protocols 297 The Basics of Networking Protocols 297 MAC Addresses 298 TCP/IP 299 Ethernet 309 Network Control Strategies 311 Hands-On Exercises 313 Objectives 313 Discussion 313 Procedures 314 Lab Questions 325 Lab Answers 326 Chapter 14 Understanding Network Servers 327 The Basics of Network Servers 327 Server Security 330 Network Administrators 331 Server Software Security 335 User Accounts 341 Network Authentication Options 347 Establishing Resource Controls 348 Maintaining Server Security 352 Vulnerability Scanning 358 Hands-On Exercises 361 Objectives 361 Resources 361 Discussion 362 Procedures 362 Lab Questions 382 Lab Answers 382 Chapter 15 Understanding Network Connectivity Devices 385 Network Switches 386 Routers 388 Gateways 390 Network Bridges 391 Wireless Network Connectivity 392 Network Connectivity Device Vulnerabilities 392 Network Connectivity Device Attacks 393 Network Connectivity Defense 397 Network Hardening 398 Hands-On Exercises 399 Objectives 399 Resources 399 Procedures 399 Lab Questions 404 Lab Answers 404 Chapter 16 Understanding Network Transmission Media Security 407 The Basics of Network Transmission Media 407 Copper Wire 408 Light Waves 410 Wireless Signals 412 Transmission Media Vulnerabilities 415 Securing Wireless Networks 415 Hands-On Exercises 417 Objectives 417 Resources 417 Procedure 417 Lab Questions 421 Lab Answers 421 Chapter 17 Local Network Security: Review Questions 423 Summary Points 423 Security Challenge Scenarios 432 Local Network Security Scenario 1 432 Local Network Security Scenario 2 432 Professional Feedback 432 Review Questions 443 PART IV SECURING THE PERIMETER 449 Chapter 18 Perimeter Security in the Real World 451 Security Challenges 451 Internet Security Scenario 1 451 Internet Security Scenario 2 454 Summary 455 Chapter 19 Understanding the Environment 457 The Basics of Internet Security 457 Understanding the Environment 460 Basic Internet Concepts 461 Internet Services 468 Standards and RFCs 470 Hands-On Exercises 471 Objectives 471 Resources 472 Discussion 472 Procedures 472 Lab Questions 486 Lab Answers 486 Chapter 20 Hiding the Private Network 487 Understanding Private Networks 487 Network Address Translation 488 Port Address Translation 489 Port Forwarding or Mapping 490 Network Segmentation 492 Software-Defined Networking 494 Hands-On Exercises 496 Objectives 496 Resources 496 Discussion 496 Procedure 497 Lab Questions 508 Lab Answers 509 Chapter 21 Protecting the Perimeter 511 Understanding the Perimeter 511 Firewalls 515 Firewall Considerations 517 Network Appliances 519 Proxy Servers 520 Demilitarized Zones (DMZs) 522 Single-Firewall DMZs 523 Dual-Firewall DMZs 524 Honeypots 525 Extranets 526 Hands-On Exercises 528 Objectives 528 Resources 528 Procedures 528 Lab Questions 534 Lab Answers 534 Chapter 22 Protecting Data Moving Through the Internet 535 Securing Data in Motion 535 Authentication 536 Encryption 542 Cryptography 543 Digital Certificates 545 Hash Tables 548 Cookies 548 CAPTCHAs 549 Virtual Private Networks 550 Hands-On Exercises 552 Objectives 552 Resources 552 Discussion 552 Procedures 552 Lab Questions 563 Lab Answers 563 Chapter 23 Tools and Utilities 565 Using Basic Tools 565 IFconfig/IPconfig 565 Whois 566 Nslookup 567 PING 567 Traceroute 568 Telnet 569 Secure Shell 570 Monitoring Tools and Software 570 Nagios 572 SolarWinds 572 Microsoft Network Monitor 572 Wireshark 572 Snort 573 Nmap 575 Nikto 575 OpenVAS 575 Metasploit 575 The Browser Exploitation Framework (BeEF) 576 Other Products 576 Hands-On Exercises 578 Objectives 578 Resources 578 Discussion 578 Procedures 579 Capturing a PING 583 Lab Questions 589 Lab Answers 589 Chapter 24 Identifying and Defending Against Vulnerabilities 591 Zero Day Vulnerabilities 591 Software Exploits 592 SQL Injection 594 Java 597 Other Software Exploits 599 Social Engineering Exploits 600 Phishing Attacks 600 Network Threats and Attacks 603 Broadcast Storms 603 Session-Hijacking Attacks 604 Dictionary Attacks 606 Denial of Service (DoS) Attacks 606 Tarpitting 611 Spam 612 Protecting Against Spam Exploits 613 Other Exploits 614 Transport Layer Security (TLS) Exploits 614 FREAK Exploits 615 Logjam Exploits 615 Hands-On Exercises 616 Objectives 616 Resources 616 Discussion 616 Procedures 616 Chapter 25 Perimeter Security: Review Questions and Hands-On Exercises 627 Summary Points 627 Security Scenario Review 637 Network Security Scenario 1 637 Network Security Scenario 2 637 Professional Feedback 637 Review Questions 644 Exam Questions 647 Appendix A 651 Appendix B 703 Appendix C 715 Index 727
£26.40
McGraw-Hill Education CISSP AllinOne Exam Guide Ninth Edition
Book SynopsisA new edition of Shon Harrisâ bestselling exam prep guideâfully updated for the 2021 version of the CISSP examThoroughly updated for the latest release of the Certified Information Systems Security Professional exam, this comprehensive resource covers all objectives in the 2021 CISSP exam developed by the International Information Systems Security Certification Consortium (ISC)2 . CISSP All-in-One Exam Guide, Ninth Edition features learning objectives at the beginning of each chapter, exam tips, practice questions, and in-depth explanations. Written by leading experts in information security certification and training, this completely up-to-date self-study system helps you pass the exam with ease and also serves as an essential on-the-job reference.Covers all 8 CISSP domains: Security and risk management Asset security Security architecture and engineering Communication and network security Identity and access ma
£45.89
John Wiley & Sons Inc The Language of Deception
Book SynopsisTable of ContentsIntroduction xi 1 Artificial Social Intelligence 1 2 Social Engineering and Psychological Exploitation 19 3 A History of Technology and Social Engineering 53 4 A History of Language Modeling 83 5 Consciousness, Sentience, and Understanding 127 6 The Imitation Game 151 7 Weaponizing Social Intelligence 175 8 Weaponizing Technical Intelligence 215 9 Multimodal Manipulation 239 10 The Future 257 11 The Quest for Resolution 283 Appendix A: Bot Automation 295 Appendix B: LLM Pretext Engineering 303 Appendix C: CAPTCHA Bypass 317 Appendix D: Context Manipulation Attacks 321 Appendix E: Attack Optimization with Monte Carlo Simulations 333 Appendix F: Autonomous C2 Operations with LLMs 349 Appendix G: Disembodiment Attacks 353 Bibliography 357 Acknowledgments 373 About the Author 375 Index 377
£22.94
O'Reilly Media Machine Learning and Security
Book SynopsisIn this practical guide, machine learning and security specialists Clarence Chio and David Freeman provide a framework for discussing the marriage of these two fields, as well as a toolkit of machine-learning algorithms that you can apply to an array of security problems.
£42.39
No Starch Press,US Practical Social Engineering: A Primer for the
Book SynopsisReaders learn how to leverage human psychology and publicly available information to attack a target. The book includes sections on how to evade detection, spear phish, generate reports, and protect victims to ensure their well-being. Readers learn how to collect information about a target and how to exploit that information to make their attacks more effective. They also learn how to defend themselves or their workplace against social engineering attacks.Trade Review"Gray provides a very accessible look at social engineering that should be essential reading for pentesters and ethical hackers." -Ian Barker, BetaNews "I really liked the way that [Joe] lays out tools to use, including walking through where to download them from and install them . . . as beginner-friendly and as easy to use as possible." -Patrick Laverty, Layer 8 PodcastTable of ContentsIntroduction Part 1: The Basics Chapter 1: What is Social Engineering? Chapter 2: Ethical Considerations in Social Engineering Part 2: Offensive Social Engineering Chapter 3: Preparing for an Attack Chapter 4: Gathering Business OSINT Chapter 5: Social Media and Public Documents Chapter 6: Gathering OSINT About People Chapter 7: Phishing Chapter 8: Cloning a Landing Page Chapter 9: Detection, Measurement, and Reporting Part 3: Defending Against Social Engineering Chapter 10: Proactive Defense Techniques Chapter 11: Technical Email Controls Chapter 12: Producing Threat Intelligence Appendix A: Scoping Worksheet Appendix B: Reporting Template Appendix C: Information Gathering Worksheet Appendix D: Pretexting Samples Appendix E: Exercises to Improve Your Social Engineering
£25.49
No Starch Press,US The Art Of Cyberwarfare: An Investigator's Guide
Book SynopsisToday, companies find themselves targeted by sophisticated nation state cyber attackers armed with the resources to craft scarily effective campaigns. This book is a detailed guide to understanding the major players, the techniques they use, and the process of analysing their advanced attacks. Whether you're an individual researcher or part of a team within a Security Operations Center (SoC), you'll learn to approach, track, and attribute attacks to these advanced actors. Jon DiMaggio demonstrates some of the techniques he has employed to uncover crucial information about the 2021 Colonial Pipeline attacks, among others.Trade Review"Encompasses useful knowledge from the past and modern advanced threats seen today. Regardless of your expertise level, this book is an insightful read . . .”—Brittany Day, Director of Communications, Guardian Digital“For those looking for a guide to help them understand the new world of cyberwar, The Art of Cyberwarfare provides readers with a good overview of this expanding threat and what they can do to avoid being victims.”—Ben Rothke, Senior Information Security Manager, Tapad"An informative and explanatory guide for cybersecurity experts and an enlightening read for novices. DiMaggio effectively details both the history of cybercrime and how it is seen today."—Justice Levine, Communications Manager and Cloud Email Security Expert, Guardian Digital"This book deserves to find a place on the shelf of everyone whose role involves protecting networks."—Ian Barker, BetaNews"A cross between an IBM presentation . . . and a Tom Clancy novel!"—The Shepherdess, Amazon Reviewer
£28.49
McGraw-Hill Education CISM Certified Information Security Manager
Book SynopsisUp-to-date practice questions that cover every topic on the 2022 version of the CISM examTake the current version of the challenging CISM exam with complete confidence using the detailed information contained in this fully updated self-study guide. Written by an expert in the field, the book features hundreds of practice exam questions that match those on the live test in content, format, tone, and feel. In-depth answer explanations are provided for both the correct and incorrect answer choices. CISM Certified Information Security Manager Practice Exams, Second Edition supplements the CISM All-in-One Exam Guide and completely covers every objective of the 2022 exam release. In total, the book contains more than 300 realistic practice questions.â Offers 100% coverage of all four CISM exam domainsâ Online content includes access to an additional 150 practice questions in the TotalTester
£28.79
McGraw-Hill Education CC Certified in Cybersecurity AllinOne Exam Guide
Book SynopsisThis new self-study system delivers complete coverage of every topic on the Certified in Cybersecurity examTake the Certified in Cybersecurity exam from (ISC)2 with confidence using the information contained in this comprehensive study guide. Written by a pair of cybersecurity experts and successful trainers, CC Certified in Cybersecurity All-in-One Exam Guide offers background material, detailed examples, and over 200 practice questions. Each exam domain is presented with information corresponding to the (ISC)2 certification exam outline. Using the trusted âœAll-in-Oneâ format, the book reviews every topic on the test and presents foundational knowledge and skills important for an entry-level cybersecurity role. You will get explanations and technical details on core concepts as well as stories, discussions, and anecdotes from real-world cybersecurity experts.Coverage includes: Security Principles Business Continuity (BC), Disaster Rec
£33.74
Kogan Page Ltd Cyber Risk Management
Book SynopsisChristopher J Hodson is Chief Security Officer for Cyberhaven where he oversees all facets of security to protect Cyberhaven customers and employees, including cloud and application security, security operations, and risk management. In addition, Chris serves as a board advisor at the workforce development platform, Cybrary, and is a fellow of the Chartered Institute of Information Security. He has previously held CISO positions with Contentful, Zscaler, and Tanium. He is a guest lecturer at Royal Holloway, University of London where he also holds a master's degree in computer and information systems security.Trade Review"This is an excellent book. Christopher Hodson writes as he speaks, with passion and clear understanding of a profession of which he has extensive experience and loves. Cyber Risk Management is extremely well researched and provides the reader with a simple-to-follow, guided journey through the cyber issues we face and the approaches we should be taking to cope with them. Hodson's pragmatic style demystifies complex issues making this a great read for both experienced security professionals and non-professionals alike. This is required reading for anyone who wants to intelligently manage cyber risk, whether a CISO, CFO or CEO!" * Amanda Finch, CEO, Chartered Institute of Security Professionals *"In the fast-paced world of cybersecurity, Cyber Risk Management is a guiding light. This book combines expertise with a friendly touch, making it easy for readers to tackle security challenges, no matter their technical background. Christopher Hodson has a knack for unravelling cybersecurity jargon and presenting complex ideas in a way that anyone can understand. He effortlessly blends theory with practical examples, ensuring readers not only grasp the basics but also gain insights into real-world scenarios. Throughout the book, Hodson expertly covers the essentials of cybersecurity risk management, offering a solid framework for prioritizing threats, spotting vulnerabilities, and implementing effective controls. His conversational tone and patient approach make this book a valuable resource for both seasoned practitioners and newcomers." * Dana Wolf, CEO and Co-Founder, YeshID *"Everyone in the cybersecurity universe is experiencing a pace of change and complexity which is simply unprecedented. Christopher Hodson has captured our universe as it is today. He covers the meteoric rise of LLMs and changes in social appetite to technology, with the keen insight, deep expertise and humour that we expect from him. He gives us a reason to feel optimistic about these changes. Whilst so much is changing, the importance of understanding cybersecurity remains paramount and constant." * Phil Owen MBE, VP/Chief Security Officer, Telus Health *"Cyber Risk Management serves as both a valuable playbook for security leaders building out their programs, and a much-needed reference for their key business and technical partners across the organization. Christopher Hodson reinforces and enriches each topic by drawing upon a diverse set of examples from emerging technologies, geopolitical and regulatory forces, historical events, and noteworthy incidents." * Ryan Kazanciyan, CISO, Wiz *Table of Contents Section - PART ONE: Contextualizing cybersecurity risk; Chapter - 01: Why now? The only constant is change; Chapter - 02: Technologies and security challenges; Chapter - 03: Data breaches; Section - PART TWO: Cybersecurity programme management; Chapter - 04: What are cybersecurity and cybercrime?; Chapter - 05: Establishing a cybersecurity programme; Section - PART THREE: Actors, events and vulnerabilities; Chapter - 06: Threat actors; Chapter - 07: Threat events; Chapter - 08: Vulnerabilities; Chapter - 09: Controls; Section - PART FOUR: Conclusion: the cybersecurity risk equation explained; Chapter - 10: Cyber risk management: a conclusion;
£42.74
Pearson Education (US) CCNP and CCIE Security Core SCOR 350701 Official
Book SynopsisOmar Santos is a cybersecurity thought leader with a passion for driving industry-wide initiatives to enhance the security of critical infrastructures. Omar is the lead of the DEF CON Red Team Village, the chair of the Common Security Advisory Framework (CSAF) technical committee, and board member of the OASIS Open standards organization. Omar's collaborative efforts extend to numerous organizations, including the Forum of Incident Response and Security Teams (FIRST) and the Industry Consortium for Advancement of Security on the Internet (ICASI). Omar is a renowned expert in ethical hacking, vulnerability research, incident response, and AI security. He employs his deep understanding of these disciplines to help organizations stay ahead of emerging threats. His dedication to cybersecurity has made a significant impact on businesses, academic institutions, law enforcement agencies, and other entities striving to bolster their security measures. OTable of Contents Introduction xxxi Chapter 1 Cybersecurity Fundamentals 2 “Do I Know This Already?” Quiz 3 Foundation Topics 6 Introduction to Cybersecurity 6 Defining What Are Threats, Vulnerabilities, and Exploits 8 Common Software and Hardware Vulnerabilities 31 Confidentiality, Integrity, and Availability 43 Cloud Security Threats 50 IoT Security Threats 54 An Introduction to Digital Forensics and Incident Response 58 Summary 76 Exam Preparation Tasks 76 Review All Key Topics 76 Define Key Terms 78 Review Questions 78 Chapter 2 Cryptography 80 “Do I Know This Already?” Quiz 80 Foundation Topics 82 Introduction to Cryptography 82 Fundamentals of PKI 97 Exam Preparation Tasks 106 Review All Key Topics 106 Define Key Terms 107 Review Questions 107 Chapter 3 Software-Defined Networking Security and Network Programmability 110 “Do I Know This Already?” Quiz 110 Foundation Topics 112 Software-Defined Networking (SDN) and SDN Security 112 Introduction to Network Programmability 136 Exam Preparation Tasks 151 Review All Key Topics 151 Define Key Terms 152 Review Questions 152 Chapter 4 Authentication, Authorization, Accounting (AAA) and Identity Management 156 “Do I Know This Already?” Quiz 157 Foundation Topics 160 Introduction to Authentication, Authorization, and Accounting 160 Authentication 162 Authorization 177 Accounting 179 Infrastructure Access Controls 179 AAA Protocols 182 Cisco Identity Services Engine (ISE) 192 Configuring TACACS+ Access 207 Configuring RADIUS Authentication 213 Additional Cisco ISE Design Tips 222 Exam Preparation Tasks 225 Review All Key Topics 225 Define Key Terms 226 Review Questions 227 Chapter 5 Network Visibility and Segmentation 232 “Do I Know This Already?” Quiz 233 Foundation Topics 236 Introduction to Network Visibility 236 NetFlow 237 IP Flow Information Export (IPFIX) 249 NetFlow Deployment Scenarios 255 Cisco Secure Network Analytics and Cisco Secure Cloud Analytics 263 Cisco Cognitive Intelligence and Cisco Encrypted Traffic Analytics (ETA) 274 NetFlow Collection Considerations and Best Practices 279 Configuring NetFlow in Cisco IOS and Cisco IOS-XE 280 Configuring NetFlow in NX-OS 295 Introduction to Network Segmentation 296 Micro-Segmentation with Cisco ACI 301 Segmentation with Cisco ISE 302 Exam Preparation Tasks 312 Review All Key Topics 312 Define Key Terms 313 Review Questions 314 Chapter 6 Infrastructure Security 316 “Do I Know This Already?” Quiz 317 Foundation Topics 320 Securing Layer 2 Technologies 320 VLAN and Trunking Fundamentals 320 Common Layer 2 Threats and How to Mitigate Them 333 Network Foundation Protection 343 Understanding and Securing the Management Plane 345 Understanding the Control Plane 347 Understanding and Securing the Data Plane 348 Securing Management Traffic 350 Implementing Logging Features 378 Configuring NTP 379 Securing the Network Infrastructure Device Image and Configuration Files 380 Securing the Data Plane in IPv6 381 Securing Routing Protocols and the Control Plane 395 Exam Preparation Tasks 404 Review All Key Topics 404 Define Key Terms 405 Review Questions 405 Chapter 7 Cisco Secure Firewall 410 “Do I Know This Already?” Quiz 410 Foundation Topics 413 Introduction to Cisco Secure Firewall 413 Comparing Network Security Solutions That Provide Firewall Capabilities 435 Deployment Modes of Network Security Solutions and Architectures That Provide Firewall Capabilities 437 High Availability and Clustering 448 Implementing Access Control 452 Cisco Firepower Intrusion Policies 472 Cisco Secure Malware Defense 478 Security Intelligence, Security Updates, and Keeping Firepower Software Up to Date 483 Exam Preparation Tasks 484 Review All Key Topics 485 Define Key Terms 486 Review Questions 486 Chapter 8 Virtual Private Networks (VPNs) 490 “Do I Know This Already?” Quiz 490 Foundation Topics 494 Virtual Private Network (VPN) Fundamentals 494 Deploying and Configuring Site-to-Site VPNs in Cisco Routers 506 Configuring Site-to-Site VPNs in Cisco ASA Firewalls 528 Configuring Remote-Access VPNs in the Cisco ASA 537 Configuring Clientless Remote Access SSL VPNs in the Cisco ASA 540 Configuring Client-Based Remote-Access SSL VPNs in the Cisco ASA 551 Configuring Remote-Access VPNs in Cisco Secure Firewall 556 Configuring Site-to-Site VPNs in the Cisco Secure Firewall 567 Cisco SD-WAN 569 Exam Preparation Tasks 573 Review All Key Topics 573 Define Key Terms 574 Review Questions 575 Chapter 9 Securing the Cloud 578 “Do I Know This Already?” Quiz 579 Foundation Topics 581 What Is Cloud and What Are the Cloud Service Models? 581 DevOps, Continuous Integration (CI), Continuous Delivery (CD), and Describing the Customer vs. Provider Security Responsibility for the Different Cloud Service Models 605 Cisco Umbrella 608 Cisco Secure Email Threat Defense 614 Cisco Attack Surface Management (Formerly Cisco Secure Cloud Insights) 616 Cisco Secure Cloud Analytics 618 AppDynamics Cloud Monitoring 619 Cisco Secure Workload 622 Cisco XDR 627 Exam Preparation Tasks 632 Review All Key Topics 633 Define Key Terms 634 Review Questions 634 Chapter 10 Content Security 638 “Do I Know This Already?” Quiz 638 Foundation Topics 641 Content Security Fundamentals 641 Cisco Secure Web Appliance 642 Cisco Secure Email 658 Cisco Content Security Management Appliance (SMA) 662 Exam Preparation Tasks 667 Review All Key Topics 668 Define Key Terms 668 Review Questions 669 Chapter 11 Endpoint Protection and Detection 672 “Do I Know This Already?” Quiz 672 Foundation Topics 674 Introduction to Endpoint Protection and Detection 674 Cisco Secure Endpoint 676 Cisco Threat Response 693 Exam Preparation Tasks 693 Review All Key Topics 693 Define Key Terms 694 Review Questions 694 Chapter 12 Final Preparation 696 Hands-on Activities 696 Suggested Plan for Final Review and Study 696 Summary 697 Chapter 13 CCNP and CCIE Security Core SCOR (350-701) Exam Updates 698 The Purpose of This Chapter 698 News about the Next Exam Release 700 Updated Technical Content 700 Appendix A Answers to the “Do I Know This Already?” Quizzes and Q&A Glossary 714 Online Element Appendix B Study Planner 9780138221263, TOC, 10/2/23
£50.39
WW Norton & Co A Hackers Mind
Book SynopsisIt's not just computers—hacking is everywhere. Legendary cybersecurity expert and New York Times best-selling author Bruce Schneier reveals how using a hacker’s mindset can change how you think about your life and the world.Trade Review"A Hacker's Mind… sheds vital light on the beginnings of our journey into an increasingly complex world." -- Becky Hogge - Financial Times"Schneier sees everything from tax avoidance to electoral gerrymandering as hacking and suggests that the hackers we should worry about are not teenagers in hooded sweatshirts, but accountants, lawyers and lobbyists in suits. " -- Ethan Zuckerman - Prospect"An essential new perspective on hacking: the bad and the ugly, but also a surprisingly optimistic way of using a hacker mentality to solve society’s complex problems." -- Marietje Schaake, international policy director at Stanford University Cyber Policy Centre and member of European Parliament, 2009–2019"A Hacker’s Mind brilliantly explains how our society and democracy are being shaped by people taking the ‘hacking’ mentality into realms that weren’t designed to be hacked. Bruce Schneier shows how hacking, the tool of the rebel and the outsider, can also be used by the rich and powerful to win in business and politics, at great cost to the civic commitment needed for our free society. A great read and an important book!" -- Timothy H. Edgar, author of Beyond Snowden"They say that rules are made to be broken, but more often rules are gamed, finessed, worked around, or subverted—in short, hacked. No one is better equipped than Bruce Schneier to explain how this often-perverse use of human ingenuity can undermine the institutions that civilized life depends on. A Hacker’s Mind is an important source of new insights on the forces that can sap the vigor and integrity of modern society." -- Steven Pinker, Johnstone Family Professor of Psychology, Harvard University, and author of Rationality
£22.79
Taylor & Francis Ltd A Deeper Perspective on the Fundamentals of
Book SynopsisThis book, divided into three parts, describes the detailed concepts of Digital Communication, Security, and Privacy protocols. In Part One, the first chapter provides a deeper perspective on communications, while Chapters 2 and 3 focus on analog and digital communication networks. Part Two then delves into various Digital Communication protocols. Beginning first in Chapter 4 with the major Telephony protocols, Chapter 5 then focuses on important Data Communication protocols, leading onto the discussion of Wireless and Cellular Communication protocols in Chapter 6 and Fiber Optic Data Transmission protocols in Chapter 7. Part Three covers Digital Security and Privacy protocols including Network Security protocols (Chapter 8), Wireless Security protocols (Chapter 9), and Server Level Security systems (Chapter 10), while the final chapter covers various aspects of privacy related to communication protocols and associated issues. This boTable of ContentsPart OneIntroduction to Analog & Digital Communication ProtocolsChapter 01 – Evolution of Communication ProtocolsChapter 02 – Introduction to Analog Communication ProtocolsChapter 03 – Introduction to Digital Communication ProtocolsPart TwoChapter 04 – Major Telephony ProtocolsChapter 05 – Important Data Communication ProtocolsChapter 06 – Wireless and Cellular Communication ProtocolsChapter 07 – Fiber Optic Data Transmission ProtocolsPart ThreeChapter 08 – Network Security ProtocolsChapter 09 – Wireless Security ProtocolsChapter 10 – Server Level Security SystemsChapter 11 – PrivacyBibliography
£44.99
John Wiley & Sons Inc Threat Modeling
Book SynopsisThe only security book to be chosen as a Dr. Dobbs Jolt Award Finalist since Bruce Schneier's Secrets and Lies and Applied Cryptography! Adam Shostack is responsible for security development lifecycle threat modeling at Microsoft and is one of a handful of threat modeling experts in the world.Table of ContentsIntroduction xxi Part I Getting Started 1 Chapter 1 Dive In and Threat Model! 3 Learning to Threat Model 4 Threat Modeling on Your Own 26 Checklists for Diving In and Threat Modeling 27 Summary 28 Chapter 2 Strategies for Threat Modeling 29 “What’s Your Threat Model?” 30 Brainstorming Your Threats 31 Structured Approaches to Threat Modeling 34 Models of Software 43 Summary 56 Part II Finding Threats 59 Chapter 3 STRIDE 61 Understanding STRIDE and Why It’s Useful 62 Spoofing Threats 64 Tampering Threats 67 Repudiation Threats 68 Information Disclosure Threats 70 Denial-of-Service Threats 72 Elevation of Privilege Threats 73 Extended Example: STRIDE Threats against Acme-DB 74 STRIDE Variants 78 Exit Criteria 85 Summary 85 Chapter 4 Attack Trees 87 Working with Attack Trees 87 Representing a Tree 91 Example Attack Tree 94 Real Attack Trees 96 Perspective on Attack Trees 98 Summary 100 Chapter 5 Attack Libraries 101 Properties of Attack Libraries 101 CAPEC 104 OWASP Top Ten 108 Summary 108 Chapter 6 Privacy Tools 111 Solove’s Taxonomy of Privacy 112 Privacy Considerations for Internet Protocols 114 Privacy Impact Assessments (PIA) 114 The Nymity Slider and the Privacy Ratchet 115 Contextual Integrity 117 LINDDUN 120 Summary 121 Part III Managing and Addressing Threats 123 Chapter 7 Processing and Managing Threats 125 Starting the Threat Modeling Project 126 Digging Deeper into Mitigations 130 Tracking with Tables and Lists 133 Scenario-Specifi c Elements of Threat Modeling 138 Summary 143 Chapter 8 Defensive Tactics and Technologies 145 Tactics and Technologies for Mitigating Threats 145 Addressing Threats with Patterns 159 Mitigating Privacy Threats 160 Summary 164 Chapter 9 Trade-Off s When Addressing Threats 167 Classic Strategies for Risk Management 168 Selecting Mitigations for Risk Management 170 Threat-Specific Prioritization Approaches 178 Mitigation via Risk Acceptance 184 Arms Races in Mitigation Strategies 185 Summary 186 Chapter 10 Validating That Threats Are Addressed 189 Testing Threat Mitigations 190 Checking Code You Acquire 192 QA’ing Threat Modeling 195 Process Aspects of Addressing Threats 197 Tables and Lists 198 Summary 202 Chapter 11 Threat Modeling Tools 203 Generally Useful Tools 204 Open-Source Tools 206 Commercial Tools 208 Tools That Don’t Exist Yet 213 Summary 213 Part IV Threat Modeling in Technologies and Tricky Areas 215 Chapter 12 Requirements Cookbook 217 Why a “Cookbook”? 218 The Interplay of Requirements, Threats, and Mitigations 219 Business Requirements 220 Prevent/Detect/Respond as a Frame for Requirements 221 People/Process/Technology as a Frame for Requirements 227 Development Requirements vs. Acquisition Requirements 228 Compliance-Driven Requirements 229 Privacy Requirements 231 The STRIDE Requirements 234 Non-Requirements 240 Summary 242 Chapter 13 Web and Cloud Threats 243 Web Threats 243 Cloud Tenant Threats 246 Cloud Provider Threats 249 Mobile Threats 250 Summary 251 Chapter 14 Accounts and Identity 253 Account Life Cycles 254 Authentication 259 Account Recovery 271 Names, IDs, and SSNs 282 Summary 290 Chapter 15 Human Factors and Usability 293 Models of People 294 Models of Software Scenarios 304 Threat Elicitation Techniques 311 Tools and Techniques for Addressing Human Factors 316 User Interface Tools and Techniques 322 Testing for Human Factors 327 Perspective on Usability and Ceremonies 329 Summary 331 Chapter 16 Threats to Cryptosystems 333 Cryptographic Primitives 334 Classic Threat Actors 341 Attacks against Cryptosystems 342 Building with Crypto 346 Things to Remember about Crypto 348 Secret Systems: Kerckhoffs and His Principles 349 Summary 351 Part V Taking It to the Next Level 353 Chapter 17 Bringing Threat Modeling to Your Organization 355 How To Introduce Threat Modeling 356 Who Does What? 359 Threat Modeling within a Development Life Cycle 367 Overcoming Objections to Threat Modeling 379 Summary 383 Chapter 18 Experimental Approaches 385 Looking in the Seams 386 Operational Threat Models 387 The “Broad Street” Taxonomy 392 Adversarial Machine Learning 398 Threat Modeling a Business 399 Threats to Threat Modeling Approaches 400 How to Experiment 404 Summary 405 Chapter 19 Architecting for Success 407 Understanding Flow 407 Knowing the Participants 413 Boundary Objects 414 The Best Is the Enemy of the Good 415 Closing Perspectives 416 Summary 419 Now Threat Model 420 Appendix A Helpful Tools 421 Common Answers to “What’s Your Threat Model?” 421 Appendix B Threat Trees 429 STRIDE Threat Trees 430 Other Threat Trees 470 Appendix C Attacker Lists 477 Attacker Lists 478 Appendix D Elevation of Privilege: The Cards 501 Spoofing 501 Tampering 503 Repudiation 504 Information Disclosure 506 Denial of Service 507 Elevation of Privilege (EoP) 508 Appendix E Case Studies 511 The Acme Database 512 Acme’s Operational Network 519 Phones and One-Time Token Authenticators 525 Sample for You to Model 528 Glossary 533 Bibliography 543 Index 567
£48.45
APress Securing Office 365
Book Synopsis Understand common security pitfalls and discover weak points in your organization''s data security, and what you can do to combat them. This book includes the best approaches to managing mobile devices both on your local network and outside the office. Data breaches, compliance fines, and distribution of personally identifiable information (PII) without encryption or safeguards place businesses of all types at risk. In today''s electronic world, you must have a secure digital footprint that is based on business processes that are designed to protect information. This book is written for business owners, chief information security officers (CISO), and IT managers who want to securely configure Office 365. You will follow the Microsoft cybersecurity road map through a progressive tutorial on how to configure the security services in Office 365 to protect and manage your business. Table of Contents1. Why Security and Compliance 2. Azure and Office 365 Security 3. Office 365- Security Score 4. Office 365- Deploying Identity Management with EMS 5. Office 365- Mobile Device Management with EMS 6. Using Office 365 Compliance Center 7. Migration Step by Step 8. Managing Your Office 365
£48.74
APress Building Digital Experience Platforms
Book SynopsisUse digital experience platforms (DXP) to improve your development productivity and release timelines. Leverage the pre-integrated feature sets of DXPs in your organization''s digital transformation journey to quickly develop a personalized, secure, and robust enterprise platform.In this book the authors examine various features of DXPs and provide rich insights into building each layer in a digital platform. Proven best practices are presented with examples for designing and building layers. A special focus is provided on security and quality attributes needed for business-critical enterprise applications. The authors cover modern and emerging digital trends such as Blockchain, IoT, containers, chatbots, artificial intelligence, and more.The book is divided into five parts related to requirements/design, development, security, infrastructure, and case study. The authors employ proven real-world methods, best practices, and security and integration techniques derived fTable of ContentsPart 1: Requirements and Design.- Chapter 1: Introduction to Digital Experience Platforms (DXP).- Chapter 2: Gathering Requirements.- Chapter 3: Design.- Part 2: Development of the Banking Experience Platform.- Chapter 4: User Interface Design.- Chapter 5: Designing Integration Layer.- Part 3: Securing Banking Experience Platform.- Chapter 6: DXP Security.- Chapter 7: DXP Information Security.- Part 4: Infrastructure and NFR for Banking Experience Platform.- Chapter 8: Quality Attributes and Sizing of DXP.- Chapter 9: DXP Performance Optimization.- Chapter 10: Transforming Legacy Banking Applications to Banking Experience Platforms.- Part 5: End to End Case Study.- Chapter 11: End-to-End DXP Case Study.- Appendix A: Open-Source Tools and Frameworks.- Appendix B: Source Code.- Appendix C: Further Reading.-
£37.49
APress Privileged Attack Vectors
Book SynopsisSee how privileges, insecure passwords, administrative rights, and remote access can be combined as an attack vector to breach any organization. Cyber attacks continue to increase in volume and sophistication. It is not a matter of if, but when, your organization will be breached. Threat actors target the path of least resistance: users and their privileges. In decades past, an entire enterprise might be sufficiently managed through just a handful of credentials. Today''s environmental complexity has seen an explosion of privileged credentials for many different account types such as domain and local administrators, operating systems (Windows, Unix, Linux, macOS, etc.), directory services, databases, applications, cloud instances, networking hardware, Internet of Things (IoT), social media, and so many more. When unmanaged, these privileged credentials pose a significant threat from external hackers and insider threats. We are experiencing an expanding univerTable of Contents
£48.74
O'Reilly Media Agile Application Security
Book SynopsisWritten by security experts and agile veterans, this book begins by introducing security principles to agile practitioners, and agile principles to security practitioners. The authors also reveal problems they encountered in their own experiences with agile security, and how they worked to solve them.
£38.39
Oxford University Press Cryptography
Book SynopsisCryptography is a part of everyday life for almost all of us, though we may not realise we''re using it.We are a far cry from the historical prediction that cryptography would only be used by militaries and governments. With vast quantities of sensitive information transferred online by individuals, companies, organizations, and nation states, cryptography is increasingly important to everyone, and most of us, often without realising, use it daily. Cryptography: A Very Short Introduction demystifies the art of cryptography by tracing its historical use, explaining how it works, and providing examples of its practical use. These include online shopping, chip and PIN bank cards, and communicating via mobile phone. While many of these uses have been mainstream for some time now, the development and deployment of cryptography has changed enormously in the last twenty years.In this second edition, Sean Murphy and Rachel Player highlight the important advances in both academic cryptography research and its everyday use. Using non-technical language and without assuming advanced mathematical knowledge, they introduce symmetric and public-key cryptography and provide a detailed discussion of the design of cryptographic algorithms that are secure against quantum computers and the development of cryptographic algorithms with advanced functionalities. They also consider the new applications of cryptography such as blockchain, secure messaging apps, and electronic voting.ABOUT THE SERIES: The Very Short Introductions series from Oxford University Press contains hundreds of titles in almost every subject area. These pocket-sized books are the perfect way to get ahead in a new subject quickly. Our expert authors combine facts, analysis, perspective, new ideas, and enthusiasm to make interesting and challenging topics highly readable.
£9.49
Pearson Education Redefining Hacking
Book Synopsis
£35.99
Oxford University Press Inc Cyber Persistence Theory Redefining National
Book SynopsisTrade ReviewCyber Persistence Theory is an important addition to our collective understanding of the dynamics of cyberspace and its implications for national security. It provides sound insight and excellent analysis on how we can meet the challenges of cyber in the hyper-connected, digitally driven world we find ourselves in today. Excellent work on a topic of increasing importance to all! * Admiral Michael S. Rogers, USN (ret) former Commander, US Cyber Command and Director, National Security Agency (2014-2018) *This timely new book is destined to go down as a major milestone in the development of new strategic thought for twenty-first century. With admirable clarity and powerful prose, the authors first dismantle the deterrence-focused paradigm that has so far guided US defense strategy in cyber space and then formulate a new organizing concept. Anyone interested in cyber security must come to terms with this new thinking. * Brad Roberts, Center for Global Security Research *Michael Fischerkeller, Emily Goldman, and Richard Harknett have once again made an incredibly valuable contribution to the development of American cyber policy and strategy through the writing of Cyber Persistence Theory. The authors push its readership to think beyond classical deterrence theory to new concepts for engaging and defeating undeterred adversaries in cyberspace. In short, this book argues the need for change and to take more risk to close an increasingly larger risk in our defense and national security as well as our public safety posture as American citizens To do so, the authors argue will require not only persistent engagement, but a 'whole-of-nation plus' effort. A must-read for both national and cyber security professionals! * Robert J. Butler, former Deputy Assistant Secretary of Defense for Cyber and Space Policy *Time will tell whether cyberspace operations can have coercive effect, but it is unambiguously true that to date, nations have used cyberspace mostly to gain advantage in competing with other nations. Understanding how they do so is a new challenge that scholars of international relations would do well to take on, and this book is a superb point of departure for them. * Herb Lin, Hank J. Holland Fellow in Cyber Policy and Security, Hoover Institution, Stanford University *This book helps to fill a crucial gap in strategic thinking about the fundamentals of cyberspace and sets out a clear course of action for the US government. It is a must-read for students, analysts and policymakers. * Max Smeets, Senior Researcher ETH Zurich, Center for Security Studies, and author of No Shortcuts: Why States Struggle Develop a Military Cyber-Force *Table of ContentsAcknowledgments Foreword by General Paul Nakasone Chapter 1: The Misapplied Nexus of Theory and Policy Chapter 2: The Structure of Strategic Environments Chapter 3: Cyber Behavior and Dynamics Chapter 4: Theory and the Empirical Record Chapter 5: Cyber Stability Chapter 6: The Cyber Aligned Nexus of Theory and Policy Chapter 7: United States Case Study Bibliography Index
£24.49
Taylor & Francis Ltd Holistic Approach to Quantum Cryptography in
Book SynopsisThis new book discusses the concepts while also highlighting the challenges in thefield of quantum cryptography and also covering cryptographic techniques and cybersecurity techniques, in a single volume.It comprehensively covers important topics in the field of quantum cryptographywith applications, including quantum key distribution, position-based quantumcryptography, quantum teleportation, quantum e-commerce, quantum cloning, cybersecurity techniques' architectures and design, cyber security techniques management,software-defined networks, and cyber security techniques for 5G communication.The text also discusses the security of practical quantum key distribution systems,applications and algorithms developed for quantum cryptography, as well as cybersecurity through quantum computing and quantum cryptography.The text will be beneficial for graduate students, academic researchers, andprofeTable of Contents1. Towards Security in Software Defined Networks with Trust and Monitoring 2. Quantum key generation and distribution using Decoy state 3. Cyber Security Techniques, Architectures and Design 4. Secured Unmanned Aerial Vehicle based Fog Computing Network (UAV-FCN): A Review 5. Mars Surface Exploration via Unmanned Aerial Vehicles: Secured MarSE UAV Prototype 6. Quantum Cryptography in Cybersecurity: A Holistic Approach 7. Cyber Security Technique for Internet of Things using Machine Learning 8. Image Encryption and Decryption through Quantum Cryptography 9. Cyber Security Techniques Management 10. Quantum Cryptography And Quantum Key Distribution 11. Quantum Cryptography: Basics, Effects on Communication and Data Management 12. Quantum Number: An Error Correction Circuits and Methods 13. Risk Analysis Assessment of Inter-Dependency of Vulnerabilities In Cyber-Physical Systems
£120.00
CRC Press Generative AI
Book SynopsisThe cybersecurity landscape is changing, for sure. For example, one of the oldest threat variants is that of phishing. It evolved in the early 1990s, but even today it is still being used as a primary threat variant and has now become much more sophisticated, covert, and stealthy in nature. For example, it can be used to launch ransomware, social engineering, and extortion attacks.The advent of Generative AI is making this much worse. For example, a cyberattacker can now use something like ChatGPT to craft the content for phishing emails that are so convincing that it is almost impossible to tell the difference between what is real and what is fake. This is also clearly evident in the use of deepfakes, where fake images of real people are replicated to create videos to lure unsuspecting victims to a fake website.But Generative AI can also be used for the good to combat Phishing Attacks. This is the topic of this book. In this, we cover the following: A revi
£24.99
John Wiley & Sons Inc MCA Microsoft Certified Associate Azure Security
Book SynopsisPrepare for the MCA Azure Security Engineer certification exam faster and smarter with help from Sybex In the MCA Microsoft Certified Associate Azure Security Engineer Study Guide: Exam AZ-500, cybersecurity veteran Shimon Brathwaite walks you through every step you need to take to prepare for the MCA Azure Security Engineer certification exam and a career in Azure cybersecurity. You'll find coverage of every domain competency tested by the exam, including identity management and access, platform protection implementation, security operations management, and data and application security. You'll learn to maintain the security posture of an Azure environment, implement threat protection, and respond to security incident escalations. Readers will also find: Efficient and accurate coverage of every topic necessary to succeed on the MCA Azure Security Engineer examRobust discussions of all the skills you need to hit the ground running at your firstor nextAzure cybersecurity jobComplementary access to online study tools, including hundreds of bonus practice exam questions, electronic flashcards, and a searchable glossaryThe MCA Azure Security Engineer AZ-500 exam is a challenging barrier to certification. But you can prepare confidently and quickly with this latest expert resource from Sybex. It's ideal for anyone preparing for the AZ-500 exam or seeking to step into their next role as an Azure security engineer.Table of ContentsIntroduction xix Assessment Test xxv Chapter 1 Introduction to Microsoft Azure 1 What Is Microsoft Azure? 3 Cloud Environment Security Objectives 4 Confidentiality 4 Integrity 4 Availability 5 Nonrepudiation 5 Common Security Issues 5 Principle of Least Privilege 5 Zero- Trust Model 6 Defense in Depth 6 Avoid Security through Obscurity 9 The AAAs of Access Management 9 Encryption 10 End- to- End Encryption 11 Symmetric Key Encryption 11 Asymmetric Key Encryption 11 Network Segmentation 13 Basic Network Configuration 13 Unsegmented Network Example 14 Internal and External Compliance 15 Cybersecurity Considerations for the Cloud Environment 16 Configuration Management 17 Unauthorized Access 17 Insecure Interfaces/APIs 17 Hijacking of Accounts 17 Compliance 18 Lack of Visibility 18 Accurate Logging 18 Cloud Storage 18 Vendor Contracts 19 Link Sharing 19 Major Cybersecurity Threats 19 DDoS 19 Social Engineering 20 Password Attacks 21 Malware 21 Summary 24 Exam Essentials 24 Review Questions 26 Chapter 2 Managing Identity and Access in Microsoft Azure 29 Identity and Access Management 31 Identifying Individuals in a System 31 Identifying and Assigning Roles in a System and to an Individual 32 Assigning Access Levels to Individuals or Groups 33 Adding, Removing, and Updating Individuals and Their Roles in a System 33 Protecting a System’s Sensitive Data and Securing the System 33 Enforcing Accountability 34 IAM in the Microsoft Azure Platform 34 Creating and Managing Azure AD Identities 34 Managing Azure AD Groups 37 Managing Azure Users 39 Adding Users to Your Azure AD 39 Managing External Identities Using Azure AD 40 Managing Secure Access Using Azure Active Directory 42 Implementing Conditional Access Policies, Including MFA 44 Implementing Azure AD Identity Protection 45 Enabling the Policies 47 Implement Passwordless Authentication 50 Configuring an Access Review 52 Managing Application Access 57 Integrating Single Sign- On and Identity Providers for Authentication 57 Creating an App Registration 58 Configuring App Registration Permission Scopes 58 Managing App Registration Permission Consent 59 Managing API Permission to Azure Subscriptions 60 Configuring an Authentication Method for a Service Principal 61 Managing Access Control 62 Interpret Role and Resource Permissions 62 Configuring Azure Role Permissions for Management Groups, Subscriptions, Resource Groups, and Resources 63 Assigning Built- In Azure AD Roles 64 Creating and Assigning Custom Roles, Including Azure Roles and Azure AD Roles 65 Summary 66 Exam Essentials 67 Review Questions 70 Chapter 3 Implementing Platform Protections 73 Implementing Advanced Network Security 75 Securing Connectivity of Hybrid Networks 75 Securing Connectivity of Virtual Networks 77 Creating and Configuring Azure Firewalls 78 Azure Firewall Premium 79 Creating and Configuring Azure Firewall Manager 82 Creating and Configuring Azure Application Gateway 82 Creating and Configuring Azure Front Door 87 Creating and Configuring a Web Application Firewall 91 Configuring Network Isolation for Web Apps and Azure Functions 93 Implementing Azure Service Endpoints 94 Implementing Azure Private Endpoints, Including Integrating with Other Services 97 Implementing Azure Private Link 98 Implementing Azure DDoS Protection 101 Configuring Enhanced Security for Compute 102 Configuring Azure Endpoint Protection for VMs 102 Enabling Update Management in Azure Portal 104 Configuring Security for Container Services 108 Managing Access to the Azure Container Registry 109 Configuring Security for Serverless Compute 109 Microsoft Recommendations 111 Configuring Security for an Azure App Service 112 Exam Essentials 118 Review Questions 122 Chapter 4 Managing Security Operations 125 Configure Centralized Policy Management 126 Configure a Custom Security Policy 126 Create Custom Security Policies 127 Creating a Policy Initiative 128 Configuring Security Settings and Auditing by Using Azure Policy 129 Configuring and Managing Threat Protection 130 Configuring Microsoft Defender for Cloud for Servers (Not Including Microsoft Defender for Endpoint) 131 Configuring Microsoft Defender for SQL 134 Using the Microsoft Threat Modeling Tool 139 Azure Monitor 147 Visualizations in Azure Monitor 148 Configuring and Managing Security Monitoring Solutions 149 Creating and Customizing Alert Rules by Using Azure Monitor 149 Configuring Diagnostic Logging and Retention Using Azure Monitor 157 Monitoring Security Logs Using Azure Monitor 159 Microsoft Sentinel 167 Configuring Connectors in Microsoft Sentinel 170 Evaluating Alerts and Incidents in Microsoft Sentinel 175 Summary 176 Exam Essentials 177 Review Questions 179 Chapter 5 Securing Data and Applications 183 Configuring Security for Storage in Azure 184 Storage Account Access Keys 185 Configuring Access Control for Storage Accounts 185 Configuring Storage Account Access Keys 189 Configuring Azure AD Authentication for Azure Storage and Azure Files 191 Configuring Delegated Access for Storage Accounts 202 Configuring Security for Databases 220 Summary 254 Exam Essentials 255 Review Questions 257 Appendix A An Azure Security Tools Overview 261 Chapter 2, “Managing Identity and Access on Microsoft Azure” 262 Azure Active Directory (AD) 262 Microsoft Authenticator App 265 Azure API Management 265 Chapter 3, “Implementing Platform Protections” 266 Azure Firewall 266 Azure Firewall Manager 267 Azure Application Gateway 269 Azure Front Door 273 Web Application Firewall 273 Azure Service Endpoints 274 Azure Private Links 274 Azure DDoS Protection 275 Microsoft Defender for Cloud 276 Azure Container Registry 277 Azure App Service 278 Chapter 4, “Managing Security Operations” 279 Azure Policy 279 Microsoft Threat Modeling Tool 281 Microsoft Sentinel 287 How Does Microsoft Sentinel Work? 289 Automation 290 Chapter 5, “Securing Data and Applications” 290 Azure Key Vault 299 Appendix B Answers to Review Questions 301 Chapter 1: Introduction to Microsoft Azure 302 Chapter 2: Managing Identity and Access in Microsoft Azure 303 Chapter 3: Implementing Platform Protections 304 Chapter 4: Managing Security Operations 305 Chapter 5: Securing Data and Applications 306 Index 309
£38.00
John Wiley & Sons Inc Threats
Book SynopsisSecure your applications with help from your favorite Jedi masters In Threats: What Every Engineer Should Learn From Star Wars, accomplished security expert and educator Adam Shostack delivers an easy-to-read and engaging discussion of security threats and how to develop secure systems. The book will prepare you to take on the Dark Side as you learnin a structured and memorable wayabout the threats to your systems. You'll move from thinking of security issues as clever one-offs and learn to see the patterns they follow. This book brings to light the burning questions software developers should be asking about securing systems, and answers them in a fun and entertaining way, incorporating cybersecurity lessons from the much-loved Star Wars series. You don't need to be fluent in over 6 million forms of exploitation to face these threats with the steely calm of a Jedi master. You'll also find: Understandable and memorable introductions to the most important threats that every engineer should knowStraightforward software security frameworks that will help engineers bake security directly into their systemsStrategies to align large teams to achieve application security in today's fast-moving and agile worldStrategies attackers use, like tampering, to interfere with the integrity of applications and systems, and the kill chains that combine these threats into fully executed campaignsAn indispensable resource for software developers and security engineers, Threats: What Every Engineer Should Learn From Star Wars belongs on the bookshelves of everyone delivering or operating technology: from engineers to executives responsible for shipping secure code.Table of ContentsPreface xi Introduction xv 1 Spoofing and Authenticity 1 2 Tampering and Integrity 41 3 Repudiation and Proof 63 4 Information Disclosure and Confidentiality 95 5 Denial of Service and Availability 131 6 Expansion of Authority and Isolation 151 7 Predictability and Randomness 187 8 Parsing and Corruption 211 9 Kill Chains 249 Epilogue 291 Glossary 295 Bibliography 303 Story Index 317 Index 323
£17.09
John Wiley & Sons Inc The Official ISC2 CCSP CBK Reference
Book SynopsisTable of ContentsForeword to the Fourth Edition xxi Introduction xix Chapter 1 Cloud Concepts, Architecture, and Design 1 Understand Cloud Computing Concepts 2 Cloud Computing Definitions 2 Cloud Computing Roles and Responsibilities 3 Key Cloud Computing Characteristics 7 Building Block Technologies 11 Describe Cloud Reference Architecture 14 Cloud Computing Activities 14 Cloud Service Capabilities 15 Cloud Service Categories 17 Cloud Deployment Models 18 Cloud Shared Considerations 21 Impact of Related Technologies 27 Understand Security Concepts Relevant to Cloud Computing 33 Cryptography and Key Management 33 Identity and Access Control 34 Data and Media Sanitization 36 Network Security 37 Virtualization Security 39 Common Threats 41 Security Hygiene 41 Understand Design Principles of Secure Cloud Computing 43 Cloud Secure Data Lifecycle 43 Cloud- Based Business Continuity and Disaster Recovery Plan 44 Business Impact Analysis 45 Functional Security Requirements 46 Security Considerations for Different Cloud Categories 48 Cloud Design Patterns 49 DevOps Security 51 Evaluate Cloud Service Providers 51 Verification against Criteria 52 System/Subsystem Product Certifications 54 Summary 56 Chapter 2 Cloud Data Security 57 Describe Cloud Data Concepts 58 Cloud Data Lifecycle Phases 58 Data Dispersion 61 Data Flows 62 Design and Implement Cloud Data Storage Architectures 63 Storage Types 63 Threats to Storage Types 66 Design and Apply Data Security Technologies and Strategies 67 Encryption and Key Management 67 Hashing 70 Data Obfuscation 71 Tokenization 73 Data Loss Prevention 74 Keys, Secrets, and Certificates Management 77 Implement Data Discovery 78 Structured Data 79 Unstructured Data 80 Semi- structured Data 81 Data Location 82 Implement Data Classification 82 Data Classification Policies 83 Mapping 85 Labeling 86 Design and Implement Information Rights Management 87 Objectives 88 Appropriate Tools 89 Plan and Implement Data Retention, Deletion, and Archiving Policies 89 Data Retention Policies 90 Data Deletion Procedures and Mechanisms 93 Data Archiving Procedures and Mechanisms 94 Legal Hold 95 Design and Implement Auditability, Traceability, and Accountability of Data Events 96 Definition of Event Sources and Requirement of Event Attribution 97 Logging, Storage, and Analysis of Data Events 99 Chain of Custody and Nonrepudiation 100 Summary 101 Chapter 3 Cloud Platform and Infrastructure Security 103 Comprehend Cloud Infrastructure and Platform Components 104 Physical Environment 104 Network and Communications 106 Compute 107 Virtualization 108 Storage 110 Management Plane 111 Design a Secure Data Center 113 Logical Design 114 Physical Design 116 Environmental Design 117 Analyze Risks Associated with Cloud Infrastructure and Platforms 119 Risk Assessment 119 Cloud Vulnerabilities, Threats, and Attacks 122 Risk Mitigation Strategies 123 Plan and Implementation of Security Controls 124 Physical and Environmental Protection 124 System, Storage, and Communication Protection 125 Identification, Authentication, and Authorization in Cloud Environments 127 Audit Mechanisms 128 Plan Disaster Recovery and Business Continuity 131 Business Continuity/Disaster Recovery Strategy 131 Business Requirements 132 Creation, Implementation, and Testing of Plan 134 Summary 138 Chapter 4 Cloud Application Security 139 Advocate Training and Awareness for Application Security 140 Cloud Development Basics 140 Common Pitfalls 141 Common Cloud Vulnerabilities 142 Describe the Secure Software Development Life Cycle Process 144 NIST Secure Software Development Framework 145 OWASP Software Assurance Maturity Model 145 Business Requirements 145 Phases and Methodologies 146 Apply the Secure Software Development Life Cycle 149 Cloud- Specific Risks 149 Threat Modeling 153 Avoid Common Vulnerabilities during Development 156 Secure Coding 156 Software Configuration Management and Versioning 157 Apply Cloud Software Assurance and Validation 158 Functional and Non- functional Testing 159 Security Testing Methodologies 160 Quality Assurance 164 Abuse Case Testing 164 Use Verified Secure Software 165 Securing Application Programming Interfaces 165 Supply- Chain Management 166 Third- Party Software Management 166 Validated Open- Source Software 167 Comprehend the Specifics of Cloud Application Architecture 168 Supplemental Security Components 169 Cryptography 171 Sandboxing 172 Application Virtualization and Orchestration 173 Design Appropriate Identity and Access Management Solutions 174 Federated Identity 175 Identity Providers 175 Single Sign- on 176 Multifactor Authentication 176 Cloud Access Security Broker 178 Summary 179 Chapter 5 Cloud Security Operations 181 Build and Implement Physical and Logical Infrastructure for Cloud Environment 182 Hardware- Specific Security Configuration Requirements 182 Installation and Configuration of Virtualization Management Tools 185 Virtual Hardware–Specific Security Configuration Requirements 186 Installation of Guest Operating System Virtualization Toolsets 188 Operate Physical and Logical Infrastructure for Cloud Environment 188 Configure Access Control for Local and Remote Access 188 Secure Network Configuration 190 Operating System Hardening through the Application of Baselines 195 Availability of Stand- Alone Hosts 196 Availability of Clustered Hosts 197 Availability of Guest Operating Systems 199 Manage Physical and Logical Infrastructure for Cloud Environment 200 Access Controls for Remote Access 201 Operating System Baseline Compliance Monitoring and Remediation 202 Patch Management 203 Performance and Capacity Monitoring 205 Hardware Monitoring 206 Configuration of Host and Guest Operating System Backup and Restore Functions 207 Network Security Controls 208 Management Plane 212 Implement Operational Controls and Standards 212 Change Management 213 Continuity Management 214 Information Security Management 216 Continual Service Improvement Management 217 Incident Management 218 Problem Management 221 Release Management 221 Deployment Management 222 Configuration Management 224 Service Level Management 225 Availability Management 226 Capacity Management 227 Support Digital Forensics 228 Forensic Data Collection Methodologies 228 Evidence Management 230 Collect, Acquire, and Preserve Digital Evidence 231 Manage Communication with Relevant Parties 234 Vendors 235 Customers 236 Partners 238 Regulators 238 Other Stakeholders 239 Manage Security Operations 239 Security Operations Center 240 Monitoring of Security Controls 244 Log Capture and Analysis 245 Incident Management 248 Summary 253 Chapter 6 Legal, Risk, and Compliance 255 Articulating Legal Requirements and Unique Risks within the Cloud Environment 256 Conflicting International Legislation 256 Evaluation of Legal Risks Specific to Cloud Computing 258 Legal Frameworks and Guidelines 258 eDiscovery 265 Forensics Requirements 267 Understand Privacy Issues 267 Difference between Contractual and Regulated Private Data 268 Country- Specific Legislation Related to Private Data 272 Jurisdictional Differences in Data Privacy 277 Standard Privacy Requirements 278 Privacy Impact Assessments 280 Understanding Audit Process, Methodologies, and Required Adaptations for a Cloud Environment 281 Internal and External Audit Controls 282 Impact of Audit Requirements 283 Identify Assurance Challenges of Virtualization and Cloud 284 Types of Audit Reports 285 Restrictions of Audit Scope Statements 288 Gap Analysis 289 Audit Planning 290 Internal Information Security Management System 291 Internal Information Security Controls System 292 Policies 293 Identification and Involvement of Relevant Stakeholders 296 Specialized Compliance Requirements for Highly Regulated Industries 297 Impact of Distributed Information Technology Model 298 Understand Implications of Cloud to Enterprise Risk Management 299 Assess Providers Risk Management Programs 300 Differences between Data Owner/Controller vs. Data Custodian/Processor 301 Regulatory Transparency Requirements 302 Risk Treatment 303 Risk Frameworks 304 Metrics for Risk Management 307 Assessment of Risk Environment 307 Understand Outsourcing and Cloud Contract Design 309 Business Requirements 309 Vendor Management 311 Contract Management 312 Supply Chain Management 314 Summary 316 Index 317
£48.75
Manning Publications Azure Security
Book SynopsisSecure your Azure applications the right way with the expert DevSecOps techniques you'll learn in this essential handbook. For software and security engineers building and securing Azure applications. In Azure Security you'll learn vital security skills, including how to: Configure Conditional Access policies to implement secure access Implement Azure Web Application Firewall (WAF) on Application Gateway and Azure Front Door Deploy Azure Firewall Premium to monitor network activities for malicious activity Enable Microsoft Defender for Cloud to continuously assess your workloads for misconfiguration Use Microsoft Sentinel to create analytics rules to detect threats and suspicious activity Set up Azure Policy to ensure that resource states and deployment is compliant with your business rules About the technology Attacks against cloud-based applications are increasingly common and sophisticated. It's vital for any developer or resource owner to understand how to properly configure their Azure cloud environments and establish reliable security best practices. The Azure platform comes with dozens of built-in security tools to help keep your systems safe. This book will teach you exactly how to set them up for maximum effectiveness.
£38.99
No Starch Press,US Cybersecurity For Small Networks: A No-Nonsense
Book SynopsisThis book is an easy-to-follow series of tutorials that will lead readers through different facets of protecting household or small-business networks from cyber attacks. You'll learn how to use pfSense to build a firewall, lock down wireless, segment a network into protected zones, configure a VPN (virtual private network) to hide and encrypt network traffic and communications, set up proxies to speed up network performance and hide the source of traffic, block ads, install and configure an antivirus, back up your data securely, and even how to monitor your network for unauthorized activity and alert you to intrusion.Trade Review“An excellent crash course for someone like me with a technical background but little security experience. I've always wanted to beef up my home server and network security but didn't know where to start . . . This book has given me actionable steps I can take today, this week, this month, and beyond. And it gives me the confidence that I'm following reasonable best practices for an actual small network.”—Chris Miller, GoodReads Reviewer
£28.49
BCS Learning & Development Limited Information Security Management Principles
Book SynopsisIn today’s technology-driven environment there is an ever-increasing demand for information delivery. A compromise has to be struck between security and availability. This book is a pragmatic guide to information assurance for both business professionals and technical experts. Written in an accessible manner, Information Security Management Principles provides practical guidance and actionable steps to better prepare your workplace and your home alike, and keep your information secure. This book is a primer for those new to the subject as well as a guide for more experienced practitioners. It explains the fundamentals of information security, how to shape good organisational security practice, and how to recover effectively should the worst happen. This third edition has been updated to reflect the latest threats and vulnerabilities in the IT security landscape, and updates to standards, good practice guides and legislation. It also includes updates to the BCS Certification in Information Security Management Principles, which this book supports. A valuable guide to both current professionals at all levels and those wishing to embark on an information security career Offers practical guidance and actionable steps for individuals and businesses to protect themselves Highly accessible and terminology is clearly explained and supported with current, real-world examples Trade Review'This book is fantastic for those studying information security management and as a desk-side reference. It is comprehensive yet concise. I would recommend this book to anybody studying for the qualification as well as anyone in senior management positions looking to understand the basics. The language used is refreshingly understandable, making the book accessible to those outside the specialism.' -- Helen Mary Jones * Group Information Security Manager, The Jockey Club *Table of Contents Information Security Principles Information Risk Information Security Framework Security Lifecycles Procedural and People Security Controls Technical Security Controls Physical and Environmental Security Disaster Recovery and Business Continuity Management Other Technical Aspects
£42.74
Springer Nature Switzerland AG Open Source Intelligence and Cyber Crime: Social
Book SynopsisThis book shows how open source intelligence can be a powerful tool for combating crime by linking local and global patterns to help understand how criminal activities are connected. Readers will encounter the latest advances in cutting-edge data mining, machine learning and predictive analytics combined with natural language processing and social network analysis to detect, disrupt, and neutralize cyber and physical threats. Chapters contain state-of-the-art social media analytics and open source intelligence research trends. This multidisciplinary volume will appeal to students, researchers, and professionals working in the fields of open source intelligence, cyber crime and social network analytics. Chapter Automated Text Analysis for Intelligence Purposes: A Psychological Operations Case Study is available open access under a Creative Commons Attribution 4.0 International License via link.springer.com.Table of ContentsChapter1. Studying the Weaponization of Social Media: Case Studies of Anti-NATO Disinformation Campaigns.- Chapter2. Cognitively-Inspired Inference for Malware Task Indentation.- Chapter3. Beyond the ‘Silk Road’: Assessing Illicit Drug Marketplaces on the Public Web.- Chapter4. Protecting the Web from Misinformation.- Chapter5. Social Media for Mental Health: Data, Methods, and Findings.- Chapter6. Twitter Bots and the Swedish Election.- Chapter7. Automated Text Analysis for Intelligence Purposes: A Psychological Operations Case Study.- Chapter8. You are Known by Your Friends: Leveraging Network Metrics for Bot Detection in Twitter.- Chapter9. Inferring Systemic Nets with Applications to Islamist Forums.
£89.99
BPB Publications Advanced Malware Analysis and Intelligence
Book Synopsis
£29.92
Apress Cybersecurity Audit Essentials
Book SynopsisChapter 1: Introduction to Cybersecurity Audits.- Chapter 2: Planning the Cybersecurity Audit.- Chapter 3: Assessing Security Control.- Chapter 4: Compliance and Regulations.- Chapter 5 Introduction to Cyber Risk Management.- Chapter 6 Tools for Network and Cyber Security Audits.- Chapter 7 How to Write an Effective Cybersecurity Audit Report.- Chapter 8 Real-Life Scenarios and Case Studies.
£31.34
John Wiley & Sons Inc CompTIA Security Study Guide with over 500
Book SynopsisTable of ContentsIntroduction xxxi Chapter 1 Today’s Security Professional 1 Cybersecurity Objectives 2 Data Breach Risks 3 The DAD Triad 4 Breach Impact 5 Implementing Security Controls 7 Gap Analysis 7 Security Control Categories 8 Security Control Types 9 Data Protection 10 Data Encryption 11 Data Loss Prevention 11 Data Minimization 12 Access Restrictions 13 Segmentation and Isolation 13 Summary 13 Exam Essentials 14 Review Questions 16 Chapter 2 Cybersecurity Threat Landscape 21 Exploring Cybersecurity Threats 23 Classifying Cybersecurity Threats 23 Threat Actors 25 Attacker Motivations 31 Threat Vectors and Attack Surfaces 32 Threat Data and Intelligence 35 Open Source Intelligence 35 Proprietary and Closed- Source Intelligence 38 Assessing Threat Intelligence 39 Threat Indicator Management and Exchange 40 Information Sharing Organizations 41 Conducting Your Own Research 42 Summary 42 Exam Essentials 43 Review Questions 45 Chapter 3 Malicious Code 49 Malware 50 Ransomware 51 Trojans 52 Worms 54 Spyware 55 Bloatware 56 Viruses 57 Keyloggers 59 Logic Bombs 60 Rootkits 60 Summary 62 Exam Essentials 62 Review Questions 64 Chapter 4 Social Engineering and Password Attacks 69 Social Engineering and Human Vectors 70 Social Engineering Techniques 71 Password Attacks 76 Summary 78 Exam Essentials 78 Review Questions 80 Chapter 5 Security Assessment and Testing 85 Vulnerability Management 87 Identifying Scan Targets 87 Determining Scan Frequency 89 Configuring Vulnerability Scans 91 Scanner Maintenance 95 Vulnerability Scanning Tools 98 Reviewing and Interpreting Scan Reports 101 Confirmation of Scan Results 111 Vulnerability Classification 112 Patch Management 112 Legacy Platforms 113 Weak Configurations 115 Error Messages 115 Insecure Protocols 116 Weak Encryption 117 Penetration Testing 118 Adopting the Hacker Mindset 119 Reasons for Penetration Testing 120 Benefits of Penetration Testing 120 Penetration Test Types 121 Rules of Engagement 123 Reconnaissance 125 Running the Test 125 Cleaning Up 126 Audits and Assessments 126 Security Tests 127 Security Assessments 128 Security Audits 129 Vulnerability Life Cycle 131 Vulnerability Identification 131 Vulnerability Analysis 132 Vulnerability Response and Remediation 132 Validation of Remediation 132 Reporting 133 Summary 133 Exam Essentials 134 Review Questions 136 Chapter 6 Application Security 141 Software Assurance Best Practices 143 The Software Development Life Cycle 143 Software Development Phases 144 DevSecOps and DevOps 146 Designing and Coding for Security 147 Secure Coding Practices 148 API Security 149 Software Security Testing 149 Analyzing and Testing Code 150 Injection Vulnerabilities 151 SQL Injection Attacks 151 Code Injection Attacks 155 Command Injection Attacks 155 Exploiting Authentication Vulnerabilities 156 Password Authentication 156 Session Attacks 157 Exploiting Authorization Vulnerabilities 160 Insecure Direct Object References 161 Directory Traversal 161 File Inclusion 163 Privilege Escalation 163 Exploiting Web Application Vulnerabilities 164 Cross- Site Scripting (XSS) 164 Request Forgery 167 Application Security Controls 168 Input Validation 168 Web Application Firewalls 170 Parameterized Queries 170 Sandboxing 171 Code Security 171 Secure Coding Practices 173 Source Code Comments 174 Error Handling 174 Hard- Coded Credentials 175 Package Monitoring 175 Memory Management 176 Race Conditions 177 Unprotected APIs 178 Automation and Orchestration 178 Use Cases of Automation and Scripting 179 Benefits of Automation and Scripting 179 Other Considerations 180 Summary 181 Exam Essentials 181 Review Questions 183 Chapter 7 Cryptography and the PKI 189 An Overview of Cryptography 190 Historical Cryptography 191 Goals of Cryptography 196 Confidentiality 197 Integrity 199 Authentication 200 Non-repudiation 200 Cryptographic Concepts 200 Cryptographic Keys 201 Ciphers 202 Modern Cryptography 202 Cryptographic Secrecy 202 Symmetric Key Algorithms 204 Asymmetric Key Algorithms 205 Hashing Algorithms 208 Symmetric Cryptography 208 Data Encryption Standard 208 Advanced Encryption Standard 209 Symmetric Key Management 209 Asymmetric Cryptography 211 RSA 212 Elliptic Curve 213 Hash Functions 214 Sha 215 md 5 216 Digital Signatures 216 HMAC 217 Public Key Infrastructure 218 Certificates 218 Certificate Authorities 219 Certificate Generation and Destruction 220 Certificate Formats 223 Asymmetric Key Management 224 Cryptographic Attacks 225 Brute Force 225 Frequency Analysis 225 Known Plain Text 226 Chosen Plain Text 226 Related Key Attack 226 Birthday Attack 226 Downgrade Attack 227 Hashing, Salting, and Key Stretching 227 Exploiting Weak Keys 228 Exploiting Human Error 228 Emerging Issues in Cryptography 229 Tor and the Dark Web 229 Blockchain 229 Lightweight Cryptography 230 Homomorphic Encryption 230 Quantum Computing 230 Summary 231 Exam Essentials 231 Review Questions 233 Chapter 8 Identity and Access Management 237 Identity 239 Authentication and Authorization 240 Authentication and Authorization Technologies 241 Authentication Methods 246 Passwords 247 Multifactor Authentication 251 One- Time Passwords 252 Biometrics 254 Accounts 256 Account Types 256 Provisioning and Deprovisioning Accounts 257 Access Control Schemes 259 Filesystem Permissions 260 Summary 262 Exam Essentials 262 Review Questions 264 Chapter 9 Resilience and Physical Security 269 Resilience and Recovery in Security Architectures 271 Architectural Considerations and Security 273 Storage Resiliency 274 Response and Recovery Controls 280 Capacity Planning for Resilience and Recovery 283 Testing Resilience and Recovery Controls and Designs 284 Physical Security Controls 285 Site Security 285 Detecting Physical Attacks 291 Summary 291 Exam Essentials 292 Review Questions 294 Chapter 10 Cloud and Virtualization Security 299 Exploring the Cloud 300 Benefits of the Cloud 301 Cloud Roles 303 Cloud Service Models 303 Cloud Deployment Models 307 Private Cloud 307 Shared Responsibility Model 309 Cloud Standards and Guidelines 312 Virtualization 314 Hypervisors 314 Cloud Infrastructure Components 316 Cloud Compute Resources 316 Cloud Storage Resources 319 Cloud Networking 322 Cloud Security Issues 325 Availability 325 Data Sovereignty 326 Virtualization Security 327 Application Security 327 Governance and Auditing of Third- Party Vendors 328 Hardening Cloud Infrastructure 328 Cloud Access Security Brokers 328 Resource Policies 329 Secrets Management 330 Summary 331 Exam Essentials 331 Review Questions 333 Chapter 11 Endpoint Security 337 Operating System Vulnerabilities 339 Hardware Vulnerabilities 340 Protecting Endpoints 341 Preserving Boot Integrity 342 Endpoint Security Tools 344 Hardening Techniques 350 Hardening 350 Service Hardening 350 Network Hardening 352 Default Passwords 352 Removing Unnecessary Software 353 Operating System Hardening 353 Configuration, Standards, and Schemas 356 Encryption 357 Securing Embedded and Specialized Systems 358 Embedded Systems 358 SCADA and ICS 361 Securing the Internet of Things 362 Communication Considerations 363 Security Constraints of Embedded Systems 364 Asset Management 365 Summary 368 Exam Essentials 369 Review Questions 371 Chapter 12 Network Security 375 Designing Secure Networks 377 Infrastructure Considerations 380 Network Design Concepts 380 Network Segmentation 383 Zero Trust 385 Network Access Control 387 Port Security and Port- Level Protections 388 Virtual Private Networks and Remote Access 390 Network Appliances and Security Tools 392 Deception and Disruption Technology 399 Network Security, Services, and Management 400 Secure Protocols 406 Using Secure Protocols 406 Secure Protocols 407 Network Attacks 410 On- Path Attacks 411 Domain Name System Attacks 412 Credential Replay Attacks 414 Malicious Code 415 Distributed Denial- of- Service Attacks 415 Summary 418 Exam Essentials 419 Review Questions 421 Chapter 13 Wireless and Mobile Security 425 Building Secure Wireless Networks 426 Connection Methods 427 Wireless Network Models 431 Attacks Against Wireless Networks and Devices 432 Designing a Network 435 Controller and Access Point Security 438 Wi- Fi Security Standards 438 Wireless Authentication 440 Managing Secure Mobile Devices 442 Mobile Device Deployment Methods 442 Hardening Mobile Devices 444 Mobile Device Management 444 Summary 448 Exam Essentials 449 Review Questions 450 Chapter 14 Monitoring and Incident Response 455 Incident Response 457 The Incident Response Process 458 Training 462 Threat Hunting 463 Understanding Attacks and Incidents 464 Incident Response Data and Tools 466 Monitoring Computing Resources 466 Security Information and Event Management Systems 466 Alerts and Alarms 469 Log Aggregation, Correlation, and Analysis 470 Rules 471 Benchmarks and Logging 478 Reporting and Archiving 478 Mitigation and Recovery 479 Secure Orchestration, Automation, and Response (SOAR) 479 Containment, Mitigation, and Recovery Techniques 479 Root Cause Analysis 482 Summary 483 Exam Essentials 484 Review Questions 485 Chapter 15 Digital Forensics 489 Digital Forensic Concepts 490 Legal Holds and e- Discovery 491 Conducting Digital Forensics 493 Acquiring Forensic Data 493 Acquisition Tools 497 Validating Forensic Data Integrity 500 Data Recovery 502 Forensic Suites and a Forensic Case Example 503 Reporting 507 Digital Forensics and Intelligence 508 Summary 508 Exam Essentials 509 Review Questions 511 Chapter 16 Security Governance and Compliance 515 Security Governance 518 Corporate Governance 518 Governance, Risk, and Compliance Programs 520 Information Security Governance 520 Types of Governance Structures 521 Understanding Policy Documents 521 Policies 522 Standards 524 Procedures 526 Guidelines 528 Exceptions and Compensating Controls 529 Monitoring and Revision 530 Change Management 531 Change Management Processes and Controls 532 Version Control 534 Documentation 535 Personnel Management 535 Least Privilege 535 Separation of Duties 535 Job Rotation and Mandatory Vacations 536 Clean Desk Space 536 Onboarding and Offboarding 536 Nondisclosure Agreements 537 Social Media 537 Third- Party Risk Management 537 Vendor Selection 537 Vendor Assessment 538 Vendor Agreements 538 Vendor Monitoring 539 Winding Down Vendor Relationships 540 Complying with Laws and Regulations 540 Common Compliance Requirements 541 Compliance Reporting 541 Consequences of Noncompliance 542 Compliance Monitoring 543 Adopting Standard Frameworks 543 NIST Cybersecurity Framework 544 NIST Risk Management Framework 546 ISO Standards 547 Benchmarks and Secure Configuration Guides 549 Security Awareness and Training 550 User Training 551 Ongoing Awareness Efforts 553 Summary 554 Exam Essentials 555 Review Questions 557 Chapter 17 Risk Management and Privacy 561 Analyzing Risk 563 Risk Identification 564 Risk Assessment 565 Risk Analysis 567 Managing Risk 570 Risk Mitigation 571 Risk Avoidance 572 Risk Transference 572 Risk Acceptance 573 Risk Tracking 574 Risk Register 575 Risk Reporting 576 Disaster Recovery Planning 577 Disaster Types 577 Business Impact Analysis 578 Privacy 578 Data Inventory 579 Information Classification 580 Data Roles and Responsibilities 581 Information Life Cycle 583 Privacy Enhancing Technologies 584 Privacy and Data Breach Notification 585 Summary 585 Exam Essentials 585 Review Questions 587 Appendix Answers to Review Questions 591 Chapter 1: Today’s Security Professional 592 Chapter 2: Cybersecurity Threat Landscape 593 Chapter 3: Malicious Code 595 Chapter 4: Social Engineering and Password Attacks 597 Chapter 5: Security Assessment and Testing 600 Chapter 6: Application Security 602 Chapter 7: Cryptography and the PKI 604 Chapter 8: Identity and Access Management 605 Chapter 9: Resilience and Physical Security 607 Chapter 10: Cloud and Virtualization Security 609 Chapter 11: Endpoint Security 611 Chapter 12: Network Security 614 Chapter 13: Wireless and Mobile Security 616 Chapter 14: Monitoring and Incident Response 619 Chapter 15: Digital Forensics 621 Chapter 16: Security Governance and Compliance 623 Chapter 17: Risk Management and Privacy 626 Index 629
£34.00
McGraw-Hill Education CCSP Certified Cloud Security Professional
Book SynopsisThis fully updated self-study guide delivers 100% coverage of all topics on the current version of the CCSP examThoroughly revised for the 2022 edition of the exam, this highly effective test preparation guide covers all six domains within the CCSP Body of Knowledge. The book offers clear explanations of every subject on the CCSP exam and features accurate practice questions and real-world examples. New, updated, or expanded coverage includes cloud data security, DevOps security, mobile computing, threat modeling paradigms, regulatory and legal frameworks, and best practices and standards.Written by a respected computer security expert, CCSP Certified Cloud Security Professional All-in-One Exam Guide, Third Edition is both a powerful study tool and a valuable reference that will serve professionals long after the test. To aid in self-study, each chapter includes exam tips that highlight key information, a summary that serves as a quick review of salient p
£35.99
McGraw-Hill Education CompTIA CySA Cybersecurity Analyst Certification
Book SynopsisPrepare for the CompTIA CySA+â certification exam using this fully updated self-study resourceTake the current version of the challenging CompTIA CySA+â certification exam with confidence using the detailed information contained in this up-to-date integrated study system. Based on proven pedagogy, the book contains detailed explanations, real-world examples, step-by-step exercises, and exam-focused special elements that teach and reinforce practical skills.CompTIA CySA+â Cybersecurity Analyst Certification All-in-One Exam Guide, Third Edition (Exam CS0-003) covers 100% of 2023 exam objectives and features re-structured content and new topics. Online content enables you to test yourself with full-length, timed practice exams or create customized quizzes by chapter or exam domain. Designed to help you pass the exam with ease, this comprehensive guide also serves as an essential on-the-job reference.Includes access to the TotalTester
£40.49
O'Reilly Media Building a Cyber Risk Management Program
Book SynopsisIdeal for corporate directors, senior executives, security risk practitioners, and auditors at many levels, this guide offers both the strategic insight and tactical guidance you're looking for.
£35.99
O'Reilly Media Certified Kubernetes Security Specialist CKS
Book SynopsisThis practical book helps you fully prepare for the certification exam by walking you through all of the topics covered.
£33.74
No Starch Press,US Hacking Apis: Breaking Web Application
Book SynopsisYou'll learn how REST and GraphQL APIs work in the wild and set up a streamlined API testing lab with Burp Suite and Postman. Then you'll master tools useful for reconnaissance, endpoint analysis, and fuzzing, such as Kiterunner. Next, you'll learn to perform common attacks, like those targeting an API's authentication mechanisms and the injection vulnerabilities commonly found in web applications. You'll also learn techniques for bypassing protections against these attacks so that you can uncover API bugs other hackers aren't finding and improve the security of applications on the web.Trade Review"Corey Ball takes you on a journey through the lifecycle of APIs in such a manner that you’re wanting to not only know more, but also anticipating trying out your newfound knowledge on the next legitimate target. From concepts to examples, through to identifying tools and demonstrating them in fine detail, this book has it all. It IS the motherload for API hacking, and should be found next to the desk, well-read by ANYONE wanting to take this level of adversarial research, assessment, or DevSecOps seriously."—Chris Roberts, @Sidragon1, vCISO/Researcher/Hacker"This book opens the doors to the field of API Hacking, a subject not very well understood. Using real-world examples that emphasize Access Control issues, this book will help you understand the ins and outs of securing APIs, hunt great bounties, and help organizations improve their API Security!"—Inon Shkedy, @InonShkedy, Security Researcher"Even though the internet is filled with information on any topic possible in cybersecurity, it is still hard to find solid insight on performing penetration tests on APIs. Corey's book satisfies this demand—not only for the beginner cybersecurity practitioner, but also for the seasoned expert."—Cristi Vlad, @CristiVlad25, Cybersecurity Researcher"Hacking APIs is extremely helpful for anyone who wants to get into penetration testing. In particular, this book gives you the tools to start testing the security of APIs, which are becoming a weak point for many modern web applications. Experienced security folks can get something out of the book too, as it features automation tips and protection bypass techniques that will up any pentesters' game."—Vickie Li, @vickieli7, Developer Evangelist, Author of Bug Bounty Bootcamp"[Hacking APIs is] the best source of API info I've seen. If you're curious about what APIs are and how they work, read it once. If you work with or create APIs, read it twice. If you break APIs, read it three times."—Graham Helton, @GrahamHelton3"One of the few books that is actually dedicated to API hacking. . . . a great resource for anyone who wants to learn more about API security and how to hack into web applications. It provides in-depth information on how to break through various types of APIs, as well as tips on how to stay ahead of the curve in this rapidly changing field." —Dana Epp, Security Boulevard"This book has more to offer than hacking APIs but sets down a solid foundation of tools and techniques that would benefit any developer or QA Engineer that has to develop, test, or otherwise work with APIs." —John Wenning, Cybersecurity Researcher, Fortra"A thorough guide to what APIs are, how they work, what technologies they use, the various common insecurities that APIs have, and, most importantly, how to exploit them. . . . I would recommend Hacking APIs as a great read for anyone interested in learning more about the vulnerable side of APIs."—Darlene Hibbs, Senior Cybersecurity Researcher, Fortra
£42.74
No Starch Press,US Math For Security: From Graphs and Geometry to
Book SynopsisApplied Math for Security is one of the first math-based guides specifically geared for information security practitioners. Readers will learn how to use concepts from various fields of mathematics - like graph theory, computational geometry, and statistics - to create and implement ready-to-use security tools. The book is written in a lively, conversational style that engages readers from the get-go. Chapters are enriched with code examples written in Python, and feature hands-on 'proof of concept' projects that involve developing math-based applications to solve real-world problems. Readers are also able to apply the mathematical constructs that they learn to a variety of challenging scenarios, like determining the ideal location for fire stations, disrupting information flow in a social network, building facial recognition software, and designing custom tools for modern security work.Trade Review"A very practical book for security. . . . a real eye-opener."—William Gasarch, Professor, University of Maryland-Dept of Computer Science"A really nice introduction to graph theory and computational geometry for people who know a bit of Python and without a mathematical background."—Julien Voisin, Artificial Truth"The book was very easy to follow, I'd expect anyone with a technical or stats background to be able to dive right in given the step-by-step instructions and explanations provided by Daniel."—@WithSandra, tech YouTuber and security analyst"Whether you're an aspiring security professional, a social network analyst, or an innovator seeking to create cutting-edge security solutions, Math for Security will empower you to solve complex problems with precision and confidence. "—Midwest Book ReviewTable of ContentsAcknowledgments IntroductionPART I: ENVIRONMENT AND CONVENTIONSChapter 1: Setting up the EnvironmentChapter 2: Programming and Math ConventionsPART II: GRAPH THEORY AND COMPUTATIONAL GEOMETRYChapter 3: Securing Networks with Graph TheoryChapter 4: Building a Network Traffic Analysis Tool Chapter 5: Identifying Threats with Social Network AnalysisChapter 6: Analyzing Social Networks to Prevent Security IncidentsChapter 7: Using Geometry to Improve Security PracticesChapter 8: Tracking People in Physical Space with Digital InformationChapter 9: Computational Geometry for Safety Resource DistributionChapter 10: Computational Geometry for Facial RecognitionPART III: THE ART GALLERY PROBLEMChapter 11: Distributing Security Resources to Guard a SpaceChapter 12: The Minimum Viable Product Approach to Security Software DevelopmentChapter 13: Delivering Python ApplicationsNotesIndex
£35.99
Pearson Education (US) Cybersecurity Myths and Misconceptions
Book SynopsisEugene H. Spafford, PhD, is a professor in Computer Science at Purdue University. In his 35-year career, Spaf has been honored with every major award in cybersecurity. Leigh Metcalf, PhD, is a Senior Network Security Research Analyst at the Carnegie Mellon University Software Engineering Institute's cybersecurity-focused CERT division. Josiah Dykstra, PhD, is a cybersecurity practitioner, researcher, author, and speaker. He is the owner of Designer Security and has worked at the US National Security Agency for 18 years.Trade Review"Many security leaders are traditionally in charge of correcting misconceptions just as much as they are in charge of building up solid security practices. We have plenty of resources on practices--but this book is the crucial guide to that essential myth busting."--Phil Venables, CISO, Google Cloud "I'm writing this on my phone, over Wi-Fi, in an airplane on my way to Black Hat, one of the world's largest security conferences. The fact that I'm able to do this at all shows how much we've really learned about cybersecurity over the decades. Now it's all collected in one place for everyone to share. Thank the wise authors, and most importantly: GET OFF THEIR LAWN."--Wendy Nather, Head of Advisory CISOs, Cisco "This book is astounding. A true tour de force--which I have never said about any other book. Inverting the viewpoint is a stroke of genius. This is going to be on my grabbable-at-any-time shelf. What I learned, recalled, and was refreshed on with technically astute agnosticism cannot be measured; just appreciated as a profound historical compilation of security practice and theory. Bravo!"--Winn Schwartaul, Founder and Chief Visionary Officer, The Security Awareness Company "I am happy to endorse the central idea of this book--that cybersecurity is rife with myths that are themselves part of the problem. The brain wants to understand, the world grows ever more complicated, and the sum of the two is myth-making. As the authors say, even if some understanding is true at some time, with enough change what was true becomes a myth soon enough. As such, an acquired immunity to myths is a valuable skill for the cybersecurity practitioner if no other. The paramount goal of all security engineering is No Silent Failure, but myths perpetuate if not create silent failure. Why? Because a state of security is the absence of unmitigable surprise and you cannot mitigate what you don't know is going on. Myths blind us to reality. Ignorance of them is not bliss. This book is a vaccine."--Dan Geer, CISO, In-Q-Tel "This is a fun read for all levels. I like their rapid fire delivery and the general light they cast on so many diverse myths. This book will change the cybersecurity industry for the better."--Michael Sikorski, Author of Practical Malware Analysis & CTO, Unit 42 at Palo Alto NetworksTable of ContentsForeword by Vint Cerf xxiiiIntroduction xxivAcknowledgments xxxiiiAbout the Authors xxxiv Part I: General Issues 1 Chapter 1: What Is Cybersecurity? 2Everyone Knows What "Cybersecurity" Means 2We Can Measure How Secure Our Systems Are 5The Primary Goal of Cybersecurity Is Security 11Cybersecurity Is About Obvious Risks 12Sharing More Cyber Threat Intel Will Make Things Better 14What Matters to You Matters to Everyone Else 16Product X Will Make You Secure 17Macs Are Safer Than PCs, Linux Is Safer Than Windows 18Open Source Software Is More Secure Than Closed Source Software 19Technology X Will Make You Secure 20Process X Will Make You Secure 21Færie Dust Can Make Old Ideas Magically Revolutionary 22Passwords Should Be Changed Often 23Believe and Fear Every Hacking Demo You See 26Cyber Offense Is Easier Than Defense 27Operational Technology (OT) Is Not Vulnerable 29Breaking Systems Is the Best Way to Establish Yourself 30Because You Can, You Should 30Better Security Means Worse Privacy 32Further Reading 33 Chapter 2: What Is the Internet? 36Everyone Knows What the "Internet" Means 36An IP Address Identifies a Unique Machine 37The Internet Is Managed and Controlled by a Central Body 39The Internet Is Largely Static 40Your Network Is Static 41Email Is Private 43Cryptocurrency Is Untraceable 44Everything Can Be Fixed with Blockchain 46The Internet Is Like an Iceberg 46A VPN Makes You Anonymous 48A Firewall Is Enough 49Further Reading 51 Part II: Human Issues 55 Chapter 3: Faulty Assumptions and Magical Thinking 56Humans Will Behave Rationally, So Blame the User! 57We Know Everything We Need to Know About Cybersecurity Problems 62Compliance Equals (Complete) Security 63Authentication Provides Confidentiality 65I Can Never Be Secure, So Why Bother? 65I Am Too Small/Insignificant to Be a Target 66Everybody Is Out to Get Me 69I Engage Only with Trusted Websites, So My Data Is Safe from a Breach 71Security by Obscurity Is Reasonably Secure 72The Illusions of Visibility and Control 74Five 9's Is the Key to Cybersecurity 76Everybody Has Top-of-the-Line Technology 78We Can Predict Future Threats 80Security People Control Security Outcomes 81All Bad Outcomes Are the Result of a Bad Decision 82More Security Is Always Better 84Best Practices Are Always Best 85Because It Is Online It Must Be True/Correct 86Further Reading 87 Chapter 4: Fallacies and Misunderstandings 88The False Cause Fallacy: Correlation Is Causation 89Absence of Evidence Is Evidence of Absence 92The Straw Hacker Fallacy 94Ad Hominem Fallacy 95Hasty Generalization Fallacy 96Regression Fallacy 97Base Rate Fallacy 98Gambler's Fallacy 100Fallacies of Anomalies 100Ignorance of Black Swans 101Conjunction and Disjunction Fallacies 103Valence Effect 104Endowment Effect 104Sunk Cost Fallacy 105Bonus Fallacies 107Further Reading 109 Chapter 5: Cognitive Biases 110Action Bias 112Omission Bias 113Survivorship Bias 115Confirmation Bias 116Choice Affirmation Bias 117Hindsight Bias 117Availability Bias 119Social Proof 121Overconfidence Bias 122Zero Risk Bias 123Frequency Bias 124Bonus Biases 125Further Reading 128 Chapter 6: Perverse Incentives and the Cobra Effect 130The Goal of a Security Vendor Is to Keep You Secure 131Your Cybersecurity Decisions Affect Only You 132Bug Bounties Eliminate Bugs from the Offensive Market 134Cyber Insurance Causes People to Take Less Risk 135Fines and Penalties Cause People to Take Less Risk 136Attacking Back Would Help Stop Cyber Crime 137Innovation Increases Security and Privacy Incidents 138Further Reading 139 Chapter 7: Problems and Solutions 140Failure Is Not an Option in Cybersecurity 141Every Problem Has a Solution 142Anecdotes Are Good Leads for Cybersecurity Solutions 147Detecting More "Bad Stuff" Means the New Thing Is an Improvement 148Every Security Process Should Be Automated 149Professional Certifications Are Useless 151Further Reading 158 Part III: Contextual Issues 161 Chapter 8: Pitfalls of Analogies and Abstractions 162Cybersecurity Is Like the Physical World 165Cybersecurity Is Like Medicine and Biology 170Cybersecurity Is Like Fighting a War 172Cybersecurity Law Is Analogous to Physical-World Law 175Tips for Analogies and Abstractions 175Further Reading 178 Chapter 9: Legal Issues 180Cybersecurity Law Is Analogous to Physical-World Law 181Your Laws Do Not Apply to Me Where I Am 182That Violates My First Amendment Rights! 184Legal Code Supersedes Computer Code 186Law Enforcement Will Never Respond to Cyber Crimes 191You Can Always Hide Information by Suing 193Suing to Suppress a Breach Is a Good Idea 194Terms and Conditions Are Meaningless 194The Law Is on My Side, So I Do Not Need to Worry 195Further Reading 196 Chapter 10: Tool Myths and Misconceptions 198The More Tools, The Better 199Default Configurations Are Always Secure 201A Tool Can Stop All Bad Things 203Intent Can Be Determined from Tools 205Security Tools Are Inherently Secure and Trustworthy 207Nothing Found Means All Is Well 209Further Reading 212 Chapter 11: Vulnerabilities 214We Know Everything There Is to Know About Vulnerabilities 215Vulnerabilities Are Sparse 218Attackers Are Getting More Proficient 218Zero-Day Vulnerabilities Are Most Important 219All Attacks Hinge on a Vulnerability 223Exploits and Proofs of Concept Are Bad 226Vulnerabilities Happen Only in Complex Code 228First Movers Should Sacrifice Security 230Patches Are Always Perfect and Available 231Defenses Might Become Security Vulnerabilities with Time 236All Vulnerabilities Can Be Fixed 237Scoring Vulnerabilities Is Easy and Well Understood 239Because You Can, You Should--Vulnerabilities Edition 240Vulnerability Names Reflect Their Importance 241Further Reading 242 Chapter 12: Malware 244Using a Sandbox Will Tell Me Everything I Need to Know 246Reverse Engineering Will Tell Me Everything I Need to Know 249Malware and Geography Are/Are Not Related 251I Can Always Determine Who Made the Malware and Attacked Me 253Malware Is Always a Complex Program That Is Difficult to Understand 254Free Malware Protection Is Good Enough 256Only Shady Websites Will Infect Me 257Because You Can, You Should--Malware Edition 258Ransomware Is an Entirely New Kind of Malware 259Signed Software Is Always Trustworthy 261Malware Names Reflect Their Importance 263Further Reading 264 Chapter 13: Digital Forensics and Incident Response 266Movies and Television Reflect the Reality of Cyber 267Incidents Are Discovered as Soon as They Occur 269Incidents Are Discrete and Independent 270Every Incident Is the Same Severity 271Standard Incident Response Techniques Can Deal with Ransomware 272Incident Responders Can Flip a Few Switches and Magically EverythingIs Fixed 273Attacks Are Always Attributable 276Attribution Is Essential 278Most Attacks/Exfiltration of Data Originate from Outside the Organization 280The Trojan Horse Defense Is Dead 281Endpoint Data Is Sufficient for Incident Detection 282Recovering from an Event Is a Simple and Linear Process 284Further Reading 285 Part IV: Data Issues 287 Chapter 14: Lies, Damn Lies, and Statistics 288Luck Prevents Cyber Attacks 289The Numbers Speak for Themselves 290Probability Is Certainty 290Statistics Are Laws 293Data Is Not Important to Statistics 303Artificial Intelligence and Machine Learning Can Solve AllCybersecurity Problems 306Further Reading 310 Chapter 15: Illustrations, Visualizations, and Delusions 312Visualizations and Dashboards Are Inherently and Universally Helpful 313Cybersecurity Data Is Easy to Visualize 319Further Reading 324 Chapter 16: Finding Hope 326Creating a Less Myth-Prone World 328The Critical Value of Documentation 329Meta-Myths and Recommendations 331Avoiding Other and Future Traps 334Parting Thoughts 334 Appendix: Short Background Explanations 336 Acronyms 344Index 350
£29.69
Taylor & Francis Ltd Enterprise Cybersecurity in Digital Business
Book SynopsisCyber risk is the highest perceived business risk according to risk managers and corporate insurance experts. Cybersecurity typically is viewed as the boogeyman: it strikes fear into the hearts of non-technical employees. Enterprise Cybersecurity in Digital Business: Building a Cyber Resilient Organization provides a clear guide for companies to understand cyber from a business perspective rather than a technical perspective, and to build resilience for their business. Written by a world-renowned expert in the field, the book is based on three years of research with the Fortune 1000 and cyber insurance industry carriers, reinsurers, and brokers. It acts as a roadmap to understand cybersecurity maturity, set goals to increase resiliency, create new roles to fill business gaps related to cybersecurity, and make cyber inclusive for everyone in the business. It is unique since it provides strategies and learnings that have shown to lower risk and demystify cybeTable of ContentsPart I: The Evolution of Cybersecurity. 1. Cyber – A business Issue 2. ‘Cyber Risk’ 3. ‘The History of Cybersecurity’ 4. ‘Cyber Consequences’ 5. ‘Cyber Trends and Spending’ 6. ‘Cyber Roles’ Part II: Cybersecurity Basics. 7. ‘Cyber –Attack Surfaces and Digital Asset Inventories’ 8. ‘Cyber Terminology and Statistics’ 9. ‘Enterprise Threats of Today and Cybercriminals’ 10. ‘Cybersecurity Regulations, Standards and Frameworks’ 11. ‘Enterprise Cybersecurity Programs’ 12. ‘Organizational Cyber Maturities’ Part III: Cybersecurity Tools. 13. ‘Cyber Policies’ 14. ‘Cybersecurity Tools Part IV: Cybersecurity Regulation.15. ‘U.S. Federal Regulations’ 16. ‘U.S. State Regulations’ 17. ‘New York State Department of Financial Services Part 500’ 18. ‘Global, Industry or Other Types of Cybersecurity Regulations’ Part V: Incident Response, Forensics and Audit. 19. ‘Incident Response Plans’ 20. ‘Forensic Methods’ 21. ‘IT Audit’ Part VI: Cybersecurity Risk Management. 22. ‘Cybersecurity Financial Exposures’ 23. ‘Digital Asset Cyber Risk Modeling and Scoring’ 24. ‘Mitigating Cybersecurity Scores and Residual Cyber Risk Scores’ Part VII: GDPR and Privacy. 25. ‘GDPR Overview’ 26. ‘GDPR Articles’ 27. ‘GDRP Evidence’ 28. ‘GDPR Privacy Impact Assessment (PIA)’ Part VIII: Cybersecurity Risk Management Strategy. 29. ‘CISO Strategies’ 30. ‘Cyber in the Board Room’ Part IX: Cybersecurity Insurance. 31. ‘Cyber Insurance Overview’ 32. ‘Calculating Limits Adequacy’ 33. ‘Ransomware Strategies’ Part X: Introduction to Cybersecurity Vendor Risk Management. 34. ‘Vendor Risk Overview’ 35. ‘Vendor Cybersecurity Regulations’
£36.99
