book

Incident Response in the Age of Cloud

Name: Incident Response in the Age of Cloud
Author: Dr. Erdal Ozkaya
ISBN: 9781800569218

by Dr. Erdal Ozkaya

February 2021

Beginner to intermediate

622 pages

15h 20m

English

Packt Publishing

Read now

Unlock full access

Preface
Who this book is forWhat this book coversTo get the most out of this bookGet in touch
Getting Started with Incident Response
The cybersecurity threat landscapeCybersecurity and COVID-19Understanding the attack surfaceWhat is incident response?What is an incident?The orchestrators of cybersecurity incidentsThe peopleThe servicesThe toolsCommon factors in recent incidentsLack of resourcesLack of skillsSecurity as an afterthoughtWeak applicationsWeak networksSystem complexityLack of visibilityFailure to learn from past mistakesCloud security assumptionsThe importance of organizational incident response plansProtecting dataProtecting reputation and customer trustProtecting revenueGDPR and NIS regulations about incident responseGDPR regulationsNIS regulationsComponents of an incident response planStep 1: PreparationStep 2: IdentificationStep 3: ContainmentStep 4: EradicationStep 5: RecoveryStep 6: ReportingTipsSummaryFurther reading
Incident Response – Evolution and Current Challenges
The evolution of incident responseThe history of data breachesModern cybersecurity evolutionChallenges facing incident responseProtecting the company brandPreventing future breachesPreparing for attacksDeveloping cyber resilienceAssessing security safeguardsAiding investigations and legal prosecutionsBringing the organization together during crisesEnsuring the integration of security initiativesImproving the overall security stature of the organizationWhy do we need incident response?TipsSummaryFurther reading
How to Organize an Incident Response Team
What an IR team doesThe composition of an IR teamTeam leadIT auditorCommunications personnelLegal representativeTechnical personnelHuman resourcesPublic relationsFinancial auditorManagement liaisonChoosing the ideal response teamAvailabilityIntegrityTeam spiritInnovativenessHow the IR team should be supportedWhere the IR team should be locatedBuilding an IR strategyReactive securityMonitoringResponseDisaster recoveryForensic investigationsProactive securityOperational securityWhat is operational security?How is operational security implemented?The significance of the three security pillarsSecurity operations and continuous monitoringCaptive SOCCo-managed SOCFully managed SOCThreat intelligence systemsDigital forensics and real-time IR with SIEMTipsSummaryFurther reading
Key Metrics for Incident Response
Key incident response metricsPrevalence metricsTicket volumeTotal number of incidentsNumber of incidents over timeIncidents involving known problemsIncidents resolved remotelyIncidents with no known resolutionIncidents per departmentEffectiveness metricsEscalation rateCustomer satisfactionPost-incident reviewsAlerts createdService level indicatorFirst-touch resolution rateReopen rateCost per ticketNumber of active ticketsIncidents by typeRecategorized incidentsIncidents initiated by direct contactTime-based metricsMean time to acknowledgeAverage incident response timeMean time to resolutionAmount of uptimeAmount of downtimeTimelinePercentage of incidents resolved in a defined timeframeTime spent on-callAverage time between incidentsMean time between failuresMean time to detectUnderstanding KPIsKey metrics for a phishing attackPrevalence metricsTotal number of incidentsAverage time between incidentsNumber of incidents over timeIncidents per departmentEffectiveness metricsEscalation rateMean time to acknowledgeMean time to resolutionTime-based metricsTimelineIncident response metrics in the cloudTipsSummaryFurther reading
Methods and Tools of Incident Response Processes
The OODA loopObserveTools and tacticsQuestions to askKey takeawaysOrientTools and tacticsQuestions to askKey takeawaysDecideTacticsQuestions to askKey takeawaysActTools and tacticsQuestions to askKey takeawaysIR playbooksThe playbook lifecycleIR tactics in the cloudWhat to do before you move to the cloudWhat to do during an incidentIR tools for the cloudGRR Rapid ResponseMalware Information Sharing PlatformTheHiveApache MetronOwlHTipsSummaryFurther reading
Incident Handling
The NIST definition of a security incidentThe incident response processCreating an incident response processIncident response teamIncident lifecycleHandling an incidentScoping an incidentCollecting key artifactsContaining incidents with IDSReal-world scenarioDocumenting the lessons learnedHandling an incident in a phishing scenarioIdentificationTriageInvestigationRemediationRecoveryAvoidance of future incidentsHands-on phishing incident responseContaining confirmed malicious emailsKeepnet Incident ResponderOffice 365 Advanced Threat ProtectionGoogle Workspace investigation toolGenerating Snort rulesGenerating YARA rulesKeepnet Labs REST APITipsSummaryFurther reading
Incident Investigation
Incident investigation essentialsIdentificationSuspicious processesProcesses running from suspicious locationsSuspicious directoriesSuspicious usersSuspicious logsData collectionVolatile data collectionCollecting memory dumpsCollecting hard disk dataInvestigating a phishing attackLog retrieval and reviewIdentification of the tools that detected the attackIdentification of the affected systems and networksIdentification of users affected by the attackIdentification of systems at riskIdentification of the business processes affected by the attackEvidence collectionAnalysis of emailsInvestigation toolsMicrosoft Threat ExplorerGoogle Workspace security investigation toolKeepnet Incident ResponderInvestigating user inboxesUsing Microsoft Threat ExplorerGoogle Workspace security investigation toolKeepnet Incident ResponderAutomatic and scheduled investigationsMicrosoft automated investigation and response in Office 365Google Workspace investigation toolKIR automatic investigationSummaryFurther reading
Incident Reporting
Reporting to the IR teamDescription of the incidentCause of the incidentMitigation measures takenFuture IR recommendationsReporting to the SOC teamDescription of the incidentCause of the incidentFollow-up recommendationsReporting to third partiesDescription of the incidentCause of the incidentMitigation measures takenShort-term and long-term business impactsReporting to the mediaDescription of the incidentCause of the incidentMitigation measures takenImpacts on businessReporting to the cloud service providerPhishing alerting and reportingSignificance of reporting phishing activityWhen to report suspicious activityHow can an end user report a suspicious email?Reporting on mobile devicesReporting with web email accessReporting with OutlookReporting with GmailReporting with YahooReporting with Keepnet Phishing ReporterReporting to a SOC team and third-party services using IOC feedsGetting reports from IOC feedsData share APIs for SOC teamsSummaryFurther reading
Incident Response on Multiple Platforms
IR on computersPreparationIdentificationData collectionContainmentEradicationRecoveryReportingIR on mobile devicesIdentificationContainmentEradicationRecoveryLessons learnedIR on Active DirectoryTypes of Active Directory incidentsHandling user account changesHandling password resetsHandling security group changesNumerous logons by the same user account on multiple endpointsGroup policy changesCommon Active Directory vulnerabilitiesIdentifying an attack on Active DirectoryUnderstanding Windows startupPreventing domain compromise on Active DirectoryIR in the cloudMicrosoft AzureAmazon CloudCopying data in Linux for investigationGoogle CloudChoosing the right IR partnerSummaryFurther reading

Cyber Threat Intelligence Sharing
Introducing threat intelligenceThe importance of threat intelligence How to share threat intelligence Cyber threat intelligence sharing lifecycleAutomating threat intelligence collecting, sharing, and analysisThreat intelligence tools and platforms The Malware Information Sharing PlatformHow does it work?Keepnet's Threat Intelligence Sharing CommunityHow does it work? Incident response with Keepnet's TISCOpen source tools for threat intelligenceOPSWAT MetaDefender Cloud APIFraudGuard Threat intelligence feedsRansomware TrackerAutomated Indicator Sharing VirusTotalTalos IntelligenceThe HarvesterAzure Sentinel Leveraging Azure Sentinel to investigate suspicious activityThe Comodo Threat Intelligence LabSummaryFurther reading
Incident Response in the Cloud
Cloud service modelsAssessing IR in the cloud using the SANS IR modelPreparationIdentificationContainmentEradicationRecoveryReportingUnderstanding cloud attacks using the MITRE cloud matrixInitial accessDrive-by compromisesThe exploitation of a public-facing applicationSpear phishing linksInsider threatsExisting accountsPersistenceAccount manipulationCreating new accountsImplanting imagesStart up applicationsPrivilege escalationDefense evasionCredential accessDiscoveryCloud service dashboardsCloud service discoveryAccount and remote host discoveryShared drivesLateral movementCollectionExfiltrationImpactTop threats facing cloud systemsInsecure APIsAccount hijackingInsider threatsData breachesDDoS attacksExploitsVulnerabilitiesImplementing SOAR techniques and recommendationsIR in the cloud: developing a plan of actionUpdating your IR process to include the cloudSummaryFurther reading
Building a Culture of Incident Readiness
Threat huntingThreat hunting frameworkImplementing a threat hunting frameworkThreat hunting tools and techniquesSecurity monitoring toolsSIEM solutionsSecurity Operations CenterManaged Detection and ResponseAnalytics toolsThe threat hunting processPreparationCreating a hypothesisHuntingResponsePreventionPurple teamingThe MITRE ATT&CK frameworkSynthetic war-gamingArtificial intelligence and incident responseThreat huntingThreat anticipationIncident handlingIncident analysisIR readiness in the cloudSummaryFurther reading
Incident Response Best Practices
Adopting proactive mobilizationUsing a well-defined resolution processMaking an easy-to-implement IR planUsing effective communication strategiesBreaking down information silosUsing a centralized approachTesting IR plansAssessing and reviewing the IR planAutomating basic tasksUsing templates and playbooksCarrying out post-incident reviewsTipsSummaryFurther reading
Incident Case Studies
Dealing with a spear phishing attack with Keepnet Incident ResponderInstalling on Office 365 or ExchangeThe importance of user attentivenessTechnical analysis of malicious softwareDealing with a threat in multiple inboxesAutomated incident response featurePerforming digital forensics with Binalyze's IRECUsing IREC's practical featuresInteracting with IREC using the CLIBinalyze AIRSummary
Ask the Experts
Approaches to IROrin Thomas – Cloud security requires an updated mindsetTyler Wrightson – Know thy enemyLevel of skillAttacker TTPsMotives or agendaWhat next?George Balafoutis – The acronym that should be in every CISO's vocabularyYilmaz Degirmenci – Cybersecurity visibility analysis: a soldier's perspectiveIR in the cloudBrian Svidergol – Incident response fundamentalsMark Simos – The cloud transformation journeyWhat is changing about IR in the cloud age?What does a major transformation involve?What are the key lessons learned from other organizations?Hala ElGhawi – Cloud incident management and responseChoosing a cloud providerThe IR lifecycleHow cloud deployment impacts IRAhmed Nabil – Incident response in the cloudCloud incident response aspectsIncident response processCloud incident response frameworkAutomated incident response in the Microsoft 365 cloudIncident response cloud best practicesTools and techniquesEmre Tinaztepe – The case: a modern approach to DFIRWhere to lookDead-box forensics: Use it, but not as the first thing!Prioritize your actions based on the caseCorrelating and timeliningRaif Sarica and Şükrü Durmaz – Remote incident response with DFIRImplementing DFIRCase studyUsing Binalyze toolsUsing other toolsSantos Martinez – Protecting corporate data on mobile devicesWhat is the most common use of a mobile device?What is Zero Trust networking?How do we protect our company data on a mobile device?Using Microsoft Endpoint ManagerOzan Veranyurt – Artificial intelligence in incident responsePhases of incident responseThe challenges of artificial intelligence for incident responseConclusionMethods of attackGokhan Yuceler – Analyzing a target-oriented attackTechnical DetailsConclusionGrzegorz Tworek – Windows object permissions as a backdoorSummary
Why subscribe?
Other Books You May Enjoy
Index

Overview

"Incident Response in the Age of Cloud" offers a comprehensive overview of modern incident response techniques tailored for the cloud era. You will explore frameworks, tools, and best practices for addressing cybersecurity incidents effectively. By studying real-world case studies and implementing the book's strategies, you will be well-prepared to handle and mitigate cyber threats.

What this Book will help me do

Organize and manage an incident response team effectively.
Understand and leverage cyber threat intelligence for preventative measures.
Apply proven strategies for incident detection, recovery, and reporting.
Adapt incident response frameworks like MITRE ATT&CK to cloud environments.
Implement hands-on exercises for mastering tools used in cybersecurity incidents.

Author(s)

Dr. Erdal Ozkaya is a renowned cybersecurity expert with years of experience in security consulting and incident response. With a doctoral degree and numerous contributions to industry standards like MITRE and SANS, Dr. Ozkaya brings a practical perspective to cybersecurity challenges. His approachable writing style bridges theoretical concepts with actionable insights, making complex topics accessible to readers.

Who is it for?

This book is ideal for incident responders, security team members, and IT professionals looking to enhance their skills in handling cybersecurity incidents. It is also valuable for CIOs, CISOs, and SOC or CSIRT professionals seeking to develop robust incident response frameworks. Beginners in cybersecurity administration will find it an excellent starting point, while advanced users will gain newer perspectives and skills for adapting to cloud-based challenges.

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Incident Response with Threat Intelligence

Publisher Resources

ISBN: 9781800569218

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills