Network security Books

Book SynopsisDr. Chuck Easttom is the author of 37 books, including several on computer security, forensics, and cryptography. He has also authored scientific papers on digital forensics, cyber warfare, cryptography, and applied mathematics. He is an inventor with 25 computer science patents. He holds a doctor of science degree in cybersecurity (dissertation topic: a study of lattice-based algorithms for post quantum cryptography), a Ph.D. in Computer Science (dissertation topic: A Systematic Framework for Network Forensics Using Graph Theory), and a Ph.D. in Nanotechnology (dissertation topic: The Effects of Complexity on Carbon Nanotube Failures) and three master's degrees (one in applied computer science, one in education, and one in systems engineering). He also holds more than 70 industry certifications (CISSP, CEH, etc.). He is a frequent speaker at cybersecurity, computer science, and engineering conferences. He is a Distinguished Speaker and senior member of the ACM and Table of ContentsIntroduction xxix Chapter 1: Introduction to Computer Security 2 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 How Seriously Should You Take Threats to Network Security?. . . . . . . . . . 4 Identifying Types of Threats.. . . . . . . . . . . . . . . . . . . . . . . . 7 Assessing the Likelihood of an Attack on Your Network.. . . . . . . . . . . . 17 Basic Security Terminology. . . . . . . . . . . . . . . . . . . . . . . . 18 Concepts and Approaches.. . . . . . . . . . . . . . . . . . . . . . . . 21 How Do Legal Issues Impact Network Security?.. . . . . . . . . . . . . . . 24 Online Security Resources.. . . . . . . . . . . . . . . . . . . . . . . . 25 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Chapter 2: Networks and the Internet 34 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Network Basics.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 How the Internet Works. . . . . . . . . . . . . . . . . . . . . . . . . 43 History of the Internet.. . . . . . . . . . . . . . . . . . . . . . . . . . 50 Basic Network Utilities.. . . . . . . . . . . . . . . . . . . . . . . . . 52 Other Network Devices.. . . . . . . . . . . . . . . . . . . . . . . . . 59 Advanced Network Communications Topics.. . . . . . . . . . . . . . . . 60 Cloud Computing. . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Chapter 3: Cyber Stalking, Fraud, and Abuse 74 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 How Internet Fraud Works.. . . . . . . . . . . . . . . . . . . . . . . . 75 Identity Theft.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Cyber Stalking.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 Protecting Yourself Against Cybercrime.. . . . . . . . . . . . . . . . . . 91 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Chapter 4: Denial of Service Attacks 106 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 DoS Attacks.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Illustrating an Attack.. . . . . . . . . . . . . . . . . . . . . . . . . . 107 Common Tools Used for DoS Attacks.. . . . . . . . . . . . . . . . . . . 109 DoS Weaknesses.. . . . . . . . . . . . . . . . . . . . . . . . . . . 112 Specific DoS Attacks. . . . . . . . . . . . . . . . . . . . . . . . . . 112 Real-World Examples of DoS Attacks.. . . . . . . . . . . . . . . . . . . 120 How to Defend Against DoS Attacks.. . . . . . . . . . . . . . . . . . . 121 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Chapter 5: Malware 130 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 Viruses.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Trojan Horses.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 The Buffer-Overflow Attack. . . . . . . . . . . . . . . . . . . . . . . 145 Spyware.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 Other Forms of Malware.. . . . . . . . . . . . . . . . . . . . . . . . 149 Detecting and Eliminating Viruses and Spyware. . . . . . . . . . . . . . . 153 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 Chapter 6: Techniques Used by Hackers 166 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 Basic Terminology.. . . . . . . . . . . . . . . . . . . . . . . . . . . 167 The Reconnaissance Phase.. . . . . . . . . . . . . . . . . . . . . . . 167 Actual Attacks.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 Malware Creation. . . . . . . . . . . . . . . . . . . . . . . . . . . 184 Penetration Testing.. . . . . . . . . . . . . . . . . . . . . . . . . . 187 The Dark Web. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 Chapter 7: Industrial Espionage in Cyberspace 200 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200 What Is Industrial Espionage?.. . . . . . . . . . . . . . . . . . . . . . 202 Information as an Asset. . . . . . . . . . . . . . . . . . . . . . . . . 203 Real-World Examples of Industrial Espionage.. . . . . . . . . . . . . . . 205 How Does Espionage Occur?. . . . . . . . . . . . . . . . . . . . . . 207 Protecting Against Industrial Espionage.. . . . . . . . . . . . . . . . . . 212 Trade Secrets.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 The Industrial Espionage Act.. . . . . . . . . . . . . . . . . . . . . . 218 Spear Phishing.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 219 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 Chapter 8: Encryption 226 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226 Cryptography Basics.. . . . . . . . . . . . . . . . . . . . . . . . . . 227 History of Encryption.. . . . . . . . . . . . . . . . . . . . . . . . . . 228 Modern Cryptography Methods.. . . . . . . . . . . . . . . . . . . . . 236 Public Key (Asymmetric) Encryption.. . . . . . . . . . . . . . . . . . . 245 PGP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250 Legitimate Versus Fraudulent Encryption Methods.. . . . . . . . . . . . . 251 Digital Signatures. . . . . . . . . . . . . . . . . . . . . . . . . . . 252 Hashing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253 MAC and HMAC.. . . . . . . . . . . . . . . . . . . . . . . . . . . 254 Steganography. . . . . . . . . . . . . . . . . . . . . . . . . . . . 255 Cryptanalysis.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257 Cryptography Used on the Internet.. . . . . . . . . . . . . . . . . . . . 259 Quantum Computing Cryptography. . . . . . . . . . . . . . . . . . . . 259 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261 Chapter 9: Computer Security Technology 268 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268 Virus Scanners.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 269 Firewalls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272 Antispyware.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278 IDSs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 Digital Certificates.. . . . . . . . . . . . . . . . . . . . . . . . . . . 292 SSL/TLS.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293 Virtual Private Networks.. . . . . . . . . . . . . . . . . . . . . . . . 296 Wi-Fi Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299 Chapter 10: Security Policies 304 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304 What Is a Policy?.. . . . . . . . . . . . . . . . . . . . . . . . . . . 305 Important Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . 305 Defining User Policies.. . . . . . . . . . . . . . . . . . . . . . . . . 308 Defining System Administration Policies.. . . . . . . . . . . . . . . . . . 316 Security Breaches.. . . . . . . . . . . . . . . . . . . . . . . . . . . 319 Defining Access Control.. . . . . . . . . . . . . . . . . . . . . . . . 321 Development Policies.. . . . . . . . . . . . . . . . . . . . . . . . . 322 Standards, Guidelines, and Procedures.. . . . . . . . . . . . . . . . . . 323 Disaster Recovery.. . . . . . . . . . . . . . . . . . . . . . . . . . . 324 Zero Trust.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327 Important Laws.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 328 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330 Chapter 11: Network Scanning and Vulnerability Scanning 336 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336 Basics of Assessing a System.. . . . . . . . . . . . . . . . . . . . . . 337 Securing Computer Systems.. . . . . . . . . . . . . . . . . . . . . . 346 Scanning Your Network. . . . . . . . . . . . . . . . . . . . . . . . . 352 Testing and Scanning Standards.. . . . . . . . . . . . . . . . . . . . . 363 Getting Professional Help.. . . . . . . . . . . . . . . . . . . . . . . . 366 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369 Chapter 12: Cyber Terrorism and Information Warfare 378 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378 Actual Cases of Cyber Terrorism.. . . . . . . . . . . . . . . . . . . . . 379 Weapons of Cyber Warfare.. . . . . . . . . . . . . . . . . . . . . . . 382 Economic Attacks.. . . . . . . . . . . . . . . . . . . . . . . . . . . 384 Military Operations Attacks. . . . . . . . . . . . . . . . . . . . . . . 386 General Attacks.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 387 Supervisory Control and Data Acquisitions (SCADA).. . . . . . . . . . . . . 387 Information Warfare.. . . . . . . . . . . . . . . . . . . . . . . . . . 388 Actual Cases of Cyber Terrorism.. . . . . . . . . . . . . . . . . . . . . 391 Future Trends.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 395 Defense Against Cyber Terrorism.. . . . . . . . . . . . . . . . . . . . . 399 Terrorist Recruiting and Communication.. . . . . . . . . . . . . . . . . . 399 TOR and the Dark Web.. . . . . . . . . . . . . . . . . . . . . . . . . 400 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 402 Chapter 13: Cyber Detective 408 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408 General Searches. . . . . . . . . . . . . . . . . . . . . . . . . . . 410 Company Searches.. . . . . . . . . . . . . . . . . . . . . . . . . . 413 Court Records and Criminal Checks.. . . . . . . . . . . . . . . . . . . 413 Usenet. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 417 Google.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418 Maltego. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 421 Chapter 14: Introduction to Forensics 426 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 426 General Guidelines. . . . . . . . . . . . . . . . . . . . . . . . . . . 427 Finding Evidence on a PC. . . . . . . . . . . . . . . . . . . . . . . . 440 Finding Evidence in System Logs.. . . . . . . . . . . . . . . . . . . . 441 Getting Back Deleted Files.. . . . . . . . . . . . . . . . . . . . . . . 442 Operating System Utilities. . . . . . . . . . . . . . . . . . . . . . . . 445 The Windows Registry. . . . . . . . . . . . . . . . . . . . . . . . . 447 Mobile Forensics: Cell Phone Concepts.. . . . . . . . . . . . . . . . . . 452 The Need for Forensic Certification.. . . . . . . . . . . . . . . . . . . . 457 Expert Witnesses.. . . . . . . . . . . . . . . . . . . . . . . . . . . 458 Additional Types of Forensics.. . . . . . . . . . . . . . . . . . . . . . 459 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 Chapter 15: Cybersecurity Engineering 466 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466 Defining Cybersecurity Engineering.. . . . . . . . . . . . . . . . . . . . 467 Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 475 SecML. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 480 Modeling. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491 Glossary 494 Appendix A: Resources 500 Appendix B: Answers to the Multiple Choice Questions 502 9780137984787, TOC, 12/6/2022

Read more less

Book SynopsisDr. Chuck Easttom is the author of 41 books, including several on computer security, forensics, and cryptography. He is also an inventor with 25 patents and the author of over 70 research papers. He holds a Doctor of Science in cybersecurity, a Ph.D. in nanotechnology, a Ph.D. in computer science, and three master's degrees (one in applied computer science, one in education, and one in systems engineering). He is a senior member of both the IEEE and the ACM. He is also a Distinguished Speaker of the ACM and a Distinguished Visitor of the IEEE. Dr. Easttom is currently an adjunct professor for Georgetown University and for Vanderbilt University.Table of Contents Preface xxiii Chapter 1: Introduction to Network Security 2 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 The Basics of a Network.. . . . . . . . . . . . . . . . . . . . . . . . . 3 Basic Network Utilities.. . . . . . . . . . . . . . . . . . . . . . . . . 11 The OSI Model.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 What Does This Mean for Security?. . . . . . . . . . . . . . . . . . . . 16 Assessing Likely Threats to the Network. . . . . . . . . . . . . . . . . . 16 Classifications of Threats.. . . . . . . . . . . . . . . . . . . . . . . . 20 Likely Attacks.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Threat Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Understanding Security Terminology.. . . . . . . . . . . . . . . . . . . . 26 Choosing a Network Security Approach.. . . . . . . . . . . . . . . . . . 30 Network Security and the Law.. . . . . . . . . . . . . . . . . . . . . . 32 Using Security Resources. . . . . . . . . . . . . . . . . . . . . . . . 34 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Endnotes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Chapter 2: Types of Attacks 42 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Understanding Denial of Service Attacks.. . . . . . . . . . . . . . . . . . 43 Defending Against Buffer Overflow Attacks.. . . . . . . . . . . . . . . . . 63 Defending Against IP Spoofing. . . . . . . . . . . . . . . . . . . . . . 64 Defending Against Session Hijacking.. . . . . . . . . . . . . . . . . . . 66 Blocking Virus and Trojan Horse Attacks. . . . . . . . . . . . . . . . . . 66 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 Endnotes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 Chapter 3: Fundamentals of Firewalls 82 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 What Is a Firewall?. . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Implementing Firewalls.. . . . . . . . . . . . . . . . . . . . . . . . . 90 Firewall Deployment.. . . . . . . . . . . . . . . . . . . . . . . . . . 95 Selecting and Using a Firewall.. . . . . . . . . . . . . . . . . . . . . . 96 Using Proxy Servers.. . . . . . . . . . . . . . . . . . . . . . . . . . 97 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Chapter 4: Firewall Practical Applications 106 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Using Single Machine Firewalls.. . . . . . . . . . . . . . . . . . . . . 107 Windows 10 Firewall.. . . . . . . . . . . . . . . . . . . . . . . . . . 108 User Account Control.. . . . . . . . . . . . . . . . . . . . . . . . . 110 Linux Firewalls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 Using Small Office/Home Office Firewalls.. . . . . . . . . . . . . . . . . 118 Using Medium-Sized Network Firewalls.. . . . . . . . . . . . . . . . . . 121 Using Enterprise Firewalls. . . . . . . . . . . . . . . . . . . . . . . . 124 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Endnotes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Chapter 5: Intrusion-Detection Systems 132 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Understanding IDS Concepts.. . . . . . . . . . . . . . . . . . . . . . 133 IDS Components and Processes.. . . . . . . . . . . . . . . . . . . . . 135 SIEM.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Evasion Techniques.. . . . . . . . . . . . . . . . . . . . . . . . . . 137 Understanding and Implementing IDSs.. . . . . . . . . . . . . . . . . . 138 Understanding and Implementing Honeypots. . . . . . . . . . . . . . . . 141 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 Chapter 6: Encryption Fundamentals 152 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 The History of Encryption.. . . . . . . . . . . . . . . . . . . . . . . . 153 Learning About Modern Encryption Methods.. . . . . . . . . . . . . . . . 160 Identifying Good Encryption.. . . . . . . . . . . . . . . . . . . . . . . 173 Understanding Digital Signatures and Certificates.. . . . . . . . . . . . . . 174 MAC and HMAC.. . . . . . . . . . . . . . . . . . . . . . 179 Understanding and Using Decryption.. . . . . . . . . . . . . . . . . . . 179 Cracking Passwords.. . . . . . . . . . . . . . . . . . . . . . . . . . 180 Steganography. . . . . . . . . . . . . . . . . . . . . . . . . . . . 184 Steganalysis.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 Quantum Computing and Quantum Cryptography. . . . . . . . . . . . . . 186 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 Endnote.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 Chapter 7: Virtual Private Networks 194 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 Basic VPN Technology.. . . . . . . . . . . . . . . . . . . . . . . . . 195 Using VPN Protocols for VPN Encryption.. . . . . . . . . . . . . . . . . 197 IPsec.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206 SSL/TLS.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207 Other VPN Protocols.. . . . . . . . . . . . . . . . . . . . . . . . . . 209 Implementing VPN Solutions.. . . . . . . . . . . . . . . . . . . . . . 210 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 Endnotes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 Chapter 8: Operating System Hardening 222 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 Configuring Windows Properly.. . . . . . . . . . . . . . . . . . . . . . 223 Configuring Linux Properly.. . . . . . . . . . . . . . . . . . . . . . . 244 Patching the Operating System.. . . . . . . . . . . . . . . . . . . . . 245 Configuring Browsers.. . . . . . . . . . . . . . . . . . . . . . . . . 246 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253 Chapter 9: Defending Against Virus Attacks 260 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260 Understanding Virus Attacks.. . . . . . . . . . . . . . . . . . . . . . 261 Virus Scanners.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 270 Virus Scanning Techniques. . . . . . . . . . . . . . . . . . 272 When Antivirus Causes a Problem. . . . . . . . . . . . . . . 274 Commercial Antivirus Software.. . . . . . . . . . . . . . . . 274 Antivirus Policies and Procedures.. . . . . . . . . . . . . . . . . . . . 283 Additional Methods for Defending Your System.. . . . . . . . . . . . . . . 284 What to Do If Your System Is Infected by a Virus.. . . . . . . . . . . . . . 285 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288 Endnotes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288 Chapter 10: Defending Against Trojan Horses and Phishing 296 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296 Trojan Horses.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297 Phishing.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313 Endnotes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313 Chapter 11: Security Policies 318 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 318 ISO 27002. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319 Important Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . 322 Defining User Policies.. . . . . . . . . . . . . . . . . . . . . . . . . 324 Defining System Administration Policies.. . . . . . . . . . . . . . . . . . 331 Defining Access Control.. . . . . . . . . . . . . . . . . . . . . . . . 336 Defining Developmental Policies.. . . . . . . . . . . . . . . . . . . . . 337 Disaster Recovery.. . . . . . . . . . . . . . . . . . . . . . . . . . . 338 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339 Chapter 12: Assessing System Security 346 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346 Risk Assessment Concepts.. . . . . . . . . . . . . . . . . . . . . . . 347 Evaluating the Security Risk.. . . . . . . . . . . . . . . . . . . . . . . 348 Conducting the Initial Assessment. . . . . . . . . . . . . . . . . . . . 351 Probing the Network.. . . . . . . . . . . . . . . . . . . . . . . . . . 357 Vulnerabilities.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381 McCumber Cube.. . . . . . . . . . . . . . . . . . . . . . . . . . . 384 Security Documentation.. . . . . . . . . . . . . . . . . . . . . . . . 385 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388 Chapter 13: Security Standards 394 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394 COBIT.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394 ISO Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 396 NIST Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 397 U.S. DoD Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . 403 Using the Common Criteria.. . . . . . . . . . . . . . . . . . . . . . . 405 Using Security Models.. . . . . . . . . . . . . . . . . . . . . . . . . 407 U.S. Federal Regulations, Guidelines, and Standards.. . . . . . . . . . . . 410 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413 Endnotes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 414 Chapter 14: Physical Security and Disaster Recovery 422 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422 Physical Security.. . . . . . . . . . . . . . . . . . . . . . . . . . . 422 Disaster Recovery.. . . . . . . . . . . . . . . . . . . . . . . . . . . 428 Ensuring Fault Tolerance.. . . . . . . . . . . . . . . . . . . . . . . . 432 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435 Chapter 15: Techniques Used by Attackers 438 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 438 Preparing to Hack.. . . . . . . . . . . . . . . . . . . . . . . . . . . 439 The Attack Phase. . . . . . . . . . . . . . . . . . . . . . . . . . . 453 Session Hijacking. . . . . . . . . . . . . . . . . . . . . . . . . . . 457 Wi-Fi Hacking. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459 Bluetooth Hacking.. . . . . . . . . . . . . . . . . . . . . . . . . . . 459 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462 Chapter 16: Introduction to Forensics 466 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466 General Forensics Guidelines.. . . . . . . . . . . . . . . . . . . . . . 467 FBI Forensics Guidelines. . . . . . . . . . . . . . . . . . . . . . . . 470 Imaging a Drive.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 471 Finding Evidence on the PC.. . . . . . . . . . . . . . . . . . . . . . . 474 Gathering Evidence from a Cell Phone.. . . . . . . . . . . . . . . . . . 485 Forensic Tools to Use.. . . . . . . . . . . . . . . . . . . . . . . . . 491 AccessData Forensic Toolkit.. . . . . . . . . . . . . . . . . 491 EnCase.. . . . . . . . . . . . . . . . . . . . . . . . . . 492 The Sleuth Kit. . . . . . . . . . . . . . . . . . . . . . . 492 OSForensics. . . . . . . . . . . . . . . . . . . . . . . . 492 Forensic Science.. . . . . . . . . . . . . . . . . . . . . . . . . . . 493 To Certify or Not to Certify?.. . . . . . . . . . . . . . . . . . . . . . . 493 Expert Witnesses.. . . . . . . . . . . . . . . . . . . . . . . . . . . 494 Additional Types of Forensics.. . . . . . . . . . . . . . . . . . . . . . 495 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499 Endnote.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499 Chapter 17: Cyber Warfare and Terrorism 504 Introduction.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504 Defending Against Computer-Based Espionage. . . . . . . . . . . . . . . 505 Defending Against Computer-Based Terrorism. . . . . . . . . . . . . . . 508 Choosing Defense Strategies.. . . . . . . . . . . . . . . . . . . . . . 514 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 524 Endnotes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 524 Appendix A: Answers 530 Glossary 542 9780138200589, 9/1/2023

Read more less

Book SynopsisFocusing on the human factors involved with information security, this book explains why all the firewalls and encryption protocols in the world will never be enough to stop a savvy grifter intent on rifling a corporate database or an irate employee determined to crash a system.Trade Review“…a fascinating read…” (ForTean Times, June 2004) "...a lot of interesting cautionary tales..." (New Scientist, January 2004)Table of ContentsForeword. Preface. Introduction. Part 1: Behind the Scenes. Chapter 1: Security's Weakest Link. Part 2: The Art of the Attacker. Chapter 2: When Innocuous Information Isn't. Chapter 3: The Direct Attack: Just Asking for It. Chapter 4: Building Trust. Chapter 5: "Let Me Help You". Chapter 6: "Can You Help Me?". Chapter 7: Phony Sites and Dangerous Attachments. Chapter 8: Using Sympathy, Guilt, and Intimidation. Chapter 9: The Reverse Sting. Part 3: Intruder Alert. Chapter 10: Entering the Premises. Chapter 11: Combining Technology and Social Engineering. Chapter 12: Attacks on the Entry-Level Employee. Chapter 13: Clever Cons. Chapter 14: Industrial Espionage. Part 4: Raising the Bar. Chapter 15: Information Security Awareness and Training. Chapter 16: Recommended Corporate Information Security Policies. Security at a Glance. Sources. Acknowledgments. Index.

Read more less

Book SynopsisThe highly successful security book returns with a new edition, completely updated Web applications are the front door to most organizations, exposing them to attacks that may disclose personal information, execute fraudulent transactions, or compromise ordinary users.Table of ContentsIntroduction xxiii Chapter 1 Web Application (In)security 1 The Evolution of Web Applications 2 Common Web Application Functions 4 Benefits of Web Applications 5 Web Application Security 6 “This Site Is Secure” 7 The Core Security Problem: Users Can Submit Arbitrary Input 9 Key Problem Factors 10 The New Security Perimeter 12 The Future of Web Application Security 14 Summary 15 Chapter 2 Core Defense Mechanisms 17 Handling User Access 18 Authentication 18 Session Management 19 Access Control 20 Handling User Input 21 Varieties of Input 21 Approaches to Input Handling 23 Boundary Validation 25 Multistep Validation and Canonicalization 28 Handling Attackers 30 Handling Errors 30 Maintaining Audit Logs 31 Alerting Administrators 33 Reacting to Attacks 34 Managing the Application 35 Summary 36 Questions 36 Chapter 3 Web Application Technologies 39 The HTTP Protocol 39 HTTP Requests 40 HTTP Responses 41 HTTP Methods 42 URLs 44 Rest 44 HTTP Headers 45 Cookies 47 Status Codes 48 Https 49 HTTP Proxies 49 HTTP Authentication 50 Web Functionality 51 Server-Side Functionality 51 Client-Side Functionality 57 State and Sessions 66 Encoding Schemes 66 URL Encoding 67 Unicode Encoding 67 HTML Encoding 68 Base64 Encoding 69 Hex Encoding 69 Remoting and Serialization Frameworks 70 Next Steps 70 Questions 71 Chapter 4 Mapping the Application 73 Enumerating Content and Functionality 74 Web Spidering 74 User-Directed Spidering 77 Discovering Hidden Content 80 Application Pages Versus Functional Paths 93 Discovering Hidden Parameters 96 Analyzing the Application 97 Identifying Entry Points for User Input 98 Identifying Server-Side Technologies 101 Identifying Server-Side Functionality 107 Mapping the Attack Surface 111 Summary 114 Questions 114 Chapter 5 Bypassing Client-Side Controls 117 Transmitting Data Via the Client 118 Hidden Form Fields 118 HTTP Cookies 121 URL Parameters 121 The Referer Header 122 Opaque Data 123 The ASP.NET ViewState 124 Capturing User Data: HTML Forms 127 Length Limits 128 Script-Based Validation 129 Disabled Elements 131 Capturing User Data: Browser Extensions 133 Common Browser Extension Technologies 134 Approaches to Browser Extensions 135 Intercepting Traffic from Browser Extensions 135 Decompiling Browser Extensions 139 Attaching a Debugger 151 Native Client Components 153 Handling Client-Side Data Securely 154 Transmitting Data Via the Client 154 Validating Client-Generated Data 155 Logging and Alerting 156 Summary 156 Questions 157 Chapter 6 Attacking Authentication 159 Authentication Technologies 160 Design Flaws in Authentication Mechanisms 161 Bad Passwords 161 Brute-Forcible Login 162 Verbose Failure Messages 166 Vulnerable Transmission of Credentials 169 Password Change Functionality 171 Forgotten Password Functionality 173 “Remember Me” Functionality 176 User Impersonation Functionality 178 Incomplete Validation of Credentials 180 Nonunique Usernames 181 Predictable Usernames 182 Predictable Initial Passwords 183 Insecure Distribution of Credentials 184 Implementation Flaws in Authentication 185 Fail-Open Login Mechanisms 185 Defects in Multistage Login Mechanisms 186 Insecure Storage of Credentials 190 Securing Authentication 191 Use Strong Credentials 192 Handle Credentials Secretively 192 Validate Credentials Properly 193 Prevent Information Leakage 195 Prevent Brute-Force Attacks 196 Prevent Misuse of the Password Change Function 199 Prevent Misuse of the Account Recovery Function 199 Log, Monitor, and Notify 201 Summary 201 Questions 202 Chapter 7 Attacking Session Management 205 The Need for State 206 Alternatives to Sessions 208 Weaknesses in Token Generation 210 Meaningful Tokens 210 Predictable Tokens 213 Encrypted Tokens 223 Weaknesses in Session Token Handling 233 Disclosure of Tokens on the Network 234 Disclosure of Tokens in Logs 237 Vulnerable Mapping of Tokens to Sessions 240 Vulnerable Session Termination 241 Client Exposure to Token Hijacking 243 Liberal Cookie Scope 244 Securing Session Management 248 Generate Strong Tokens 248 Protect Tokens Throughout Their Life Cycle 250 Log, Monitor, and Alert 253 Summary 254 Questions 255 Chapter 8 Attacking Access Controls 257 Common Vulnerabilities 258 Completely Unprotected Functionality 259 Identifier-Based Functions 261 Multistage Functions 262 Static Files 263 Platform Misconfiguration 264 Insecure Access Control Methods 265 Attacking Access Controls 266 Testing with Different User Accounts 267 Testing Multistage Processes 271 Testing with Limited Access 273 Testing Direct Access to Methods 276 Testing Controls Over Static Resources 277 Testing Restrictions on HTTP Methods 278 Securing Access Controls 278 A Multilayered Privilege Model 280 Summary 284 Questions 284 Chapter 9 Attacking Data Stores 287 Injecting into Interpreted Contexts 288 Bypassing a Login 288 Injecting into SQL 291 Exploiting a Basic Vulnerability 292 Injecting into Different Statement Types 294 Finding SQL Injection Bugs 298 Fingerprinting the Database 303 The UNION Operator 304 Extracting Useful Data 308 Extracting Data with UNION 308 Bypassing Filters 311 Second-Order SQL Injection 313 Advanced Exploitation 314 Beyond SQL Injection: Escalating the Database Attack 325 Using SQL Exploitation Tools 328 SQL Syntax and Error Reference 332 Preventing SQL Injection 338 Injecting into NoSQL 342 Injecting into MongoDB 343 Injecting into XPath 344 Subverting Application Logic 345 Informed XPath Injection 346 Blind XPath Injection 347 Finding XPath Injection Flaws 348 Preventing XPath Injection 349 Injecting into LDAP 349 Exploiting LDAP Injection 351 Finding LDAP Injection Flaws 353 Preventing LDAP Injection 354 Summary 354 Questions 354 Chapter 10 Attacking Back-End Components 357 Injecting OS Commands 358 Example 1: Injecting Via Perl 358 Example 2: Injecting Via ASP 360 Injecting Through Dynamic Execution 362 Finding OS Command Injection Flaws 363 Finding Dynamic Execution Vulnerabilities 366 Preventing OS Command Injection 367 Preventing Script Injection Vulnerabilities 368 Manipulating File Paths 368 Path Traversal Vulnerabilities 368 File Inclusion Vulnerabilities 381 Injecting into XML Interpreters 383 Injecting XML External Entities 384 Injecting into SOAP Services 386 Finding and Exploiting SOAP Injection 389 Preventing SOAP Injection 390 Injecting into Back-end HTTP Requests 390 Server-side HTTP Redirection 390 HTTP Parameter Injection 393 Injecting into Mail Services 397 E-mail Header Manipulation 398 SMTP Command Injection 399 Finding SMTP Injection Flaws 400 Preventing SMTP Injection 402 Summary 402 Questions 403 Chapter 11 Attacking Application Logic 405 The Nature of Logic Flaws 406 Real-World Logic Flaws 406 Example 1: Asking the Oracle 407 Example 2: Fooling a Password Change Function 409 Example 3: Proceeding to Checkout 410 Example 4: Rolling Your Own Insurance 412 Example 5: Breaking the Bank 414 Example 6: Beating a Business Limit 416 Example 7: Cheating on Bulk Discounts 418 Example 8: Escaping from Escaping 419 Example 9: Invalidating Input Validation 420 Example 10: Abusing a Search Function 422 Example 11: Snarfing Debug Messages 424 Example 12: Racing Against the Login 426 Avoiding Logic Flaws 428 Summary 429 Questions 430 Chapter 12 Attacking Users: Cross-Site Scripting 431 Varieties of XSS 433 Reflected XSS Vulnerabilities 434 Stored XSS Vulnerabilities 438 DOM-Based XSS Vulnerabilities 440 XSS Attacks in Action 442 Real-World XSS Attacks 442 Payloads for XSS Attacks 443 Delivery Mechanisms for XSS Attacks 447 Finding and Exploiting XSS Vulnerabilities 451 Finding and Exploiting Reflected XSS Vulnerabilities 452 Finding and Exploiting Stored XSS Vulnerabilities 481 Finding and Exploiting DOM-Based XSS Vulnerabilities 487 Preventing XSS Attacks 492 Preventing Reflected and Stored XSS 492 Preventing DOM-Based XSS 496 Summary 498 Questions 498 Chapter 13 Attacking Users: Other Techniques 501 Inducing User Actions 501 Request Forgery 502 UI Redress 511 Capturing Data Cross-Domain 515 Capturing Data by Injecting HTML 516 Capturing Data by Injecting CSS 517 JavaScript Hijacking 519 The Same-Origin Policy Revisited 524 The Same-Origin Policy and Browser Extensions 525 The Same-Origin Policy and HTML 5 528 Crossing Domains with Proxy Service Applications 529 Other Client-Side Injection Attacks 531 HTTP Header Injection 531 Cookie Injection 536 Open Redirection Vulnerabilities 540 Client-Side SQL Injection 547 Client-Side HTTP Parameter Pollution 548 Local Privacy Attacks 550 Persistent Cookies 550 Cached Web Content 551 Browsing History 552 Autocomplete 552 Flash Local Shared Objects 553 Silverlight Isolated Storage 553 Internet Explorer userData 554 HTML5 Local Storage Mechanisms 554 Preventing Local Privacy Attacks 554 Attacking ActiveX Controls 555 Finding ActiveX Vulnerabilities 556 Preventing ActiveX Vulnerabilities 558 Attacking the Browser 559 Logging Keystrokes 560 Stealing Browser History and Search Queries 560 Enumerating Currently Used Applications 560 Port Scanning 561 Attacking Other Network Hosts 561 Exploiting Non-HTTP Services 562 Exploiting Browser Bugs 563 DNS Rebinding 563 Browser Exploitation Frameworks 564 Man-in-the-Middle Attacks 566 Summary 568 Questions 568 Chapter 14 Automating Customized Attacks 571 Uses for Customized Automation 572 Enumerating Valid Identifiers 573 The Basic Approach 574 Detecting Hits 574 Scripting the Attack 576 JAttack 577 Harvesting Useful Data 583 Fuzzing for Common Vulnerabilities 586 Putting It All Together: Burp Intruder 590 Barriers to Automation 602 Session-Handling Mechanisms 602 CAPTCHA Controls 610 Summary 613 Questions 613 Chapter 15 Exploiting Information Disclosure 615 Exploiting Error Messages 615 Script Error Messages 616 Stack Traces 617 Informative Debug Messages 618 Server and Database Messages 619 Using Public Information 623 Engineering Informative Error Messages 624 Gathering Published Information 625 Using Inference 626 Preventing Information Leakage 627 Use Generic Error Messages 628 Protect Sensitive Information 628 Minimize Client-Side Information Leakage 629 Summary 629 Questions 630 Chapter 16 Attacking Native Compiled Applications 633 Buffer Overflow Vulnerabilities 634 Stack Overflows 634 Heap Overflows 635 “Off-by-One” Vulnerabilities 636 Detecting Buffer Overflow Vulnerabilities 639 Integer Vulnerabilities 640 Integer Overflows 640 Signedness Errors 641 Detecting Integer Vulnerabilities 642 Format String Vulnerabilities 643 Detecting Format String Vulnerabilities 644 Summary 645 Questions 645 Chapter 17 Attacking Application Architecture 647 Tiered Architectures 647 Attacking Tiered Architectures 648 Securing Tiered Architectures 654 Shared Hosting and Application Service Providers 656 Virtual Hosting 657 Shared Application Services 657 Attacking Shared Environments 658 Securing Shared Environments 665 Summary 667 Questions 667 Chapter 18 Attacking the Application Server 669 Vulnerable Server Configuration 670 Default Credentials 670 Default Content 671 Directory Listings 677 WebDAV Methods 679 The Application Server as a Proxy 682 Misconfigured Virtual Hosting 683 Securing Web Server Configuration 684 Vulnerable Server Software 684 Application Framework Flaws 685 Memory Management Vulnerabilities 687 Encoding and Canonicalization 689 Finding Web Server Flaws 694 Securing Web Server Software 695 Web Application Firewalls 697 Summary 699 Questions 699 Chapter 19 Finding Vulnerabilities in Source Code 701 Approaches to Code Review 702 Black-Box Versus White-Box Testing 702 Code Review Methodology 703 Signatures of Common Vulnerabilities 704 Cross-Site Scripting 704 SQL Injection 705 Path Traversal 706 Arbitrary Redirection 707 OS Command Injection 708 Backdoor Passwords 708 Native Software Bugs 709 Source Code Comments 710 The Java Platform 711 Identifying User-Supplied Data 711 Session Interaction 712 Potentially Dangerous APIs 713 Configuring the Java Environment 716 ASP.NET 718 Identifying User-Supplied Data 718 Session Interaction 719 Potentially Dangerous APIs 720 Configuring the ASP.NET Environment 723 PHP 724 Identifying User-Supplied Data 724 Session Interaction 727 Potentially Dangerous APIs 727 Configuring the PHP Environment 732 Perl 735 Identifying User-Supplied Data 735 Session Interaction 736 Potentially Dangerous APIs 736 Configuring the Perl Environment 739 JavaScript 740 Database Code Components 741 SQL Injection 741 Calls to Dangerous Functions 742 Tools for Code Browsing 743 Summary 744 Questions 744 Chapter 20 A Web Application Hacker’s Toolkit 747 Web Browsers 748 Internet Explorer 748 Firefox 749 Chrome 750 Integrated Testing Suites 751 How the Tools Work 751 Testing Work Flow 769 Alternatives to the Intercepting Proxy 771 Standalone Vulnerability Scanners 773 Vulnerabilities Detected by Scanners 774 Inherent Limitations of Scanners 776 Technical Challenges Faced by Scanners 778 Current Products 781 Using a Vulnerability Scanner 783 Other Tools 785 Wikto/Nikto 785 Firebug 785 Hydra 785 Custom Scripts 786 Summary 789 Chapter 21 A Web Application Hacker’s Methodology 791 General Guidelines 793 1 Map the Application’s Content 795 2 Analyze the Application 798 3 Test Client-Side Controls 800 4 Test the Authentication Mechanism 805 5 Test the Session Management Mechanism 814 6 Test Access Controls 821 7 Test for Input-Based Vulnerabilities 824 8 Test for Function-Specific Input Vulnerabilities 836 9 Test for Logic Flaws 842 10 Test for Shared Hosting Vulnerabilities 845 11 Test for Application Server Vulnerabilities 846 12 Miscellaneous Checks 849 13 Follow Up Any Information Leakage 852 Index 853

Read more less

Book SynopsisSuccessfully navigate through the ever-changing world of technology and ethics and reconcile system administration principles for separation of duty, account segmentation, administrative groups and data protection. As security breaches become more common, businesses need to protect themselves when facing ethical dilemmas in today''s digital landscape. This book serves as a equitable guideline in helping system administrators, engineers - as well as their managers - on coping with the ethical challenges of technology and security in the modern data center by providing real-life stories, scenarios, and use cases from companies both large and small. You''ll examine the problems and challenges that people working with customer data, security and system administration may face in the cyber world and review the boundaries and tools for remaining ethical in an environment where it is so easy to step over a line - intentionally or accidentally. You''ll also see hTable of ContentsSystem Administration EthicsChapter 1: In the BeginningChapter 2: Separate RolesChapter 3: Respect PrivacyChapter 4: Do Not Change DataChapter 5: Don't Steal (Intellectual Property)Chapter 6: Don't Steal (Computers)Chapter 7: Do Not Go Where You Are Not WantedChapter 8: Follow Procedures and Get OutChapter 9: Communicate ChangeChapter 10: Do No HarmChapter 11: Break Glass

Read more less

Book SynopsisToday, companies find themselves targeted by sophisticated nation state cyber attackers armed with the resources to craft scarily effective campaigns. This book is a detailed guide to understanding the major players, the techniques they use, and the process of analysing their advanced attacks. Whether you're an individual researcher or part of a team within a Security Operations Center (SoC), you'll learn to approach, track, and attribute attacks to these advanced actors. Jon DiMaggio demonstrates some of the techniques he has employed to uncover crucial information about the 2021 Colonial Pipeline attacks, among others.Trade Review"Encompasses useful knowledge from the past and modern advanced threats seen today. Regardless of your expertise level, this book is an insightful read . . .”—Brittany Day, Director of Communications, Guardian Digital“For those looking for a guide to help them understand the new world of cyberwar, The Art of Cyberwarfare provides readers with a good overview of this expanding threat and what they can do to avoid being victims.”—Ben Rothke, Senior Information Security Manager, Tapad"An informative and explanatory guide for cybersecurity experts and an enlightening read for novices. DiMaggio effectively details both the history of cybercrime and how it is seen today."—Justice Levine, Communications Manager and Cloud Email Security Expert, Guardian Digital"This book deserves to find a place on the shelf of everyone whose role involves protecting networks."—Ian Barker, BetaNews"A cross between an IBM presentation . . . and a Tom Clancy novel!"—The Shepherdess, Amazon Reviewer

Read more less

Book SynopsisIn this practical book, authors Ev Kontsevoy, Sakshyam Shah, and Peter Conrad break this topic down into manageable pieces. You'll discover how different parts of the approach fit together in a way that enables engineering teams to build more secure applications without slowing down productivity.

Read more less

Book Synopsis Understand common security pitfalls and discover weak points in your organization''s data security, and what you can do to combat them. This book includes the best approaches to managing mobile devices both on your local network and outside the office. Data breaches, compliance fines,  and distribution  of personally identifiable information (PII) without encryption or safeguards place businesses of all types at risk. In today''s electronic world, you must have a secure digital footprint that is based on business processes that are designed to protect information. This book is written for business owners, chief information security officers (CISO), and IT managers who want to securely configure Office 365.  You will follow the Microsoft cybersecurity road map through a progressive tutorial on how to configure the security  services in Office 365 to protect and manage your business. Table of Contents1. Why Security and Compliance 2. Azure and Office 365 Security 3. Office 365- Security Score 4. Office 365- Deploying Identity Management with EMS 5. Office 365- Mobile Device Management with EMS 6. Using Office 365 Compliance Center 7. Migration Step by Step 8. Managing Your Office 365

Read more less

Book SynopsisSee how privileges, insecure passwords, administrative rights, and remote access can be combined as an attack vector to breach any organization. Cyber attacks continue to increase in volume and sophistication. It is not a matter of if, but when, your organization will be breached. Threat actors target the path of least resistance: users and their privileges. In decades past, an entire enterprise might be sufficiently managed through just a handful of credentials. Today''s environmental complexity has seen an explosion of privileged credentials for many different account types such as domain and local administrators, operating systems (Windows, Unix, Linux, macOS, etc.), directory services, databases, applications, cloud instances, networking hardware, Internet of Things (IoT), social media, and so many more. When unmanaged, these privileged credentials pose a significant threat from external hackers and insider threats. We are experiencing an expanding univerTable of Contents

Read more less

Book SynopsisTable of Contents1. Introduction Part I: Cryptography 2. Symmetric Encryption and Message 3. Public-Key Cryptography and Message 4. Key Distribution and User Authentication 5. Network Access Control and Cloud Security 6. Transport-Level Security 7. Wireless Network Security 8. Electronic Mail Security 9. IP Security Part III: System Security 10. Malicious Software 11. Intruders 12. Firewalls APPENDICES Appendix A Some Aspects of Number Theory Appendix B Projects for Teaching Network Security

Read more less

Book Synopsis

Read more less

Book SynopsisDr. William Stallings has made a unique contribution to understanding the broad sweep of technical developments in computer security, computer networking, and computer architecture. He has authored 18 textbooks and, counting revised editions, a total of 70 books on various aspects of these subjects. His writings have appeared in numerous ACM and IEEE publications, including the Proceedings of the IEEE and ACM Computing Reviews. He has 13 times received the award for the best computer science textbook of the year from the Text and Academic Authors Association. With more than 30 years in the field, he has been a technical contributor, a technical manager, and an executive with several high-technology firms. He has designed and implemented both TCP/IP-based and OSI-based protocol suites on a variety of computers and operating systems, ranging from microcomputers to mainframes. Currently he is an independent consultant whose clients have included computer and Table of Contents Part I: Planning for Privacy 1. Information Privacy Concepts 2. Security Governance and Management 3. Risk Assessment Part II: Privacy Threats 4. Information Storage and Processing 5. Information Collection and Dissemination 6. Intrusion and Interference Part III: Information Privacy Technology 7. Basic Privacy Controls 8. Privacy Enhancing Technology 9. Data Loss Prevention 10. Online Privacy 11. Detection of Conflicts In Security Policies 12. Privacy Evaluation Part IV: Information Privacy Regulations 13. GDPR 14. U.S. Privacy Laws and Regulations

Read more less

Book SynopsisPrepare for the MCA Azure Security Engineer certification exam faster and smarter with help from Sybex In the MCA Microsoft Certified Associate Azure Security Engineer Study Guide: Exam AZ-500, cybersecurity veteran Shimon Brathwaite walks you through every step you need to take to prepare for the MCA Azure Security Engineer certification exam and a career in Azure cybersecurity. You'll find coverage of every domain competency tested by the exam, including identity management and access, platform protection implementation, security operations management, and data and application security. You'll learn to maintain the security posture of an Azure environment, implement threat protection, and respond to security incident escalations. Readers will also find: Efficient and accurate coverage of every topic necessary to succeed on the MCA Azure Security Engineer examRobust discussions of all the skills you need to hit the ground running at your firstor nextAzure cybersecurity jobComplementary access to online study tools, including hundreds of bonus practice exam questions, electronic flashcards, and a searchable glossaryThe MCA Azure Security Engineer AZ-500 exam is a challenging barrier to certification. But you can prepare confidently and quickly with this latest expert resource from Sybex. It's ideal for anyone preparing for the AZ-500 exam or seeking to step into their next role as an Azure security engineer.Table of ContentsIntroduction xix Assessment Test xxv Chapter 1 Introduction to Microsoft Azure 1 What Is Microsoft Azure? 3 Cloud Environment Security Objectives 4 Confidentiality 4 Integrity 4 Availability 5 Nonrepudiation 5 Common Security Issues 5 Principle of Least Privilege 5 Zero- Trust Model 6 Defense in Depth 6 Avoid Security through Obscurity 9 The AAAs of Access Management 9 Encryption 10 End- to- End Encryption 11 Symmetric Key Encryption 11 Asymmetric Key Encryption 11 Network Segmentation 13 Basic Network Configuration 13 Unsegmented Network Example 14 Internal and External Compliance 15 Cybersecurity Considerations for the Cloud Environment 16 Configuration Management 17 Unauthorized Access 17 Insecure Interfaces/APIs 17 Hijacking of Accounts 17 Compliance 18 Lack of Visibility 18 Accurate Logging 18 Cloud Storage 18 Vendor Contracts 19 Link Sharing 19 Major Cybersecurity Threats 19 DDoS 19 Social Engineering 20 Password Attacks 21 Malware 21 Summary 24 Exam Essentials 24 Review Questions 26 Chapter 2 Managing Identity and Access in Microsoft Azure 29 Identity and Access Management 31 Identifying Individuals in a System 31 Identifying and Assigning Roles in a System and to an Individual 32 Assigning Access Levels to Individuals or Groups 33 Adding, Removing, and Updating Individuals and Their Roles in a System 33 Protecting a System’s Sensitive Data and Securing the System 33 Enforcing Accountability 34 IAM in the Microsoft Azure Platform 34 Creating and Managing Azure AD Identities 34 Managing Azure AD Groups 37 Managing Azure Users 39 Adding Users to Your Azure AD 39 Managing External Identities Using Azure AD 40 Managing Secure Access Using Azure Active Directory 42 Implementing Conditional Access Policies, Including MFA 44 Implementing Azure AD Identity Protection 45 Enabling the Policies 47 Implement Passwordless Authentication 50 Configuring an Access Review 52 Managing Application Access 57 Integrating Single Sign- On and Identity Providers for Authentication 57 Creating an App Registration 58 Configuring App Registration Permission Scopes 58 Managing App Registration Permission Consent 59 Managing API Permission to Azure Subscriptions 60 Configuring an Authentication Method for a Service Principal 61 Managing Access Control 62 Interpret Role and Resource Permissions 62 Configuring Azure Role Permissions for Management Groups, Subscriptions, Resource Groups, and Resources 63 Assigning Built- In Azure AD Roles 64 Creating and Assigning Custom Roles, Including Azure Roles and Azure AD Roles 65 Summary 66 Exam Essentials 67 Review Questions 70 Chapter 3 Implementing Platform Protections 73 Implementing Advanced Network Security 75 Securing Connectivity of Hybrid Networks 75 Securing Connectivity of Virtual Networks 77 Creating and Configuring Azure Firewalls 78 Azure Firewall Premium 79 Creating and Configuring Azure Firewall Manager 82 Creating and Configuring Azure Application Gateway 82 Creating and Configuring Azure Front Door 87 Creating and Configuring a Web Application Firewall 91 Configuring Network Isolation for Web Apps and Azure Functions 93 Implementing Azure Service Endpoints 94 Implementing Azure Private Endpoints, Including Integrating with Other Services 97 Implementing Azure Private Link 98 Implementing Azure DDoS Protection 101 Configuring Enhanced Security for Compute 102 Configuring Azure Endpoint Protection for VMs 102 Enabling Update Management in Azure Portal 104 Configuring Security for Container Services 108 Managing Access to the Azure Container Registry 109 Configuring Security for Serverless Compute 109 Microsoft Recommendations 111 Configuring Security for an Azure App Service 112 Exam Essentials 118 Review Questions 122 Chapter 4 Managing Security Operations 125 Configure Centralized Policy Management 126 Configure a Custom Security Policy 126 Create Custom Security Policies 127 Creating a Policy Initiative 128 Configuring Security Settings and Auditing by Using Azure Policy 129 Configuring and Managing Threat Protection 130 Configuring Microsoft Defender for Cloud for Servers (Not Including Microsoft Defender for Endpoint) 131 Configuring Microsoft Defender for SQL 134 Using the Microsoft Threat Modeling Tool 139 Azure Monitor 147 Visualizations in Azure Monitor 148 Configuring and Managing Security Monitoring Solutions 149 Creating and Customizing Alert Rules by Using Azure Monitor 149 Configuring Diagnostic Logging and Retention Using Azure Monitor 157 Monitoring Security Logs Using Azure Monitor 159 Microsoft Sentinel 167 Configuring Connectors in Microsoft Sentinel 170 Evaluating Alerts and Incidents in Microsoft Sentinel 175 Summary 176 Exam Essentials 177 Review Questions 179 Chapter 5 Securing Data and Applications 183 Configuring Security for Storage in Azure 184 Storage Account Access Keys 185 Configuring Access Control for Storage Accounts 185 Configuring Storage Account Access Keys 189 Configuring Azure AD Authentication for Azure Storage and Azure Files 191 Configuring Delegated Access for Storage Accounts 202 Configuring Security for Databases 220 Summary 254 Exam Essentials 255 Review Questions 257 Appendix A An Azure Security Tools Overview 261 Chapter 2, “Managing Identity and Access on Microsoft Azure” 262 Azure Active Directory (AD) 262 Microsoft Authenticator App 265 Azure API Management 265 Chapter 3, “Implementing Platform Protections” 266 Azure Firewall 266 Azure Firewall Manager 267 Azure Application Gateway 269 Azure Front Door 273 Web Application Firewall 273 Azure Service Endpoints 274 Azure Private Links 274 Azure DDoS Protection 275 Microsoft Defender for Cloud 276 Azure Container Registry 277 Azure App Service 278 Chapter 4, “Managing Security Operations” 279 Azure Policy 279 Microsoft Threat Modeling Tool 281 Microsoft Sentinel 287 How Does Microsoft Sentinel Work? 289 Automation 290 Chapter 5, “Securing Data and Applications” 290 Azure Key Vault 299 Appendix B Answers to Review Questions 301 Chapter 1: Introduction to Microsoft Azure 302 Chapter 2: Managing Identity and Access in Microsoft Azure 303 Chapter 3: Implementing Platform Protections 304 Chapter 4: Managing Security Operations 305 Chapter 5: Securing Data and Applications 306 Index 309

Read more less

Book SynopsisPrepare for the Security+ certification exam confidently and quickly CompTIA Security+ Practice Tests: Exam SY0-701, Third Edition, prepares you for the newly updated CompTIA Security+ exam. You''ll focus on challenging areas and get ready to ace the exam and earn your Security+ certification. This essential collection of practice tests contains study questions covering every single objective domain included on the SY0-701. Comprehensive coverage of every essential exam topic guarantees that you''ll know what to expect on exam day, minimize test anxiety, and maximize your chances of success. You''ll find 1000 practice questions on topics like general security concepts, threats, vulnerabilities, mitigations, security architecture, security operations, and security program oversight. You''ll also find: Complimentary access to the Sybex test bank and interactive learning environment Clear and accurate answers, complete with explanationsTable of ContentsIntroduction xi Chapter 1 Domain 1.0: General Security Concepts 1 Chapter 2 Domain 2.0: Threats, Vulnerabilities, and Mitigations 29 Chapter 3 Domain 3.0: Security Architecture 69 Chapter 4 Domain 4.0: Security Operations 115 Chapter 5 Domain 5.0: Security Program Management and Oversight 169 Appendix Answers to Review Questions 217 Chapter 1: Domain 1.0: General Security Concepts 218 Chapter 2: Domain 2.0: Threats, Vulnerabilities, and Mitigations 233 Chapter 3: Domain 3.0: Security Architecture 255 Chapter 4: Domain 4.0: Security Operations 283 Chapter 5: Domain 5.0: Security Program Management and Oversight 309 Index 337

Read more less

Book SynopsisFoundations of Information Security provides readers with fundamental knowledge of information security in both theoretical and practical aspects. Each chapter explores one main security concept, lists scenarios in which the concept is applicable, and discusses the implementation of that concept in detail, often by going over rival models or strategies. Readers will come away with a sense of what types of assets need protecting, what kinds of risks exist, and what kinds of defensive measures can be taken.Trade Review“This book is an excellent starting point for future security professionals but also network and system administrators.”—Help Net Security"A thorough overview for many different areas within security. The author explains what and more importantly why, then illustrates each concept with concrete, realistic examples. Definitely a great addition to any security engineer's library, but also less technical people who want to learn more about common topics like defense in depth."—Seth Foley"If you’re new to info security or are looking to refresh your knowledge, then this is an ideal book. It’s easy to read and makes the information fun to consume."—HaXez, Blogger and YouTuberTable of ContentsIntroductionChapter 1: What is Information Security?Chapter 2: Indentification and AuthenticationChapter 3: Authorization and Access ControlChapter 4: Auditing and AccountabilityChapter 5: CryptographyChapter 6: Compliance, Laws, and RegulationsChapter 7: Operations SecurityChapter 8: Human Element SecurityChapter 9: Physical SecurityChapter 10: Network SecurityChapter 11: Operating System SecurityChapter 12: Mobile, Embedded, and Internet of Things SecurityChapter 13: Application SecurityChapter 14: Assessing SecurityNotes

Read more less

Book SynopsisThis book contains selected papers presented at the 13th IFIP WG 9.2, 9.6/11.7, 11.6/SIG 9.2.2 International Summer School on Privacy and Identity Management, held in Vienna, Austria, in August 2018. The 10 full papers included in this volume were carefully reviewed and selected from 27 submissions. Also included are reviewed papers summarizing the results of workshops and tutorials that were held at the Summer School as well as papers contributed by several of the invited speakers. The papers combine interdisciplinary approaches to bring together a host of perspectives: technical, legal, regulatory, socio-economic, social, societal, political, ethical, anthropological, philosophical, historical, and psychological. Table of ContentsA Causal Bayesian Networks Viewpoint on Fairness.- Sharing is caring, a boundary object approach to mapping and discussing personal data processing.- Who You Gonna Call When There's Something Wrong in Your Processing? Risk Assessment and Data Breach Notications in Practice.- Design and Security Assessment of Usable Multi-Factor Authentication and Single Sign-On Solutions for Mobile Applications: A Workshop Experience Report.- Towards Empowering the Human for Privacy Online.- Trust and Distrust: On Sense and Nonsense in Big Data.- GDPR transparency requirements and data privacy vocabularies.- Glycos: the basis for a peer-to-peer, private online social network.- GDPR and the Concept of Risk: The Role of risk, the Scope of risk and the technology involved.- Privacy Patterns for Pseudonymity.- Implementing GDPR in the Charity Sector: A Case Study.- Me and My Robot! Sharing Information with a New Friend.- chownIoT: Enhancing IoT Privacy by Automated Handling of Ownership Change.- Is Privacy Controllable?.- Assessing Theories for Research on Personal Data Transparency.- Data Protection by Design for cross-border electronic identication: does the eIDAS Interoperability Framework need to be modernised?.- Risk proling by law enforcement agencies in the Big Data era: Is there a need for transparency?

Read more less

Book SynopsisThis book shows how open source intelligence can be a powerful tool for combating crime by linking local and global patterns to help understand how criminal activities are connected. Readers will encounter the latest advances in cutting-edge data mining, machine learning and predictive analytics combined with natural language processing and social network analysis to detect, disrupt, and neutralize cyber and physical threats. Chapters contain state-of-the-art social media analytics and open source intelligence research trends. This multidisciplinary volume will appeal to students, researchers, and professionals working in the fields of open source intelligence, cyber crime and social network analytics. Chapter Automated Text Analysis for Intelligence Purposes: A Psychological Operations Case Study is available open access under a Creative Commons Attribution 4.0 International License via link.springer.com.Table of ContentsChapter1. Studying the Weaponization of Social Media: Case Studies of Anti-NATO Disinformation Campaigns.- Chapter2. Cognitively-Inspired Inference for Malware Task Indentation.- Chapter3. Beyond the ‘Silk Road’: Assessing Illicit Drug Marketplaces on the Public Web.- Chapter4. Protecting the Web from Misinformation.- Chapter5. Social Media for Mental Health: Data, Methods, and Findings.- Chapter6. Twitter Bots and the Swedish Election.- Chapter7. Automated Text Analysis for Intelligence Purposes: A Psychological Operations Case Study.- Chapter8. You are Known by Your Friends: Leveraging Network Metrics for Bot Detection in Twitter.- Chapter9. Inferring Systemic Nets with Applications to Islamist Forums.

Read more less

Book SynopsisTrade ReviewAn important new book…[It] attempts to do for blockchain what the likes of Lawrence Lessig and Tim Wu did for the Internet and cyberspace—explain how a new technology will upend the current legal and social order…A fine, deeply-researched book that can be expected to show up on law school syllabi for years to come…Blockchain and the Law is not just a theoretical guide. It’s also a moral one. -- Jeff John Roberts * Fortune *Blockchain and the Law perfectly links technical understanding with practical and legal implications. Blockchains will matter crucially; this book, beautifully and clearly written for a wide audience, powerfully demonstrates how. -- Lawrence Lessig, Harvard Law SchoolUseful to an educated readership…If you…don’t ‘get’ crypto, this is the book-length treatment for you. It sees merit and potential in crypto, without buying into any particular claim just for the sake of hype. -- Tyler Cowen * Marginal Revolution *De Filippi and Wright stress that because blockchain is essentially autonomous, it is inflexible, which leaves it vulnerable, once it has been set in motion, to the sort of unforeseen consequences that laws and regulations are best able to address. -- James Ryerson * New York Times Book Review *De Filippi and Wright offer neither a jeremiad nor a gospel; unlike the breathlessness that pervades much writing on blockchain technology, they stick to sensibleness and sobriety. -- Nathan Schneider * America *Explores the implications of the technology in its broadest sense, positioning it in context of the evolution of the internet, and the development of artificial intelligence and autonomous systems which are continually touching more areas of our daily lives…A fascinating and comprehensive read that poses many questions we should debate and settle before blockchain technology becomes ubiquitous. * Breaker *At long last—a deeply researched, thoughtful, and measured analysis of blockchain technology and the policies that could help us harvest its opportunities and avoid its pitfalls. Blockchain and the Law should be required reading for anyone serious about understanding this major emerging element of our technological ecosystem. -- Yochai Benkler, author of The Wealth of NetworksA well-written and comprehensive book that cuts through the blockchain hype. It not only highlights the powers and limitations of blockchain technology, but solidly grounds it in a larger social and legal context. -- Bruce Schneier, author of Data and GoliathIf you are looking to understand the intricacies of the relationship between the law and blockchain technology, then this book should be on your list…[It] makes it clear that regulators must redefine their approach because restrictive regulations will stifle the growth of the industry. -- Alexander Lielacher * BTCManager *

Read more less

Book SynopsisIn this revised and updated second edition, author Andrew Hoffman examines dozens of related topics, from the latest types of attacks and mitigations to threat modeling, the secure software development lifecycle (SSDL/SDLC), and more.

Read more less

Book SynopsisA guide to becoming an NSM analyst from the ground up. It takes a fundamental approach to NSM, complete with dozens of real-world examples that teach you the key concepts of NSM. It discusses the proper methods for data collection, and teaches you how to become a skilled NSM analyst.Trade Review"... an extremely informative dive into the realm of network security data collection and analysis...well organized and thought through...I have only positive comments from my study." --The Ethical Hacker Network, Oct 31, 2014Table of ContentsIntroduction to NSM Driving Data Collection The Sensor Platform Full Packet Capture Data Session Data Protocol Metadata Statistical Data Indicators of Compromise Target-Based Detection Signature-Based Detection with Snort Signature-Based Detection with Suricata Anomaly-Based Detection with Bro Early Warning AS&W with Honeypots Packet Analysis Friendly Intelligence Hostile Intelligence Differential Diagnosis of NSM Events Incident Morbidity and Mortality Malware Analysis for NSM

Read more less

Book SynopsisJoseph Muniz is an architect and security researcher in the Cisco Security Sales and Engineering Organization. He is driven by making the world a safer place through education and adversary research. Joseph has extensive experience in designing security solutions and architectures as a trusted advisor for top Fortune 500 corporations and the U.S. government. Joseph is a researcher and industry thought leader. He speaks regularly at international conferences, writes for technical magazines, and is involved with developing training for various industry certifications. He invented the fictitious character of Emily Williams to create awareness around social engineering. Joseph runs The Security Blogger website, a popular resource for security and product implementation. He is the author and contributor of several publications including titles ranging from security best practices to exploitation tactics. When Joseph is not using technology, you can find himTable of ContentsPreface Chapter 1: Introducing Security Operations and the SOC Introducing the SOCFactors Leading to a Dysfunctional SOCCyberthreatsInvesting in SecurityThe Impact of a BreachEstablishing a Baseline The Impact of ChangeFundamental Security Capabilities Signature Detection Behavior Detection Anomaly Detection Best of Breed vs. Defense in DepthStandards, Guidelines, and Frameworks NIST Cybersecurity Framework ISO 3100:2018 FIRST Service Frameworks Applying FrameworksIndustry Threat Models The Cyber Kill Chain Model The Diamond Model MITRE ATT&CK Model Choosing a Threat ModelVulnerabilities and Risk Endless VulnerabilitiesBusiness ChallengesIn-House vs. Outsourcing Services Advantages Services Disadvantages Hybrid ServicesSOC ServicesSOC Maturity Models SOC Maturity Assessment SOC Program MaturitySOC Goals Assessment Defining Goals SOC Goals Ranking Threats Ranking SOC Goals Assessment SummarizedSOC Capabilities Assessment Capability Maps SOC Capabilities Gaps Analysis Capability Map Next StepsSOC Development MilestonesSummaryReferencesChapter 2: Developing a Security Operations Center Mission Statement and Scope Statement Developing Mission and Scope Statements SOC Scope StatementDeveloping a SOCSOC Procedures Designing ProceduresSecurity Tools Evaluating Vulnerabilities Preventive Technologies Detection Technologies Mobile Device Security ConcernsPlanning a SOC Capacity Planning Developing a Capacity PlanDesigning a SOC Facility Physical SOC vs. Virtual SOC SOC Location SOC Interior SOC Rooms SOC Computer Rooms SOC LayoutsNetwork Considerations Segmentation Logical Segmentation Choosing Segmentation Client/Server Segmentation Active Directory Segmentation Throughput Connectivity and RedundancyDisaster RecoverySecurity Considerations Policy and Compliance Network Access Control EncryptionInternal Security Tools Intrusion Detection and Prevention Network Flow and Capturing Packets Change Management Host SystemsGuidelines and Recommendations for Securing Your SOC Network Tool CollaborationSOC Tools Reporting and Dashboards Throughput and Storage Centralized Data ManagementSummaryReferencesChapter 3: SOC Services Fundamental SOC Services SOC ChallengesThe Three Pillars of Foundational SOC Support Services Pillar 1: Work Environment Pillar 2: People Pillar 3: Technology Evaluating the Three Pillars of Foundational SOC Support ServicesSOC Service Areas FIRST’s CSIRT Developing SOC Service Areas In-House Services vs. External Services Contracted vs. Employee Job RolesSOC Service Job Goals Resource PlanningService Maturity: If You Build It, They Will ComeSOC Service 1: Risk Management Four Responses to Risk Reducing Risk Addressing RiskSOC Service 2: Vulnerability Management Vulnerability Management Best Practice Vulnerability Scanning Tools Penetration TestingSOC Service 3: Compliance Meeting Compliance with AuditsSOC Service 4: Incident Management NIST Special Publication 800-61 Revision 2 Incident Response Planning Incident Impact PlaybooksSOC Service 5: Analysis Static Analysis Dynamic AnalysisSOC Service 6: Digital ForensicsSOC Service 7: Situational and Security Awareness User TrainingSOC Service 8: Research and DevelopmentSummaryReferencesChapter 4: People and Process Career vs. JobDeveloping Job Roles General Schedule Pay Scale IT Industry Job Roles Common IT Job RolesSOC Job Roles Security Analyst Penetration Tester Assessment Officer Incident Responder Systems Analyst Security Administrator Security Engineer Security Trainer Security Architect Cryptographer/Cryptologist Forensic Engineer Chief Information Security OfficerNICE Cybersecurity Workforce Framework Nice Framework ComponentsRole TiersSOC Services and Associated Job Roles Risk Management Service Vulnerability Management Service Incident Management Service Analysis Service Compliance Service Digital Forensics Service Situational and Security Awareness Service Research and Development ServiceSoft Skills Evaluating Soft Skills SOC Soft SkillsSecurity Clearance RequirementsPre-InterviewingInterviewing Interview Prompter Post InterviewOnboarding Employees Onboarding RequirementsManaging PeopleJob RetentionTraining Training MethodsCertificationsCompany CultureSummaryReferencesChapter 5: Centralizing Data Data in the SOC Strategic and Tactical Data Data Structure Data Types Data ContextData-Focused Assessment Data Assessment Example: Antivirus Threat Mapping Data Applying Data Assessments to SOC ServicesLogs Log Types Log FormatsSecurity Information and Event Management SIEM Data Processing Data Correlation Data Enrichment SIEM Solution Planning SIEM TuningTroubleshooting SIEM Logging SIEM Troubleshooting Part 1: Data Input SIEM Troubleshooting Part 2: Data Processing and Validation SIEM Troubleshooting Examples Additional SIEM FeaturesAPIs Leveraging APIs API Architectures API ExamplesBig Data Hadoop Big Data Threat FeedsMachine Learning Machine Learning in Cybersecurity Artificial Intelligence Machine Learning ModelsSummaryReferencesChapter 6: Reducing Risk and Exceeding ComplianceWhy Exceeding CompliancePolicies Policy Overview Policy Purpose Policy Scope Policy Statement Policy Compliance Related Standards, Policies, Guidelines, and Processes Definitions and Terms HistoryLaunching a New Policy Steps for Launching a New PolicyPolicy Enforcement Certification and AccreditationProcedures Procedure DocumentTabletop Exercise Tabletop Exercise Options Tabletop Exercise Execution Tabletop Exercise Format Tabletop Exercise Template ExampleStandards, Guidelines, and Frameworks NIST Cybersecurity Framework ISO/IEC 27005 CIS Controls ISACA COBIT 2019 FIRST CSIRT Services Framework Exceeding ComplianceAudits Audit Example Internal Audits External Auditors Audit ToolsAssessments Assessment Types Assessment Results Assessment Template Vulnerability Scanners Assessment Program WeaknessesPenetration Test NIST Special Publication 800-115 Additional NIST SP 800-115 Guidance Penetration Testing Types Penetration Testing PlanningIndustry Compliance Compliance RequirementsSummaryReferencesChapter 7: Threat Intelligence Threat Intelligence Overview Threat DataThreat Intelligence Categories Strategic Threat Intelligence Tactical Threat Intelligence Operational Threat Intelligence Technical Threat IntelligenceThreat Intelligence Context Threat ContextEvaluating Threat Intelligence Threat Intelligence Checklist Content Quality Testing Threat IntelligencePlanning a Threat Intelligence Project Data Expectations for Strategic Threat Intelligence Data Expectations for Tactical Threat Intelligence Data Expectations for Operational Threat Intelligence Data Expectations for Technical Threat IntelligenceCollecting and Processing Intelligence Processing Nontechnical Data Operational Data and Web Processing Technical Processing Technical Threat Intelligence Resources Actionable Intelligence Security Tools and Threat IntelligenceFeedbackSummaryReferencesChapter 8: Threat Hunting and Incident Response Security IncidentsIncident Response LifecyclePhase 1: Preparation Assigning Tasks with Playbooks Communication Third-Party Interaction Law Enforcement Law Enforcement Risk Ticketing Systems Other Incident Response Planning Templates Phase 1: Preparation SummaryPhase 2: Detection and Analysis Incident Detection Core Security Capabilities Threat Analysis Detecting Malware Behavior Infected Systems Analyzing Artifacts Identifying Artifact Types Packing Files Basic Static Analysis Advanced Static Analysis Dynamic Analysis Phase 2: Detection and Analysis SummaryPhase 3: Containment, Eradication, and Recovery Containment Responding to Malware Threat Hunting Techniques Eradicate RecoveryDigital Forensics Digital Forensic Process First Responder Chain of Custody Working with Evidence Duplicating Evidence Hashes Forensic Static Analysis Recovering Data Forensic Dynamic Analysis Digital Forensics Summary Phase 3: Containment, Eradication, and Recovery SummaryPhase 4: Post-Incident Activity Post-Incident Response Process Phase 4: Post-Incident Response SummaryIncident Response Guidelines FIRST Services FrameworksSummaryReferencesChapter 9: Vulnerability Management Vulnerability Management Phase 1: Asset Inventory Phase 2: Information Management Phase 3: Risk Assessment Phase 4: Vulnerability Assessment Phase 5: Report and Remediate Phase 6: Respond and RepeatMeasuring Vulnerabilities Common Vulnerabilities and Exposures Common Vulnerability Scoring System CVSS StandardsVulnerability Technology Vulnerability Scanners Currency and Coverage Tuning Vulnerability Scanners Exploitation Tools Asset Management and Compliance Tools Network Scanners and Network Access Control Threat Detection ToolsVulnerability Management Service Scanning Services Vulnerability Management Service Roles Vulnerability Evaluation ProceduresVulnerability Response Vulnerability Accuracy Responding to Vulnerabilities Cyber Insurance Patching Systems Residual Risk Remediation Approval Reporting ExceptionsVulnerability Management Process SummarizedSummaryReferencesChapter 10: Data Orchestration Introduction to Data Orchestration Comparing SIEM and SOAR The Rise of XDRSecurity Orchestration, Automation, and Response SOAR Example: PhantomEndpoint Detection and Response EDR Example: CrowdStrikePlaybooks Playbook Components Constructing Playbooks Incident Response Consortium Playbook Examples: Malware OutbreakAutomation Automating Playbooks Common Targets for Automation Automation Pitfalls Playbook WorkflowDevOps Programming Data Management Text-File Formats Common Data Formats Data ModelingDevOps Tools DevOps Targets Manual DevOps Automated DevOps DevOps Lab Using Ansible Ansible PlaybooksBlueprinting with Osquery Running OsqueryNetwork Programmability Learning NetDevOps APIs NetDevOps ExampleCloud Programmability Orchestration in the Cloud Amazon DevOps SaaS DevOpsSummaryReferencesChapter 11: Future of the SOC All Eyes on SD-WAN and SASE VoIP Adoption As Prologue to SD-WAN Adoption Introduction of SD-WAN Challenges with the Traditional WAN SD-WAN to the Rescue SASE Solves SD-WAN Problems SASE Defined Future of SASEIT Services Provided by the SOC IT Operations Defined Hacking IT Services IT Services Evolving Future of IT ServicesFuture of Training Training Challenges Training Today Case Study: Training I Use Today Free Training Gamifying Learning On-Demand and Personalized Learning Future of TrainingFull Automation with Machine Learning Machine Learning Machine Learning Hurdles Machine Learning Applied Training Machine Learning Future of Machine LearningFuture of Your SOC: Bringing It All Together Your Future Facilities and Capabilities Group Tags Your Future SOC Staff Audits, Assessments, and Penetration Testing Future Impact to Your Services Hunting for Tomorrow’s ThreatsSummaryReferences9780135619858 TOC 3/24/2021

Read more less

Book SynopsisEugene H. Spafford, PhD, is a professor in Computer Science at Purdue University. In his 35-year career, Spaf has been honored with every major award in cybersecurity. Leigh Metcalf, PhD, is a Senior Network Security Research Analyst at the Carnegie Mellon University Software Engineering Institute's cybersecurity-focused CERT division. Josiah Dykstra, PhD, is a cybersecurity practitioner, researcher, author, and speaker. He is the owner of Designer Security and has worked at the US National Security Agency for 18 years.Trade Review"Many security leaders are traditionally in charge of correcting misconceptions just as much as they are in charge of building up solid security practices. We have plenty of resources on practices--but this book is the crucial guide to that essential myth busting."--Phil Venables, CISO, Google Cloud "I'm writing this on my phone, over Wi-Fi, in an airplane on my way to Black Hat, one of the world's largest security conferences. The fact that I'm able to do this at all shows how much we've really learned about cybersecurity over the decades. Now it's all collected in one place for everyone to share. Thank the wise authors, and most importantly: GET OFF THEIR LAWN."--Wendy Nather, Head of Advisory CISOs, Cisco "This book is astounding. A true tour de force--which I have never said about any other book. Inverting the viewpoint is a stroke of genius. This is going to be on my grabbable-at-any-time shelf. What I learned, recalled, and was refreshed on with technically astute agnosticism cannot be measured; just appreciated as a profound historical compilation of security practice and theory. Bravo!"--Winn Schwartaul, Founder and Chief Visionary Officer, The Security Awareness Company "I am happy to endorse the central idea of this book--that cybersecurity is rife with myths that are themselves part of the problem. The brain wants to understand, the world grows ever more complicated, and the sum of the two is myth-making. As the authors say, even if some understanding is true at some time, with enough change what was true becomes a myth soon enough. As such, an acquired immunity to myths is a valuable skill for the cybersecurity practitioner if no other. The paramount goal of all security engineering is No Silent Failure, but myths perpetuate if not create silent failure. Why? Because a state of security is the absence of unmitigable surprise and you cannot mitigate what you don't know is going on. Myths blind us to reality. Ignorance of them is not bliss. This book is a vaccine."--Dan Geer, CISO, In-Q-Tel "This is a fun read for all levels. I like their rapid fire delivery and the general light they cast on so many diverse myths. This book will change the cybersecurity industry for the better."--Michael Sikorski, Author of Practical Malware Analysis & CTO, Unit 42 at Palo Alto NetworksTable of ContentsForeword by Vint Cerf xxiiiIntroduction xxivAcknowledgments xxxiiiAbout the Authors xxxiv Part I: General Issues 1 Chapter 1: What Is Cybersecurity? 2Everyone Knows What "Cybersecurity" Means 2We Can Measure How Secure Our Systems Are 5The Primary Goal of Cybersecurity Is Security 11Cybersecurity Is About Obvious Risks 12Sharing More Cyber Threat Intel Will Make Things Better 14What Matters to You Matters to Everyone Else 16Product X Will Make You Secure 17Macs Are Safer Than PCs, Linux Is Safer Than Windows 18Open Source Software Is More Secure Than Closed Source Software 19Technology X Will Make You Secure 20Process X Will Make You Secure 21Færie Dust Can Make Old Ideas Magically Revolutionary 22Passwords Should Be Changed Often 23Believe and Fear Every Hacking Demo You See 26Cyber Offense Is Easier Than Defense 27Operational Technology (OT) Is Not Vulnerable 29Breaking Systems Is the Best Way to Establish Yourself 30Because You Can, You Should 30Better Security Means Worse Privacy 32Further Reading 33 Chapter 2: What Is the Internet? 36Everyone Knows What the "Internet" Means 36An IP Address Identifies a Unique Machine 37The Internet Is Managed and Controlled by a Central Body 39The Internet Is Largely Static 40Your Network Is Static 41Email Is Private 43Cryptocurrency Is Untraceable 44Everything Can Be Fixed with Blockchain 46The Internet Is Like an Iceberg 46A VPN Makes You Anonymous 48A Firewall Is Enough 49Further Reading 51 Part II: Human Issues 55 Chapter 3: Faulty Assumptions and Magical Thinking 56Humans Will Behave Rationally, So Blame the User! 57We Know Everything We Need to Know About Cybersecurity Problems 62Compliance Equals (Complete) Security 63Authentication Provides Confidentiality 65I Can Never Be Secure, So Why Bother? 65I Am Too Small/Insignificant to Be a Target 66Everybody Is Out to Get Me 69I Engage Only with Trusted Websites, So My Data Is Safe from a Breach 71Security by Obscurity Is Reasonably Secure 72The Illusions of Visibility and Control 74Five 9's Is the Key to Cybersecurity 76Everybody Has Top-of-the-Line Technology 78We Can Predict Future Threats 80Security People Control Security Outcomes 81All Bad Outcomes Are the Result of a Bad Decision 82More Security Is Always Better 84Best Practices Are Always Best 85Because It Is Online It Must Be True/Correct 86Further Reading 87 Chapter 4: Fallacies and Misunderstandings 88The False Cause Fallacy: Correlation Is Causation 89Absence of Evidence Is Evidence of Absence 92The Straw Hacker Fallacy 94Ad Hominem Fallacy 95Hasty Generalization Fallacy 96Regression Fallacy 97Base Rate Fallacy 98Gambler's Fallacy 100Fallacies of Anomalies 100Ignorance of Black Swans 101Conjunction and Disjunction Fallacies 103Valence Effect 104Endowment Effect 104Sunk Cost Fallacy 105Bonus Fallacies 107Further Reading 109 Chapter 5: Cognitive Biases 110Action Bias 112Omission Bias 113Survivorship Bias 115Confirmation Bias 116Choice Affirmation Bias 117Hindsight Bias 117Availability Bias 119Social Proof 121Overconfidence Bias 122Zero Risk Bias 123Frequency Bias 124Bonus Biases 125Further Reading 128 Chapter 6: Perverse Incentives and the Cobra Effect 130The Goal of a Security Vendor Is to Keep You Secure 131Your Cybersecurity Decisions Affect Only You 132Bug Bounties Eliminate Bugs from the Offensive Market 134Cyber Insurance Causes People to Take Less Risk 135Fines and Penalties Cause People to Take Less Risk 136Attacking Back Would Help Stop Cyber Crime 137Innovation Increases Security and Privacy Incidents 138Further Reading 139 Chapter 7: Problems and Solutions 140Failure Is Not an Option in Cybersecurity 141Every Problem Has a Solution 142Anecdotes Are Good Leads for Cybersecurity Solutions 147Detecting More "Bad Stuff" Means the New Thing Is an Improvement 148Every Security Process Should Be Automated 149Professional Certifications Are Useless 151Further Reading 158 Part III: Contextual Issues 161 Chapter 8: Pitfalls of Analogies and Abstractions 162Cybersecurity Is Like the Physical World 165Cybersecurity Is Like Medicine and Biology 170Cybersecurity Is Like Fighting a War 172Cybersecurity Law Is Analogous to Physical-World Law 175Tips for Analogies and Abstractions 175Further Reading 178 Chapter 9: Legal Issues 180Cybersecurity Law Is Analogous to Physical-World Law 181Your Laws Do Not Apply to Me Where I Am 182That Violates My First Amendment Rights! 184Legal Code Supersedes Computer Code 186Law Enforcement Will Never Respond to Cyber Crimes 191You Can Always Hide Information by Suing 193Suing to Suppress a Breach Is a Good Idea 194Terms and Conditions Are Meaningless 194The Law Is on My Side, So I Do Not Need to Worry 195Further Reading 196 Chapter 10: Tool Myths and Misconceptions 198The More Tools, The Better 199Default Configurations Are Always Secure 201A Tool Can Stop All Bad Things 203Intent Can Be Determined from Tools 205Security Tools Are Inherently Secure and Trustworthy 207Nothing Found Means All Is Well 209Further Reading 212 Chapter 11: Vulnerabilities 214We Know Everything There Is to Know About Vulnerabilities 215Vulnerabilities Are Sparse 218Attackers Are Getting More Proficient 218Zero-Day Vulnerabilities Are Most Important 219All Attacks Hinge on a Vulnerability 223Exploits and Proofs of Concept Are Bad 226Vulnerabilities Happen Only in Complex Code 228First Movers Should Sacrifice Security 230Patches Are Always Perfect and Available 231Defenses Might Become Security Vulnerabilities with Time 236All Vulnerabilities Can Be Fixed 237Scoring Vulnerabilities Is Easy and Well Understood 239Because You Can, You Should--Vulnerabilities Edition 240Vulnerability Names Reflect Their Importance 241Further Reading 242 Chapter 12: Malware 244Using a Sandbox Will Tell Me Everything I Need to Know 246Reverse Engineering Will Tell Me Everything I Need to Know 249Malware and Geography Are/Are Not Related 251I Can Always Determine Who Made the Malware and Attacked Me 253Malware Is Always a Complex Program That Is Difficult to Understand 254Free Malware Protection Is Good Enough 256Only Shady Websites Will Infect Me 257Because You Can, You Should--Malware Edition 258Ransomware Is an Entirely New Kind of Malware 259Signed Software Is Always Trustworthy 261Malware Names Reflect Their Importance 263Further Reading 264 Chapter 13: Digital Forensics and Incident Response 266Movies and Television Reflect the Reality of Cyber 267Incidents Are Discovered as Soon as They Occur 269Incidents Are Discrete and Independent 270Every Incident Is the Same Severity 271Standard Incident Response Techniques Can Deal with Ransomware 272Incident Responders Can Flip a Few Switches and Magically EverythingIs Fixed 273Attacks Are Always Attributable 276Attribution Is Essential 278Most Attacks/Exfiltration of Data Originate from Outside the Organization 280The Trojan Horse Defense Is Dead 281Endpoint Data Is Sufficient for Incident Detection 282Recovering from an Event Is a Simple and Linear Process 284Further Reading 285 Part IV: Data Issues 287 Chapter 14: Lies, Damn Lies, and Statistics 288Luck Prevents Cyber Attacks 289The Numbers Speak for Themselves 290Probability Is Certainty 290Statistics Are Laws 293Data Is Not Important to Statistics 303Artificial Intelligence and Machine Learning Can Solve AllCybersecurity Problems 306Further Reading 310 Chapter 15: Illustrations, Visualizations, and Delusions 312Visualizations and Dashboards Are Inherently and Universally Helpful 313Cybersecurity Data Is Easy to Visualize 319Further Reading 324 Chapter 16: Finding Hope 326Creating a Less Myth-Prone World 328The Critical Value of Documentation 329Meta-Myths and Recommendations 331Avoiding Other and Future Traps 334Parting Thoughts 334 Appendix: Short Background Explanations 336 Acronyms 344Index 350

Read more less

Book SynopsisTable of Contents Introduction xxxvii Chapter 1: The Scope of Digital Forensics 2 Popular Myths about Computer Forensics.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Types of Digital Forensic Evidence Recovered.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 What Skills Must a Digital Forensics Investigator Possess?.. . . . . . . . . . . . . . . . . . . . 10 The Importance of Digital Forensics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Job Opportunities.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 A History of Digital Forensics.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Training and Education.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Chapter 2: Windows Operating and File Systems 34 Physical and Logical Storage.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Paging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 File Conversion and Numbering Formats.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Operating Systems.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Windows Registry.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Microsoft Office.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Microsoft Windows Features.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Chapter 3: Handling Computer Hardware 92 Hard Disk Drives.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Cloning a PATA or SATA Hard Disk. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Removable Memory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Reference.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Chapter 4: Acquiring Evidence in a Computer Forensics Lab 126 Lab Requirements.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 Private-Sector Computer Forensics Laboratories.. . . . . . . . . . . . . . . . . . . . . . . . . . . 130 Computer Forensics Laboratory Requirements.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Extracting Evidence from a Device.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 Skimmers.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 Steganography. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 Chapter 5: Online Investigations 176 Working Undercover.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 Dark Web Investigations.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184 Virtual Currencies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 Website Evidence.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189 Background Searches on a Suspect.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191 Online Crime. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209 Capturing Online Communications.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 Edge Web Browser.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216 Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216 Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218 Chapter 6: Documenting the Investigation 224 Obtaining Evidence from a Service Provider.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224 Documenting a Crime Scene.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226 Seizing Evidence.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 Documenting the Evidence.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 Using Tools to Document an Investigation.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 Writing Reports.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236 Using Expert Witnesses at Trial.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246 Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246 Chapter 7: Admissibility of Digital Evidence 252 History and Structure of the United States Legal System.. . . . . . . . . . . . . . . . . . . . . 253 Evidence Admissibility. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 Constitutional Law.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 When Computer Forensics Goes Wrong.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296 Structure of the Legal System in the European Union (E.U.).. . . . . . . . . . . . . . . . . . . 296 Privacy Legislation in Asia. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305 Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309 Chapter 8: Network Forensics and Incident Response 314 The Tools of the Trade.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315 Networking Devices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316 Understanding the OSI Model.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341 Introduction to VoIP.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346 Incident Response (IR).. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348 STIX, TAXII, and Cybox.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349 Advanced Persistent Threats.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349 Investigating a Network Attack. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364 Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365 Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367 Chapter 9: Mobile Forensics 372 The Cellular Network.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374 Handset Specifications.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 389 Mobile Operating Systems.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391 Standard Operating Procedures for Handling Handset Evidence.. . . . . . . . . . . . . . . 401 Handset Forensics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406 Manual Cellphone Examinations.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408 Global Satellite Service Providers.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410 Legal Considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410 Other Mobile Devices.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413 Documenting the Investigation.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416 Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416 Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 421 Chapter 10: Mobile App Investigations 426 Static Versus Dynamic Analysis.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427 Dating Apps.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441 Rideshare Apps.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 450 Communication Apps.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457 Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457 Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 458 Chapter 11: Photograph Forensics 460 National Center for Missing and Exploited Children (NCMEC).. . . . . . . . . . . . . . . . . 462 Project VIC.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 Case Studies.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 Understanding Digital Photography.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464 Examining Picture Files.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466 Evidence Admissibility. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470 Case Studies.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474 Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474 Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 475 Chapter 12: Mac Forensics 480 A Brief History.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 480 Apple Wi-Fi Devices.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487 Macintosh File Systems.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489 Macintosh Operating Systems.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 Apple Mobile Devices.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 507 Performing a Mac Forensics Examination.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 527 Case Studies.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 531 Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 531 Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535 Chapter 13: Case Studies 538 Silk Road.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 538 Las Vegas Massacre.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549 Zacharias Moussaoui.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551 BTK (Bind Torture Kill) Serial Killer.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 555 Cyberbullying.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 557 Sports.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 561 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563 Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563 Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 564 Assignment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 570 Chapter 14: Internet of Things (IoT) Forensics and Emergent Technologies 572 5G.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573 Wi-Fi 6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 575 Wi-Fi Mesh Networks.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 576 Shodan.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 576 Mirai Botnet.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577 Cryptocurrency Mining.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577 Alexa.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 578 Micro-Chipping.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579 Fitness Trackers.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579 Apple Watch.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 581 Action Cameras.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 583 Police Safety.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 583 Police Vehicles.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 585 Vehicle Forensics.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 585 Low-Tech Solution for High-Tech Seizures.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 586 Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 588 Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 588 Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 590 Answer Key 594 9780789759917, TOC, 8/10/2020

Read more less

Book SynopsisA practical handbook to cybersecurity for both tech and non-tech professionals As reports of major data breaches fill the headlines, it has become impossible for any business, large or small, to ignore the importance of cybersecurity. Most books on the subject, however, are either too specialized for the non-technical professional or too general for positions in the IT trenches. Thanks to author Nadean Tanner's wide array of experience from teaching at a University to working for the Department of Defense, the Cybersecurity Blue Team Toolkit strikes the perfect balance of substantive and accessible, making it equally useful to those in IT or management positions across a variety of industries. This handy guide takes a simple and strategic look at best practices and tools available to both cybersecurity management and hands-on professionals, whether they be new to the field or looking to expand their expertise. Tanner gives comprehensive coverage to such crucial topics as security asTable of ContentsForeword xxi Introduction xxiii Chapter 1 Fundamental Networking and Security Tools 1 Ping 1 IPConfig 4 NSLookup 7 Tracert 9 NetStat 10 PuTTY 14 Chapter 2 Troubleshooting Microsoft Windows 17 RELI 18 PSR 19 PathPing 21 MTR 23 Sysinternals 24 The Legendary God Mode 28 Chapter 3 Nmap—The Network Mapper 31 Network Mapping 32 Port Scanning 34 Services Running 36 Operating Systems 38 Zenmap 39 Chapter 4 Vulnerability Management 43 Managing Vulnerabilities 43 OpenVAS 46 Nexpose Community 50 Chapter 5 Monitoring with OSSEC 57 Log-Based Intrusion Detection Systems 57 Agents 61 Adding an Agent 63 Extracting the Key for an Agent 64 Removing an Agent 64 Log Analysis 65 Chapter 6 Protecting Wireless Communication 67 802.11 67 inSSIDer 70 Wireless Network Watcher 71 Hamachi 72 Tor 78 Chapter 7 Wireshark 83 Wireshark 83 OSI Model 86 Capture 89 Filters and Colors 92 Inspection 93 Chapter 8 Access Management 97 AAA 98 Least Privilege 99 Single Sign-On 101 JumpCloud 103 Chapter 9 Managing Logs 109 Windows Event Viewer 110 Windows PowerShell 112 BareTail 116 Syslog 117 SolarWinds Kiwi 120 Chapter 10 Metasploit 125 Reconnaissance 127 Installation 128 Gaining Access 135 Metasploitable2 139 Vulnerable Web Services 144 Meterpreter 146 Chapter 11 Web Application Security 147 Web Development 148 Information Gathering 151 DNS 153 Defense in Depth 155 Burp Suite 156 Chapter 12 Patch and Configuration Management 165 Patch Management 166 Configuration Management 173 Clonezilla Live 179 Chapter 13 Securing OSI Layer 8 187 Human Nature 188 Human Attacks 192 Education 193 The Social Engineer Toolkit 195 Chapter 14 Kali Linux 205 Virtualization 206 Optimizing Kali Linux 219 Using Kali Linux Tools 221 Maltego 222 Recon-ng 223 Sparta 225 MacChanger 225 Nikto 226 Kismet 227 WiFite 228 John the Ripper 229 Hashcat 230 Chapter 15 CISv7 Controls and Best Practices 235 CIS Basic Controls—The Top Six 236 Inventory and Control of Hardware Assets 236 Inventory and Control of Software Assets 238 Continuous Vulnerability Management 239 Controlled Use of Administrative Privileges 240 Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers 241 Maintenance, Monitoring, and Analysis of Audit Logs 246 In Conclusion 248 Index 249

Read more less

Book SynopsisPublisher's Note: Products purchased from Third Party sellers are not guaranteed by the publisher for quality, authenticity, or access to any online entitlements included with the product.This self-study guide delivers complete coverage of every topic on the GIAC Certified Incident Handler examPrepare for the challenging GIAC Certified Incident Handler exam using the detailed information contained in this effective exam preparation guide. Written by a recognized cybersecurity expert and seasoned author, GCIH GIAC Certified Incident Handler All-in-One Exam Guide clearly explains all of the advanced security incident handling skills covered on the test. Detailed examples and chapter summaries throughout demonstrate real-world threats and aid in retention. You will get online access to 300 practice questions that match those on the live test in style, format, and tone. Designed to help you prepare for the exam, this resource also serves a

Read more less

Book SynopsisApply the basics of security in serverless computing to new or existing projects. This hands-on guide provides practical examples and fundamentals. You will apply these fundamentals in all aspects of serverless computing: improving the code, securing the application, and protecting the infrastructure. You will come away having security knowledge that enables you to secure a project you are supporting and have technical conversations with cybersecurity personnel.At a time when there are many news stories on cybersecurity breaches, it is crucial to think about security in your applications. It is tempting to believe that having a third-party host the entire computing platform will increase security. This book shows you why cybersecurity is the responsibility of everyone working on the project.What You Will Learn Gain a deeper understanding of cybersecurity in serverless computing Know how to use free and open sourceTable of ContentsIntroduction Part I: The Need for Security Chapter 1: Determining Scope Understanding the Application Scoping Chapter 2: Performing a Risk Assessment Understanding the Threat Landscape Threat Modeling Preparing the Risk Assessment Part II: Securing the Application Chapter 3: Securing the Code Assessing Dependencies Using Static Code Analysis Tools Writing Unit Tests Chapter 4: Securing the Interfaces Identifying the Interfaces Determining the Interface Inputs Reducing the Attack Surface Chapter 5: Securing the Code Repository Using a Code Repository Limiting Saved Content Part III: Securing the Infrastructure Chapter 5: Restricting Permissions Understanding Permissions Identifying the Services Updating the Permissions Chapter 6: Account Management Understanding Account Access Restricting Account Access Implementing Multi-Factor Authentication Using Secrets Part IV: Monitoring and Alerting Chapter 7: Monitoring Logs Understanding Logging Methods Reviewing Logs Chapter 8: Monitoring Metrics Understanding Metrics Reviewing Metrics Chapter 9: Monitoring Billing Understanding Billing Reviewing Billing Chapter 10: Monitoring Security Events Understanding Security Events Reviewing Security Event Chapter 10: Alerting Understanding Alerting Implementing Alerting Chapter 11: Auditing Understanding Auditing Implementing Auditing Part V: Security Assessment and Report Chapter 12: Finalizing the Risk Assessment Scoring the Identified Risks Defining the Mitigation Steps Assessing the Business Impact Determining the Overall Security Risk Level

Read more less

Book SynopsisFrom Russia’s tampering with the US election to the WannaCry hack that temporarily crippled the NHS, cyber has become the weapon of choice for democracies, dictators, and terrorists. Cheap to acquire, easily deniable, and used for a variety of malicious purposes — from crippling infrastructure to sowing discord and doubt — cyberweapons are re-writing the rules of warfare. In less than a decade, they have displaced terrorism and nuclear missiles as the biggest immediate threat to international security and to democracy. Here, New York Times correspondent David E. Sanger takes us from the White House Situation Room to the dens of Chinese government hackers and the boardrooms of Silicon Valley, piecing together a remarkable picture of a world now coming face-to-face with the most sophisticated — and arguably most dangerous — weapon ever invented. The Perfect Weapon is the dramatic story of a new era of constant sabotage, misinformation, and fear, in which everyone is a target. Trade Review‘This encyclopedic account by a Times correspondent traces the rapid rise of cyberwarfare capabilities and warns that ideas about how to control them are only beginning to emerge.’ * The New York Times Book Review (Editor’s Choice) *‘[Sanger] writes with persuasiveness and authority.’ * The Telegraph *‘In a chilling new book, The Perfect Weapon, David Sanger details how more than 30 nations have developed effective cyber forces.’ * Financial Times *‘An encyclopedic account of policy-relevant happenings in the cyberworld … the most comprehensive, readable source of information and insight about the policy quandaries that modern information technology and its destructive potential have spawned.’ -- Paul R. Pillar * The New York Times *‘[The Perfect Weapon is] an important – and deeply sobering – new book about cyberwarfare.’ -- Nicholas Kristof * The New York Times *‘A reader finishes this book fully understanding why cyberwar has moved rapidly to the top of America’s official list of national security threats.’ -- David von Drehle * The Washington Post *‘In his new book, The Perfect Weapon, Sanger offers a panoramic view of the rapidly evolving world of cyber-conflict. He covers incidents from the covert U.S. cyber-campaign to sabotage Iran’s nuclear program (a story we know about largely because of Sanger’s diligent reporting) to Edward Snowden’s epic heist of National Security Agency data. And yes, there’s also plenty of background on Russia’s active measures during the 2016 campaign. But there’s also a wealth of gripping material on stories that have probably been missed by the broader public … It all adds up to a persuasive argument for the truth of the book’s title.’ -- Christian Caryl * The Washington Post *‘Anyone who doubts cyber’s unintended consequences should read David Sanger’s new book The Perfect Weapon. Sanger, a reporter for The New York Times, has been a dogged and diligent observer of cybersecurity issues for years. His book is a readable account of what went wrong.’ -- Robert Samuelson * The Washington Post *‘Computer and cyber warfare is a burgeoning mode of conflict that poses serious threats to the United States, Pulitzer-winning New York Times correspondent Sanger (Confront and Conceal) argues in this perhaps overly worried investigation. Sanger gives a lucid account of national programs for digital espionage and warfare, but it’s not always clear that the various technologies described hold much danger; for example, he doesn’t make a strong case that Russian spoofing of social media accounts really undermines American democracy. Readers could use a more thorough exploration of the limitations of supposedly perfect digital weapons.’ * Publishers Weekly *‘You may not have realised it but we are at war. A world war. And it’s not clear who’s winning or who will ultimately win, but the battleground is vast — cyberspace … David E. Sanger sums up where we are and where we could be heading.’ -- Jon Wise * Weekend Sport *‘[A] sobering new book.’ -- John Naughton * The Guardian *‘The book’s greatest strength is in how Sanger captures the complexities of cyber weapons and cyber operations to illustrate the internal dynamics of the Obama administration as it grappled with these emerging capabilities … Where he falls a bit short is on the other side of the equation, where those principles fell somewhat short. Apple for all of its stances on privacy and protecting consumer information bent over backwards to accommodate the Chinese government … It is well reported, well sourced, and his access provides insights into what many of the key players were thinking at the time and in the years since their tenure ended … For lay readers, The Perfect Weapon is a great one-volume precis on recent cyber war.’ * Joshua Huminski, The Diplomatic Courier *‘The Perfect Weapon may be one of the most important, if chilling, books you’ll read this year.’ * The Saturday Age *‘Sanger, The New York Times’ security correspondent, has catalogued the recent history of cyber warfare, how it needs to be confronted and the intensely complex policy issues that arise. This is the last word in the modern world of cyber warfare – until artificial intelligence takes over.’ * Mercury *‘Sanger, The New York Times’ security correspondent, has catalogued the recent history of how cyber warfare has developed, how it needs to be confronted, and the intensely complex policy issues that arise.’ * Courier Mail *‘The greatest virtue of Sanger’s writing is that it is clear-headed and morally grounded, not in any way breathless or apocalyptic.’ -- Paul Monk * Weekend Australian *‘For the rest of the lay public, this very accessible book by New York Times journalist David Sanger is an outstanding volume to fill in the gaps.’ -- Anthony Smith * NZ International Review *Praise for The Inheritance:‘[Sanger is] a shrewd and insightful strategic thinker.’ -- Gary J. Bass * The New York Times *

Read more less

Book SynopsisThis book provides a comprehensive overview of the key concerns as well as research challenges in designing secure and resilient Industrial Control Systems (ICS). It will discuss today's state of the art security architectures and couple it with near and long term research needs that compare to the baseline. It will also establish all discussions to generic reference architecture for ICS that reflects and protects high consequence scenarios.Significant strides have been made in making industrial control systems secure. However, increasing connectivity of ICS systems with commodity IT devices and significant human interaction of ICS systems during its operation regularly introduces newer threats to these systems resulting in ICS security defenses always playing catch-up. There is an emerging consensus that it is very important for ICS missions to survive cyber-attacks as well as failures and continue to maintain a certain level and quality of service. Such resilient ICS design requires one to be proactive in understanding and reasoning about evolving threats to ICS components, their potential effects on the ICS mission’s survivability goals, and identify ways to design secure resilient ICS systems.This book targets primarily educators and researchers working in the area of ICS and Supervisory Control And Data Acquisition (SCADA) systems security and resiliency. Practitioners responsible for security deployment, management and governance in ICS and SCADA systems would also find this book useful. Graduate students will find this book to be a good starting point for research in this area and a reference source.Table of Contents1. Current and New Practice.- 2. Cyber-Modeling, Detection, and Forensics.- 3. Proactive Defense Mechanism Design.- 4. Human System Interface.- 5. Metrics For Resilience.

Read more less

Book SynopsisIn a world of accelerating unending change, perpetual surveillance, and increasing connectivity, conflict has become ever more complex. Wars are no longer limited to the traditional military conflict domains—land, sea, air; even space and cyber space. The new battlefield will be the cognitive domain and the new conflict a larger contest for power; a contest for cognitive superiority. Written by experts in military operations research and neuropsychology, this book introduces the concept of cognitive superiority and provides the keys to succeeding within a complex matrix where the only rules are the laws of physics, access to information, and the boundaries of cognition.The book describes the adversarial environment and how it interacts with the ongoing, accelerating change that we are experiencing, irrespective of adversaries. It talks about the ascendant power of information access, pervasive surveillance, personalized persuasion, and emerging new forms of cognition. It profiles salient technologies and science, including persuasion science, artificial intelligence and machine learning (AI/ML), surveillance technologies, complex adaptive systems, network science, directed human modification, and biosecurity. Readers will learn about human and machine cognition, what makes it tick, and why and how we and our technologies are vulnerable.Following in the tradition of Sun-Tsu and von Clausewitz, this book writes a new chapter in the study of warfare and strategy. It is written for those who lead, aspire to leadership, and those who teach or persuade, especially in the fields of political science, military science, computer science, and business.Table of ContentsChapter 1: Introduction – Humans and their Matrix.- Chapter 2: The Technium – Tools and Targets of the Conflicts.- Chapter 3: The Noosphere.- Chapter 4: The Target – Humans.- Chapter 5: The Technium – Plus, Redux.- Chapter 6: The adversarial Environment.- Chapter 7: Engagement.- Chapter 8: Conclusion.- Appendix.- Glossary of Selected Terms.- Bibliography.- Index.

Read more less

Book SynopsisThis book constitutes selected papers from the 24th International Conference on Information Security and Cryptology, ICISC 2021, held in Seoul, South Korea, in December 2021. The total of 23 papers presented in this volume were carefully reviewed and selected from 63 submissions. The papers are arranged by topic: Cryptographic Protocol in Quantum Computer Age; Security Analysis of Hash Algorithm; Security analysis of Symmetric Key Encryption Algorithm; Fault and Side-Channel Attack; Constructions and Designs; Quantum Circuit; Efficient Implementation. The aim of this conference was to provide an international forum for the latest results of research, development, and applications within the field of information security and cryptology.Table of ContentsCryptographic Protocol in Quantum Computer Age.- Security Analysis of Hash Algorithm.- Security analysis of Symmetric Key Encryption Algorithm.- Fault and Side-Channel Attack; Constructions and Designs.- Quantum Circuit.- Efficient Implementation.- Cryptographic Protocol I Revocable Hierarchical Identity-Based Authenticated Key Exchange.- Towards Witness Encryption Without Multilinear Maps.- Designated-Verifier Linkable Ring Signatures.- ATSSIA: Asynchronous Truly-Threshold Schnorr Signing for Inconsistent Availability.- Cryptographic Protocol in Quantum Computer Age Delegating Supersingular Isogenies over Fp2 with Cryptographic Applications.- Improved Lattice-Based Mix-Nets for Electronic Voting.- Practical Post-quantum Password-Authenticated Key Exchange Based-on Module-Lattice.- Security Analysis Improved Lattice Enumeration Algorithms by Primal and Dual Reordering Methods.- Resilient CFI: Compiler-based Attack Origin Tracking with Dynamic Taint Analysis.- Security Analysis of Hash Algorithm Preimage Attacks on 4-round Keccak by Solving Multivariate Quadratic Systems.- A Preimage Attack on Reduced Gimli-Hash.- Security analysis of Symmetric Key Encryption Algorithm Algebraic Attacks on Grain-like Keystream Generators.- Improved See-In-The-Middle Attacks on AES.- Fault and Side-Channel Attack Differential Fault Attack on Rocca .- Differential Fault Attack on Lightweight Block Cipher PIPO.- Learning-based Side-Channel Analysis on PIPO.- Constructions and Designs Collision-Resistant and Pseudorandom Function Based on Merkle-Damgard Hash Function.- Forward Secure Message Franking.- New General Framework for Algebraic Degree Evaluation of NFSR-Based Cryptosystems.- Quantum Circuit T–depth reduction method for efficient SHA–256 quantum circuit construction.

Read more less

Book SynopsisCharles P. Pfleeger is an internationally known expert on computer and communications security. He spent 14 years as professor of computer science at the University of Tennessee, before moving on to computer research and consulting company, Trusted Information Systems, where he was director of European operations and senior consultant. He was also director of research, member of the staff, and chief security officer at Cable and Wireless. He has chaired the IEEE Computer Society Technical Committee on Security and Privacy and was on the editorial board of IEEE Security & Privacy magazine. Shari Lawrence Pfleeger is a widely known software engineering and computer security researcher. She served as president of Systems/Software and then as senior researcher with the Rand Corporation. As research director of the Institute for Information Infrastructure Protection, she oversaw large, high-impact computer security research projects for iTable of ContentsForeword xixPreface xxvAcknowledgments xxxiAbout the Authors xxxiii Chapter 1: Introduction 11.1 What Is Computer Security? 31.2 Threats 61.3 Harm 241.4 Vulnerabilities 301.5 Controls 301.6 Conclusion 331.7 What's Next? 341.8 Exercises 36 Chapter 2: Toolbox: Authentication, Access Control, and Cryptography 382.1 Authentication 402.2 Access Control 782.3 Cryptography 932.4 Conclusion 1372.5 Exercises 138 Chapter 3: Programs and Programming 1413.1 Unintentional (Nonmalicious) Programming Oversights 1433.2 Malicious Code--Malware 1783.3 Countermeasures 2113.4 Conclusion 2453.5 Exercises 245 Chapter 4: The Internet--User Side 2484.1 Browser Attacks 2514.2 Attacks Targeting Users 2654.3 Obtaining User or Website Data 2804.4 Mobile Apps 2894.5 Email and Message Attacks 3104.6 Conclusion 3204.7 Exercises 321 Chapter 5: Operating Systems 3235.1 Security in Operating Systems 3235.2 Security in the Design of Operating Systems 3515.3 Rootkits 3715.4 Conclusion 3825.5 Exercises 382 Chapter 6: Networks 3856.1 Network Concepts 386Part I--War on Networks: Network Security Attacks 3996.2 Threats to Network Communications 4006.3 Wireless Network Security 4216.4 Denial of Service 4436.5 Distributed Denial of Service 468Part II--Strategic Defenses: Security Countermeasures 4796.6 Cryptography in Network Security 4796.7 Firewalls 4976.8 Intrusion Detection and Prevention Systems 5226.9 Network Management 5366.10 Conclusion 5456.11 Exercises 545 Chapter 7: Data and Databases 5497.1 Introduction to Databases 5507.2 Security Requirements of Databases 5557.3 Reliability and Integrity 5617.4 Database Disclosure 5667.5 Data Mining and Big Data 5857.6 Conclusion 5997.7 Exercises 599 Chapter 8: New Territory 6018.1 Introduction 6018.2 Cloud Architectures and Their Security 6058.3 IoT and Embedded Devices 6278.4 Cloud, IoT, and Embedded Devices--The Smart Home 6388.5 Smart Cities, IoT, Embedded Devices, and Cloud 6438.6 Cloud, IoT, and Critical Services 6488.7 Conclusion 6578.8 Exercises 658 Chapter 9: Privacy 6599.1 Privacy Concepts 6609.2 Privacy Principles and Policies 6719.3 Authentication and Privacy 6889.4 Data Mining 6949.5 Privacy on the Internet 6989.6 Email and Message Security 7139.7 Privacy Impacts of Newer Technologies 7179.8 Conclusion 7249.9 Exercises 725 Chapter 10: Management and Incidents 72710.1 Security Planning 72710.2 Business Continuity Planning 73810.3 Handling Incidents 74210.4 Risk Analysis 74910.5 Physical Threats to Systems 76710.6 New Frontiers in Security Management 77610.7 Conclusion 77810.8 Exercises 779 Chapter 11: Legal Issues and Ethics 78111.1 Protecting Programs and Data 78311.2 Information and the Law 80011.3 Rights of Employees and Employers 80511.4 Redress for Software Failures 80811.5 Computer Crime 81411.6 Ethical Issues in Computer Security 82211.7 An Ethical Dive into Artificial Intelligence 82811.8 Incident Analyses with Ethics 83011.9 Conclusion 84611.10 Exercises 847 Chapter 12: Details of Cryptography 85012.1 Cryptology 85112.2 Symmetric Encryption Algorithms 86312.3 Asymmetric Encryption 87712.4 Message Digests 88312.5 Digital Signatures 88812.6 Quantum Key Distribution 88912.7 Conclusion 894 Chapter 13: Emerging Topics 89513.1 AI and Cybersecurity 89613.2 Blockchains and Cryptocurrencies 90813.3 Offensive Cyber and Cyberwarfare 92413.4 Quantum Computing and Computer Security 93613.5 Conclusion 937 Bibliography 939Index 963

Read more less

Book SynopsisThe essential reference for security pros and CCIE Security candidates: identity, context sharing, encryption, secure connectivity and virtualization Integrated Security Technologies and Solutions – Volume II brings together more expert-level instruction in security design, deployment, integration, and support. It will help experienced security and network professionals manage complex solutions, succeed in their day-to-day jobs, and prepare for their CCIE Security written and lab exams. Volume II focuses on the Cisco Identity Services Engine, Context Sharing, TrustSec, Application Programming Interfaces (APIs), Secure Connectivity with VPNs, and the virtualization and automation sections of the CCIE v5 blueprint. Like Volume I, its strong focus on interproduct integration will help you combine formerly disparate systems into seamless, coherent, next-generation security solutions. Part of the Cisco CCIE Professional Development Series from Cisco Press, it is authored by a team of CCIEs who are world-class experts in their Cisco security disciplines, including co-creators of the CCIE Security v5 blueprint. Each chapter starts with relevant theory, presents configuration examples and applications, and concludes with practical troubleshooting. Review the essentials of Authentication, Authorization, and Accounting (AAA) Explore the RADIUS and TACACS+ AAA protocols, and administer devices with them Enforce basic network access control with the Cisco Identity Services Engine (ISE) Implement sophisticated ISE profiling, EzConnect, and Passive Identity features Extend network access with BYOD support, MDM integration, Posture Validation, and Guest Services Safely share context with ISE, and implement pxGrid and Rapid Threat Containment Integrate ISE with Cisco FMC, WSA, and other devices Leverage Cisco Security APIs to increase control and flexibility Review Virtual Private Network (VPN) concepts and types Understand and deploy Infrastructure VPNs and Remote Access VPNs Virtualize leading Cisco Security products Make the most of Virtual Security Gateway (VSG), Network Function Virtualization (NFV), and microsegmentation Table of Contents Introduction xixPart I Knock, Knock! Who’s There? 1Chapter 1 Who and What: AAA Basics 3 Fundamentals of AAA 3 Understanding the Concept of Triple-A in the Real World 4 Compare and Select AAA Options 4 TACACS+ 7 RADIUS 12 Comparing RADIUS and TACACS+ 15 Summary 16Chapter 2 Basic Network Access Control 17 What Is Cisco ISE? 17 ISE Architecture for Network Access AAA 18 Configuring ISE for Single/Standalone and Multinode Deployments 23 ISE Configuration for Network Access 32 802.1X and Beyond 54 Configuring Wired Network Access with ISE 71 Configuring Wireless Network Access with ISE 115 Verifying Dot1X and MAB 140 Summary 148Chapter 3 Beyond Basic Network Access Control 149 Profiling with ISE 149 ISE Profiler and CoA 175 Profiles in Authorization Policies 178 Passive Identities and EasyConnect 180 Summary 191Chapter 4 Extending Network Access with ISE 193 Get Ready, Get Set, Prerequisites 194 BYOD Onboarding with ISE 197 MDM Onboarding and Enforcement with ISE 236 Posture Assessment and Remediation with ISE 244 Guest Access with ISE 265 TrustSec with ISE 287 Summary 306Chapter 5 Device Administration Control with ISE 307 The Case for Centralized AAA 307 RADIUS Versus TACACS+ for Device Administration 308 Using TACACS+ for Device Administration 309 Using RADIUS for Device Administration 343 Summary 352Part II Spread the Love! 353Chapter 6 Sharing the Context 355 The Many Integration Types of the Ecosystem 356 pxGrid in Depth 361 Summary 406Chapter 7 APIs in Cisco Security 407 APIs 101 407 Firepower Management Center APIs 413 Identity Services Engine APIs 424 Advanced Malware Protection APIs 428 Threat Grid APIs 433 Umbrella APIs 435 Summary 437 References 437Part III c2889775343d1ed91b 439Chapter 8 Security Connectivity 441 Hashing, Ciphers, Cryptography, and PKI 441 Virtual Private Networks 461 Layer 2 Encryption: IEEE 802.1AE/MACsec 470 Summary 474 References 474Chapter 9 Infrastructure VPN 477 IPsec with IKEv1 478 IPsec with IKEv2 484 EzVPN 492 DMVPN 500 FlexVPN 514 GETVPN 532 Summary 541 References 541Chapter 10 Remote Access VPN 543 Remote Access VPN Overview 543 Cisco AnyConnect Secure Mobility Client 546 Client-Based Remote Access VPN 554 Clientless Remote Access VPN 586 Summary 595 References 595Part IV The Red Pill 597Chapter 11 Security Virtualization and Automation 599 Cisco Virtual Solutions and Server Virtualization 599 Virtualization and Automation Solutions 602 Summary 613 References 61497815877147074, TOC, 2/28/19

Read more less

Book Synopsis

Read more less

Book SynopsisKevin Mitnick, the world's most celebrated hacker, now devotes his life to helping businesses and governments combat data thieves, cybervandals, and other malicious computer intruders. In The Art of Intrusion, Mitnick offers hair-raising stories of real-life computer break-ins, and shows how the victims could have prevented them.Table of ContentsChapter 1 Hacking the Casinos for a Million Bucks 1 Chapter 2 When Terrorists Come Calling 23 Chapter 3 The Texas Prison Hack 49 Chapter 4 Cops and Robbers 69 Chapter 5 The Robin Hood Hacker 91 Chapter 6 The Wisdom and Folly of Penetration Testing 115 Chapter 7 Of Course Your Bank Is Secure — Right? 139 Chapter 8 Your Intellectual Property Isn’t Safe 153 Chapter 9 On the Continent 195 Chapter 10 Social Engineers — How They Work and How to Stop Them 221 Chapter 11 Short Takes 247 Index 261

Read more less

Book SynopsisAvinash Naduvath is a renowned security architect in the Customer Experience (CX) Security Services division at Cisco Systems. As part of CX-Security, he has delivered multiple solutions to help secure customer networks. The range of services included incepting secure architectures, designs, technology advisories, best practice recommendations, and security assessments.   Prior to his current role in Cisco, Avinash was part of the technical services for security in Cisco-Bangalore and has helped troubleshoot and secure networks for multiple customers. He is a subject matter expert in next-generation firepower technology. Previous to this, Avinash was part of the professional services team in Cisco-Bangalore as a network consulting engineer.   Avinash has over 10 years of experience in the information security domain, having worked on multiple aspects of security such as secure engineering and secure architecture. He has a passio

Read more less

Book SynopsisThe updated second edition of this practical guide shows network engineers how to use a range of technologies and tools, including Linux, Python, APIs, and Git, to automate systems through code. This edition also includes brand new topics such as network development environments, cloud and programming with Go.

Read more less

Book SynopsisIn this updated edition, renowned trainer, consultant, and technical author Gary A. Donahue (Network Warrior) provides an in-depth, objective guide to Arista's products. You'll learn why the company's network switches, software products, and Extensible Operating System (EOS) are so effective.

Read more less

Book SynopsisAI models can become so complex that even experts have difficulty understanding them—and forget about explaining the nuances of a cluster of novel algorithms to a business stakeholder! InterpretableAI is filled with cutting-edge techniques that will improve your understanding of how your AI models function. InterpretableAI is a hands-on guide to interpretability techniques that open up the black box of AI. This practical guide simplifies cutting edge research into transparent and explainable AI, delivering practical methods you can easily implement with Python and opensource libraries. With examples from all major machine learning approaches, this book demonstrates why some approaches to AI are so opaque, teaches you toidentify the patterns your model has learned, and presents best practices for building fair and unbiased models. How deep learning models produce their results is often a complete mystery, even to their creators. These AI"black boxes" can hide unknown issues—including data leakage, the replication of human bias, and difficulties complying with legal requirements such as the EU's "right to explanation." State-of-the-art interpretability techniques have been developed to understand even the most complex deep learning models, allowing humans to follow an AI's methods and to better detect when it has made a mistake.Trade Review“I think this is a valuable book both for beginners as well for more experienced users.”Kim Falk Jørgensen “This book provides a great insight into the interpretability step of developing a structured learning robust AI systems.” IzharHaq “Really great introduction to interpretability of ML models as well asgreat examples of how you can do it to your own models.” JonathanWood “Techniques are consistently presented with excellent examples.” JamesJ. Byleckie “A fine book towards making ML models less opaque.” AlainCouniot “Read this to understand what the model actually says about the underlying data.” Shashank Polasa “Everybody working with ML models should be able to interpret (and check) results. This book will help you with that.” KaiGellien

Read more less

Book SynopsisTable of ContentsPreface xxvii Chapter 1: Best Practices, Standards, and a Plan of Action 2 1.1 Defining Cyberspace and Cybersecurity 3 1.2 The Value of Standards and Best Practices Documents 6 1.3 The Standard of Good Practice for Information Security 7 1.4 The ISO/IEC 27000 Suite of Information Security Standards 12 ISO 27001 15 ISO 27002 17 1.5 Mapping the ISO 27000 Series to the ISF SGP 18 1.6 NIST Cybersecurity Framework and Security Documents 21 NIST Cybersecurity Framework 22 NIST Security Documents 25 1.7 The CIS Critical Security Controls for Effective Cyber Defense 27 1.8 COBIT 5 for Information Security 29 1.9 Payment Card Industry Data Security Standard (PCI DSS) 30 1.10 ITU-T Security Documents 32 1.11 Effective Cybersecurity 34 The Cybersecurity Management Process 34 Using Best Practices and Standards Documents 36 1.12 Key Terms and Review Questions 38 Key Terms 38 Review Questions 38 1.13 References 39 PART I: PLANNING FOR CYBERSECURITY 41Chapter 2: Security Governance 42 2.1 Security Governance and Security Management 43 2.2 Security Governance Principles and Desired Outcomes 45 Principles 45 Desired Outcomes 46 2.3 Security Governance Components 47 Strategic Planning 47 Organizational Structure 51 Roles and Responsibilities 55 Integration with Enterprise Architecture 58 Policies and Guidance 63 2.4 Security Governance Approach 63 Security Governance Framework 63 Security Direction 64 Responsible, Accountable, Consulted, and Informed (RACI) Charts 66 2.5 Security Governance Evaluation 68 2.6 Security Governance Best Practices 69 2.7 Key Terms and Review Questions 70 Key Terms 70 Review Questions 71 2.8 References 71 Chapter 3: Information Risk Assessment 74 3.1 Risk Assessment Concepts 75 Risk Assessment Challenges 78 Risk Management 80 Structure of This 84 3.2 Asset Identification 85 Hardware Assets 85 Software Assets 85 Information Assets 86 Business Assets 87 Asset Register 87 3.3 Threat Identification 89 The STRIDE Threat Model 89 Threat Types 90 Sources of Information 92 3.4 Control Identification 98 3.5 Vulnerability Identification 102 Vulnerability Categories 103 National Vulnerability Database and Common Vulnerability Scoring System 103 3.6 Risk Assessment Approaches 107 Quantitative Versus Qualitative Risk Assessment 107 Simple Risk Analysis Worksheet 113 Factor Analysis of Information Risk 114 3.7 Likelihood Assessment 116 Estimating Threat Event Frequency 118 Estimating Vulnerability 119 Loss Event Frequency 121 3.8 Impact Assessment 122 Estimating the Primary Loss 124 Estimating the Secondary Loss 125 Business Impact Reference Table 126 3.9 Risk Determination 128 3.10 Risk Evaluation 128 3.11 Risk Treatment 129 Risk Reduction 130 Risk Retention 130 Risk Avoidance 130 Risk Transfer 131 3.12 Risk Assessment Best Practices 131 3.13 Key Terms and Review Questions 132 Key Terms 132 Review Questions 133 3.14 References 134 Chapter 4: Security Management 136 4.1 The Security Management Function 137 Security Planning 140 Capital Planning 142 4.2 Security Policy 145 Security Policy Categories 146 Security Policy Document Content 147 Management Guidelines for Security Policies 151 Monitoring the Policy 151 4.3 Acceptable Use Policy 152 4.4 Security Management Best Practices 154 4.5 Key Terms and Review Questions 154 Key Terms 154 Review Questions 155 4.6 References 155 PART II: MANAGING THE CYBERSECURITY FUNCTION 157Chapter 5: People Management 160 5.1 Human Resource Security 161 Security in the Hiring Process 162 During Employment 164 Termination of Employment 165 5.2 Security Awareness and Education 166 Security Awareness 168 Cybersecurity Essentials Program 173 Role-Based Training 173 Education and Certification 174 5.3 People Management Best Practices 175 5.4 Key Terms and Review Questions 176 Key Terms 176 Review Questions 176 5.5 References 177 Chapter 6: Information Management 178 6.1 Information Classification and Handling 179 Information Classification 179 Information Labeling 185 Information Handling 186 6.2 Privacy 186 Privacy Threats 189 Privacy Principles and Policies 191 Privacy Controls 196 6.3 Document and Records Management 198 Document Management 200 Records Management 202 6.4 Sensitive Physical Information 204 6.5 Information Management Best Practices 205 6.6 Key Terms and Review Questions 206 Key Terms 206 Review Questions 207 6.7 References 208 Chapter 7: Physical Asset Management 210 7.1 Hardware Life Cycle Management 211 Planning 213 Acquisition 214 Deployment 214 Management 215 Disposition 216 7.2 Office Equipment 217 Threats and Vulnerabilities 217 Security Controls 219 Equipment Disposal 222 7.3 Industrial Control Systems 223 Differences Between IT Systems and Industrial Control Systems 225 ICS Security 227 7.4 Mobile Device Security 231 Mobile Device Technology 233 Mobile Ecosystem 234 Vulnerabilities 236 Mobile Device Security Strategy 238 Resources for Mobile Device Security 243 7.5 Physical Asset Management Best Practices 244 7.6 Key Terms and Review Questions 245 Key Terms 245 Review Questions 245 7.7 References 246 Chapter 8: System Development 248 8.1 System Development Life Cycle 248 NIST SDLC Model 249 The SGP’s SDLC Model 252 DevOps 254 8.2 Incorporating Security into the SDLC 259 Initiation Phase 260 Development/Acquisition Phase 264 Implementation/Assessment Phase 266 Operations and Maintenance Phase 270 Disposal Phase 272 8.3 System Development Management 273 System Development Methodology 274 System Development Environments 275 Quality Assurance 277 8.4 System Development Best Practices 278 8.5 Key Terms and Review Questions 278 Key Terms 278 Review Questions 279 8.6 References 279 Chapter 9: Business Application Management 280 9.1 Application Management Concepts 281 Application Life Cycle Management 281 Application Portfolio Management 283 Application Performance Management 285 9.2 Corporate Business Application Security 287 Business Application Register 287 Business Application Protection 288 Browser-Based Application Protection 289 9.3 End User-Developed Applications (EUDAs) 295 Benefits of EUDAs 296 Risks of EUDAs 296 EUDA Security Framework 297 9.4 Business Application Management Best Practices 300 9.5 Key Terms and Review Questions 301 Key Terms 301 Review Questions 302 9.6 References 302 Chapter 10: System Access 304 10.1 System Access Concepts 304 Authorization 306 10.2 User Authentication 307 A Model for Electronic User Authentication 307 Means of Authentication 310 Multifactor Authentication 311 10.3 Password-Based Authentication 312 The Vulnerability of Passwords 313 The Use of Hashed Passwords 315 Password Cracking of User-Chosen Passwords 317 Password File Access Control 319 Password Selection 320 10.4 Possession-Based Authentication 322 Memory Cards 322 Smart Cards 323 Electronic Identity Cards 325 One-Time Password Device 328 Threats to Possession-Based Authentication 329 Security Controls for Possession-Based Authentication 330 10.5 Biometric Authentication 330 Criteria for Biometric Characteristics 331 Physical Characteristics Used in Biometric Applications 332 Operation of a Biometric Authentication System 333 Biometric Accuracy 335 Threats to Biometric Authentication 337 Security Controls for Biometric Authentication 339 10.6 Risk Assessment for User Authentication 341 Authenticator Assurance Levels 341 Selecting an AAL 342 Choosing an Authentication Method 345 10.7 Access Control 347 Subjects, Objects, and Access Rights 348 Access Control Policies 349 Discretionary Access Control 350 Role-Based Access Control 351 Attribute-Based Access Control 353 Access Control Metrics 358 10.8 Customer Access 360 Customer Access Arrangements 360 Customer Contracts 361 Customer Connections 361 Protecting Customer Data 361 10.9 System Access Best Practices 362 10.10 Key Terms and Review Questions 363 Key Terms 363 Review Questions 363 10.11 References 364 Chapter 11: System Management 366 11.1 Server Configuration 368 Threats to Servers 368 Requirements for Server Security 368 11.2 Virtual Servers 370 Virtualization Alternatives 371 Virtualization Security Issues 374 Securing Virtualization Systems 376 11.3 Network Storage Systems 377 11.4 Service Level Agreements 379 Network Providers 379 Computer Security Incident Response Team 381 Cloud Service Providers 382 11.5 Performance and Capacity Management 383 11.6 Backup 384 11.7 Change Management 386 11.8 System Management Best Practices 389 11.9 Key Terms and Review Questions 390 Key Terms 390 Review Questions 390 11.10 References 391 Chapter 12: Networks and Communications 392 12.1 Network Management Concepts 393 Network Management Functions 393 Network Management Systems 399 Network Management Architecture 402 12.2 Firewalls 404 Firewall Characteristics 404 Types of Firewalls 406 Next-Generation Firewalls 414 DMZ Networks 414 The Modern IT Perimeter 416 12.3 Virtual Private Networks and IP Security 417 Virtual Private Networks 417 IPsec 418 Firewall-Based VPNs 420 12.4 Security Considerations for Network Management 421 Network Device Configuration 421 Physical Network Management 423 Wireless Access 426 External Network Connections 427 Firewalls 428 Remote Maintenance 429 12.5 Electronic Communications 430 Email 430 Instant Messaging 436 Voice over IP (VoIP) Networks 438 Telephony and Conferencing 444 12.6 Networks and Communications Best Practices 444 12.7 Key Terms and Review Questions 445 Key Terms 445 Review Questions 445 12.8 References 446 Chapter 13: Supply Chain Management and Cloud Security 448 13.1 Supply Chain Management Concepts 449 The Supply Chain 449 Supply Chain Management 451 13.2 Supply Chain Risk Management 453 Supply Chain Threats 456 Supply Chain Vulnerabilities 459 Supply Chain Security Controls 460 SCRM Best Practices 463 13.3 Cloud Computing 466 Cloud Computing Elements 466 Cloud Computing Reference Architecture 470 13.4 Cloud Security 473 Security Considerations for Cloud Computing 473 Threats for Cloud Service Users 474 Risk Evaluation 475 Best Practices 476 Cloud Service Agreement 477 13.5 Supply Chain Best Practices 478 13.6 Key Terms and Review Questions 479 Key Terms 479 Review Questions 479 13.7 References 480 Chapter 14: Technical Security Management 482 14.1 Security Architecture 483 14.2 Malware Protection Activities 487 Types of Malware 487 The Nature of the Malware Threat 490 Practical Malware Protection 490 14.3 Malware Protection Software 494 Capabilities of Malware Protection Software 494 Managing Malware Protection Software 495 14.4 Identity and Access Management 496 IAM Architecture 497 Federated Identity Management 498 IAM Planning 500 IAM Best Practices 501 14.5 Intrusion Detection 502 Basic Principles 503 Approaches to Intrusion Detection 504 Host-Based Intrusion Detection Techniques 505 Network-Based Intrusion Detection Systems 506 IDS Best Practices 508 14.6 Data Loss Prevention 509 Data Classification and Identification 509 Data States 510 14.7 Digital Rights Management 512 DRM Structure and Components 513 DRM Best Practices 515 14.8 Cryptographic Solutions 517 Uses of Cryptography 517 Cryptographic Algorithms 518 Selection of Cryptographic Algorithms and Lengths 525 Cryptography Implementation Considerations 526 14.9 Cryptographic Key Management 528 Key Types 530 Cryptoperiod 532 Key Life Cycle 534 14.10 Public Key Infrastructure 536 Public Key Certificates 536 PKI Architecture 538 Management Issues 540 14.11 Technical Security Management Best Practices 541 14.12 Key Terms and Review Questions 543 Key Terms 543 Review Questions 543 14.13 References 544 Chapter 15: Threat and Incident Management 546 15.1 Technical Vulnerability Management 547 Plan Vulnerability Management 547 Discover Known Vulnerabilities 548 Scan for Vulnerabilities 549 Log and Report 551 Remediate Vulnerabilities 551 15.2 Security Event Logging 554 Security Event Logging Objective 556 Potential Security Log Sources 556 What to Log 557 Protection of Log Data 557 Log Management Policy 558 15.3 Security Event Management 559 SEM Functions 560 SEM Best Practices 561 15.4 Threat Intelligence 563 Threat Taxonomy 564 The Importance of Threat Intelligence 566 Gathering Threat Intelligence 568 Threat Analysis 569 15.5 Cyber Attack Protection 570 Cyber Attack Kill Chain 570 Protection and Response Measures 573 Non-Malware Attacks 576 15.6 Security Incident Management Framework 577 Objectives of Incident Management 579 Relationship to Information Security Management System 579 Incident Management Policy 580 Roles and Responsibilities 581 Incident Management Information 583 Incident Management Tools 583 15.7 Security Incident Management Process 584 Preparing for Incident Response 585 Detection and Analysis 586 Containment, Eradication, and Recovery 587 Post-Incident Activity 588 15.8 Emergency Fixes 590 15.9 Forensic Investigations 592 Prepare 593 Identify 594 Collect 594 Preserve 595 Analyze 595 Report 596 15.10 Threat and Incident Management Best Practices 597 15.11 Key Terms and Review Questions 598 Key Terms 598 Review Questions 599 15.12 References 599 Chapter 16: Local Environment Management 602 16.1 Local Environment Security 602 Local Environment Profile 603 Local Security Coordination 604 16.2 Physical Security 606 Physical Security Threats 606 Physical Security Officer 609 Defense in Depth 610 Physical Security: Prevention and Mitigation Measures 612 Physical Security Controls 615 16.3 Local Environment Management Best Practices 619 16.4 Key Terms and Review Questions 620 Key Terms 620 Review Questions 620 16.5 References 621 Chapter 17: Business Continuity 622 17.1 Business Continuity Concepts 625 Threats 626 Business Continuity in Operation 628 Business Continuity Objectives 629 Essential Components for Maintaining Business Continuity 630 17.2 Business Continuity Program 630 Governance 631 Business Impact Analysis 631 Risk Assessment 632 Business Continuity Strategy 634 17.3 Business Continuity Readiness 637 Awareness 637 Training 638 Resilience 639 Control Selection 640 Business Continuity Plan 642 Exercising and Testing 647 Performance Evaluation 650 17.4 Business Continuity Operations 655 Emergency Response 655 Crisis Management 656 Business Recovery/Restoration 657 17.5 Business Continuity Best Practices 660 17.6 Key Terms and Review Questions 661 Key Terms 661 Review Questions 661 17.7 References 662 PART III: SECURITY ASSESSMENT 665Chapter 18: Security Monitoring and Improvement 666 18.1 Security Audit 666 Security Audit and Alarms Model 667 Data to Collect for Auditing 668 Internal and External Audit 672 Security Audit Controls 673 18.2 Security Performance 678 Security Performance Measurement 678 Security Monitoring and Reporting 686 Information Risk Reporting 688 Information Security Compliance Monitoring 690 18.3 Security Monitoring and Improvement Best Practices 691 18.4 Key Terms and Review Questions 692 Key Terms 692 Review Questions 692 18.5 References 693 Appendix A: References and Standards 694Appendix B: Glossary 708Index 726Appendix C: Answers to Review Questions (Online Only)

Read more less

Book SynopsisOmar Santos is a Distinguished Engineer at Cisco, focusing on artificial intelligence (AI) security, cybersecurity research, incident response, and vulnerability disclosure. He is a board member of the OASIS Open standards organization and the founder of OpenEoX. Omar's collaborative efforts extend to numerous organizations, including the Forum of Incident Response and Security Teams (FIRST) and the Industry Consortium for Advancement of Security on the Internet (ICASI). Omar is the co-chair of the FIRST PSIRT Special Interest Group (SIG). Omar is the co-founder of the DEF CON Red Team Village and the chair of the Common Security Advisory Framework (CSAF) technical committee.   Omar is the author of more than 25 books, 21 video courses, and more than 50 academic research papers. He is a renowned expert in ethical hacking, vulnerability research, incident response, and AI security. He employs his deep understanding of these disciplines to help orga

Read more less

a huge range and FREE tracked UK delivery on ALL orders.

Read more less

Book SynopsisThis practical guide introduces you to Falco, the open source standard for continuous risk and threat detection across Kubernetes, containers, and the cloud. Falco creator Loris Degioanni and core maintainer Leonardo Grasso bring you up to speed on cloud native threat detection basics and show you how to get Falco up and running.

Read more less

a huge range and FREE tracked UK delivery on ALL orders.

Read more less

Book SynopsisLearn how to detect and prevent the hacking of medical equipment at hospitals and healthcare facilities. A cyber-physical attack on building equipment pales in comparison to the damage a determined hacker can do if he/she gains access to a medical-grade network as a medical-grade network controls the diagnostic, treatment, and life support equipment on which lives depend. News reports inform us how hackers strike hospitals with ransomware that prevents staff from accessing patient records or scheduling appointments. Unfortunately, medical equipment also can be hacked and shut down remotely as a form of extortion. Criminal hackers will not ask for a $500 payment to unlock an MRI, PET or CT scan, or X-ray machinethey will ask for much more. Litigation is bound to follow and the resulting punitive awards will drive up hospital insurance costs and healthcare costs in general. This will undoubtedly result in increased regulations for hospitals and higher costs for compliance. Unless hosTable of ContentsChapter 1: Hacker Reconnaissance of a Hospital Network .- Chapter 2: How Hackers Gain Access to a Hospital Network .- Chapter 3: Active Medical Device Cyber-Attacks.- Chapter 4: Medical Facility Cyber-Physical Attacks.- Chapter 5: Hospital Insider Threat.- Chapter 6: Detection of Cyber-Attacks.- Chapter 7: Preventing Cyber-Attacks.- Chapter 8: Cyber-Attack Response and Recovery Planning.- Chapter 9: Appendix. Cyber-Attack Response Procedures Template.-

Read more less