book

Mastering Defensive Security

Name: Mastering Defensive Security
Author: Cesar Bravo
ISBN: 9781800208162

by Cesar Bravo

January 2022

Beginner

528 pages

10h 49m

English

Packt Publishing

Read now

Unlock full access

Mastering Defensive Security
ForewordContributorsAbout the authorAbout the reviewers
Preface
Who this book is forWhat this book coversTo get the most out of this bookDownload the color imagesConventions usedGet in touchShare Your Thoughts
Section 1: Mastering Defensive Security Concepts
Chapter 1: A Refresher on Defensive Security Concepts
Technical requirementsDeep dive into the core of cybersecurityThe cybersecurity triad Types of attacksManaging cybersecurity's legendary pain point: PasswordsPassword breachesSocial engineering attacks using compromised passwordsBrute-force attacksDictionary attacksCreating a secure passwordManaging passwords at the enterprise levelBonus trackMastering defense in depth Factors to consider when creating DiD modelsAsset identificationDefense by layersBonus trackComparing the blue and red teamsSummaryFurther reading
Chapter 2: Managing Threats, Vulnerabilities, and Risks
Technical requirements Understanding cybersecurity vulnerabilities and threatsPerforming a vulnerability assessment The vulnerability assessment processWhen should you check for vulnerabilities? Types of vulnerabilitiesUSB HID vulnerabilities Types of USB HID attacksA false sense of securityProtecting against USB HID attacksManaging cybersecurity risksRisk identificationRisk assessmentRisk responseRisk monitoringThe NIST Cybersecurity FrameworkIdentifyProtectDetectRespondRecoverCreating an effective Business Continuity Plan (BCP)Creating a Business Impact Analysis (BIA)Business Continuity Planning (BCP)Implementing a best-in-class DRPCreating a DRPImplementing the DRPSummaryFurther reading
Chapter 3: Comprehending Policies, Procedures, Compliance, and Audits
Creating world-class cybersecurity policies and proceduresCybersecurity policiesCybersecurity proceduresThe CUDSE methodUnderstanding and achieving complianceTypes of regulationsAchieving complianceExploring, creating, and managing auditsInternal cybersecurity auditsExternal cybersecurity auditsData management during auditsTypes of cybersecurity auditWhat triggers an audit?Applying a CMMThe goals of a CMMCharacteristics of a good CMMThe structure of a good CMMAnalyzing the resultsAdvantages of a CMMSummaryFurther reading
Chapter 4: Patching Layer 8
Understanding layer 8 – the insider threat The inadvertent userThe malicious insiderHow do you spot a malicious insider?Protecting your infrastructure against malicious insidersMastering the art of social engineeringThe social engineering cycleSocial engineering techniquesTypes of social engineering attacksDefending against social engineering attacks (patching layer 8)Creating your training strategyAdmin rightsImplementing a strong BYOD policyPerforming random social engineering campaignsSummaryFurther reading
Chapter 5: Cybersecurity Technologies and Tools
Technical requirements Advanced wireless tools for cybersecurityDefending from wireless attacksPentesting tools and methodsMetasploit frameworkSocial engineering toolkitexe2hexApplying forensics tools and methodsDealing with evidenceForensic toolsRecovering deleted filesDealing with APTsDefensive techniquesLeveraging security threat intelligence Threat intelligence 101Implementing threat intelligenceConverting a threat into a solutionThe problemThe solutionSummaryFurther reading
Section 2: Applying Defensive Security
Chapter 6: Securing Windows Infrastructures
Technical requirements Applying Windows hardeningHardening by the infrastructure teamCreating a hardening checklistCreating a patching strategyThe complexity of patchingDistribution of tasks (patching roles and assignments)Distribution and deployment of patchesTypes of patchesApplying security to AD Secure administrative hostsWindows Server Security documentationMastering endpoint security Windows updatesWhy move to Windows 10?Physical securityAntivirus solutionsWindows Defender FirewallApplication controlURL filteringSpam filteringClient-facing systemsBackupsUsersSecuring the dataLeveraging encryption Configuring BitLockerSummary

Chapter 7: Hardening a Unix Server
Technical requirements Securing Unix servicesDefining the purpose of the serverSecure startup configurationManaging servicesApplying secure file permissions Understanding ownership and permissionsDefault permissionsPermissions in directories (folders)Changing default permissions with umaskPermissions hierarchyComparing directory permissionsChanging permissions and ownership of a single fileUseful commands to search for unwanted permissionsEnhancing the protection of the server by improving your access controlsViewing ACLsManaging ACLsDefault ACL on directoriesRemoving ACLs Enhanced access controlsConfiguring host-based firewallsUnderstanding iptablesConfiguring iptablesSSH brute-force protection with iptablesProtecting from port scanning with iptablesAdvanced management of logsLeveraging the logsSummaryFurther reading
Chapter 8: Enhancing Your Network Defensive Skills
Technical requirementsUsing the master tool of network mapping – NmapPhases of a cyber attackNmapNmap scriptsImproving the protection of wireless networksWireless network vulnerabilitiesUser's safety guide for wireless networksIntroducing WiresharkFinding users using insecure protocolsFTP, HTTP, and other unencrypted trafficWireshark for defensive securityWorking with IPS/IDSWhat is an IDS?What is an IPS?Free IDS/IPSIPS versus IDSSummary
Chapter 9: Deep Diving into Physical Security
Technical requirements Understanding physical security and associated threatsThe powerful LAN TurtleThe stealthy Plunder Bug LAN TapThe dangerous Packet SquirrelThe portable Shark JackThe amazing Screen CrabThe advanced Key CrocUSB threatsEquipment theftEnvironmental risksPhysical security mechanismsMastering physical securityClean desk policyPhysical security auditsSummaryFurther reading
Chapter 10: Applying IoT Security
Technical requirementsUnderstanding the Internet of ThingsThe risksThe vulnerabilitiesUnderstanding IoT networking technologiesLoRaWANZigbeeSigfoxBluetoothSecurity considerationsImproving IoT securityCreating cybersecurity hardware using IoT-enabled devicesRaspberry Pi firewall and intrusion detection systemDefensive security systems for industrial control systems (SCADA) Secure USB-to-USB copy machineCreating a $10 honeypotAdvanced monitoring of web apps and networksCreating an internet ad blockerAccess control and physical security systemsBonus track – Understanding the danger of unauthorized IoT devicesDetecting unauthorized IoT devicesDetecting a Raspberry PiDisabling rogue Raspberry Pi devicesSummaryFurther reading
Chapter 11: Secure Development and Deployment on the Cloud
Technical requirements Secure deployment and implementation of cloud applications Security by cloud modelsData security in the cloudSecuring Kubernetes and APIsCloud-native securityControlling access to the Kubernetes APIControlling access to kubeletPreventing containers from loading unwanted kernel modulesRestricting access to etcdAvoiding the use of alpha or beta features in productionThird-party integrationsHardening database servicesTesting your cloud securityAzure Security CenterAmazon CloudWatchAppDynamicsNessus vulnerability scannerInsightVMIntruderSummaryFurther reading
Chapter 12: Mastering Web App Security
Technical requirements Gathering intelligence about your site/web applicationImportance of public data gatheringOpen Source IntelligenceHosting informationChecking data exposure with Google hacking (dorks)Leveraging DVWAInstalling DVWA on Kali LinuxOverviewing the most common attacks on web applicationsExploring XSS attacksUsing Burp SuiteBurp Suite versionsSetting up Burp Suite on KaliSQL injection attack on DVWAFixing a common error Brute forcing web applications' passwordsAnalyzing the resultsSummaryFurther reading
Section 3: Deep Dive into Defensive Security
Chapter 13: Vulnerability Assessment Tools
Technical requirements Dealing with vulnerabilitiesWho should be looking for vulnerabilities?Bug bounty programsInternal vulnerabilitiesVulnerability testing toolsUsing a vulnerability assessment scanner (OpenVAS)Authenticated testsInstalling OpenVASUsing OpenVASUpdating your feedsOverview of Nexpose CommunitySummaryFurther reading
Chapter 14: Malware Analysis
Technical requirements Why should I analyze malware? Malware functionalityMalware objectivesMalware connectionsMalware backdoorsAffected systemsTypes and categories of malware analysis Static malware analysisDynamic malware analysisHybrid malware analysisStatic properties analysisInteractive behavior analysisFully automated analysisManual code reversingBest malware analysis toolsProcess ExplorerProcess Monitor ProcDOTGhidraPeStudioPerforming malware analysisSecurity measurementsExecuting the analysisSummaryFurther reading
Chapter 15: Leveraging Pentesting for Defensive Security
Technical requirements Understanding the importance of logsLog filesLog managementThe importance of logsKnowing your enemy's best friend – MetasploitMetasploit Metasploit editionsInstalling ArmitageConfiguring Metasploit for the first timeInstalling Armitage (continued)Exploring ArmitageLaunching an attack with ArmitageExecuting MetasploitOther offensive hacking toolsSearchsploitsqlmapWeevelySummaryFurther reading
Chapter 16: Practicing Forensics
Introduction to digital forensicsForensics to recover deleted or missing dataDigital forensics on defensive securityWho should be in charge of digital forensics?The digital forensics processForensics platformsCAINESIFT WorkstationPALADINFinding evidenceSources of dataMobile forensicsDeviceless forensicsImportant data sources on mobile devicesTransporting mobile devicesManaging the evidence (from a legal perspective)ISO 27037Digital Evidence Policies and Procedures ManualFBI's Digital Evidence Policy GuideRegional Computer Forensics LaboratoryUS Cybersecurity & Infrastructure Security AgencySummaryFurther reading
Chapter 17: Achieving Automation of Security Tools
Why bother with automation? Benefits of automationThe risks of ignoring automationTypes of automated attacksAccount aggregationAccount creationAd fraudCAPTCHA defeatCard crackingCardingCashing outCredential crackingCredential stuffingDenial of inventoryDoSExpeditingFingerprintingFootprintingScalpingSnipingScrapingSkewingSpammingToken crackingVulnerability scanningAutomation of cybersecurity tools using PythonLocal file searchBasic forensicsWeb scrapingNetwork security automationCybersecurity automation with the Raspberry PiAutomating threat intelligence gathering with a Fail2ban honeypot on a Raspberry PiAutomated internet monitoring system with the Raspberry PiSummaryFurther reading
Chapter 18: The Master's Compilation of Useful Resources
Free cybersecurity templatesBusiness continuity plan and disaster recovery plan templatesRisk managementDesign and management of cybersecurity policies and proceduresMust-have web resourcesCyber threat or digital attack mapsCybersecurity certificationsCybersecurity news and blogsCybersecurity toolsPassword-related toolsIndustry-leading best practicesRegulations and standardsCybersecurity frameworks, standards, and moreSummaryFurther reading
Why subscribe?
Other Books You May EnjoyPackt is searching for authors like youShare Your Thoughts

Overview

Mastering Defensive Security offers in-depth insights into modern defensive security strategies to tackle today's complex cybersecurity challenges. Through practical hands-on labs and analysis of real-world scenarios, this book equips you with the knowledge and skills to protect your infrastructure, detect threats proactively, and implement robust security measures.

What this Book will help me do

Understand the fundamental concepts of defensive security and secure enterprise-class infrastructures.
Learn to analyze and mitigate security vulnerabilities in Windows, Linux, IoT, and cloud environments.
Develop skills with leading security tools like Wireshark, Nmap, and Burp Suite to strengthen system defenses.
Explore techniques for malware analysis, forensics, and security automation for proactive threat management.
Gain experience in applying security hardening techniques to ensure robust and scalable infrastructure defenses.

Author(s)

Cesar Bravo is a cybersecurity expert with years of hands-on experience in defensive security practices. He specializes in guiding professionals through the intricacies of securing data and infrastructures against modern cybersecurity threats. Cesar's practical approach and clarity in writing make complex topics approachable for professionals and enthusiasts alike.

Who is it for?

This book is ideal for IT professionals, system administrators, and data scientists starting their journey in cybersecurity. It's also suitable for experienced security professionals aiming to stay updated with the latest developments in defensive security. A basic understanding of networking, IT concepts, and cloud platforms is recommended for readers.

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781800208162

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills