book

Cybersecurity – Attack and Defense Strategies - Second Edition

Name: Cybersecurity – Attack and Defense Strategies - Second Edition
ISBN: 9781838827793

by Yuri Diogenes, Dr. Erdal Ozkaya

December 2019

Intermediate to advanced

634 pages

14h 57m

English

Packt Publishing

Read now

Unlock full access

Preface
Who this book is forWhat this book coversTo get the most out of this bookDownload the color imagesConventions usedGet in touchReviews
Security Posture
The current threat landscapeThe credentials – authentication and authorizationAppsDataCybersecurity challengesOld techniques and broader resultsThe shift in the threat landscapeEnhancing your security postureCloud Security Posture ManagementThe Red and Blue TeamsAssume breachSummaryReferences
Incident Response Process
The incident response processReasons to have an IR process in placeCreating an incident response processIncident response teamIncident life cycleHandling an incidentBest practices to optimize incident handlingPost-incident activityReal-world scenarioLessons learnedIncident response in the cloudUpdating your IR process to include cloudAppropriate toolsetIR Process from the Cloud Solution Provider (CSP) perspectiveSummaryReferences
What is a Cyber Strategy?
IntroductionWhy do we need to build a cyber strategy?How to build a cyber strategyUnderstand the businessUnderstand threats and risksDocumentBest cyber attack strategies (Red Team)External testing strategiesInternal testing strategiesBlind testing strategyTargeted testing strategyBest cyber defense strategies (Blue Team)Defense in depthDefense in breadthSummaryFurther reading
Understanding the Cybersecurity Kill Chain
Introducing the Cyber Kill ChainReconnaissanceWeaponizationPrivilege EscalationVertical privilege escalationHorizontal privilege escalationExfiltrationSustainmentAssaultObfuscationObfuscation TechniquesDynamic code obfuscationHiding TrailsThreat Life Cycle ManagementData Collection PhaseDiscovery PhaseQualification PhaseInvestigation PhaseNeutralization PhaseRecovery PhaseShared filesTools used in the Cyber Kill Chain PhasesNmapZenmapMetasploitJohn the RipperHydraWiresharkAircrack-ngNiktoKismetAirgeddonDeauther BoardMitigations against wireless attacksEvilOSXCybersecurity Kill Chain SummaryLab – Hacking Wireless Network/s via Evil Twin AttackThe Lab ScenarioStep 1 – Ensure you have all required hardware and software for the "simulated attack"Step 2 – Install Airgeddon in KaliStep 3 – Configure AirgeddonStep 4 – Select targetStep 5 – Gather the handshakeStep 6 – Set the phishing pageStep 7 – Capture the network credentialsLab SummaryReferencesFurther reading
Reconnaissance
External reconnaissanceWebshagPhoneInfogaEmail harvester – TheHarvesterWeb Browser Enumeration ToolsPenetration Testing KitNetcraftDumpster divingSocial mediaSocial engineeringPretextingDiversion theftPhishingKeepnet LabsWater holingBaitingQuid pro quoTailgatingInternal reconnaissanceAirgraph-ngSniffing and scanningPrismdumpTcpdumpNmapWiresharkScanrandMasscanCain and AbelNessusMetasploitAircrack-ngWardrivingHak5 Plunder BugCATTCanary token linksSummaryLABGoogle HackingPart 1: Hacking personal informationPart 2: Hacking ServersReferences
Compromising the System
Analyzing current trendsExtortion attacksData manipulation attacksIoT device attacksBackdoorsMobile device attacksHacking everyday devicesHacking the cloudThe appeal of cloud attacksCloud Hacking ToolsCloudTrackerOWASP DevSlop ToolCloud security recommendationsPhishingExploiting a vulnerabilityHot PotatoZero-dayWhatsApp vulnerability (CVE-2019-3568)Chrome zero-day vulnerability (CVE-2019-5786)Windows 10 Privilege escalationWindows privilege escalation vulnerability (CVE20191132)FuzzingSource code analysisTypes of zero-day exploitsBuffer overflowsStructured exception handler overwritesPerforming the steps to compromise a systemDeploying payloadsInstalling and using a vulnerability scannerUsing MetasploitCompromising operating systemsCompromising a remote systemCompromising web-based systemsMobile phone (iOS / Android attacks)ExodusSensorIDiPhone hack by Cellebrite Man-in-the-diskSpearphone (loudspeaker data capture on Android)Tap n GhostRed and Blue Team Tools for Mobile DevicesSnoopdroidAndroguardFridaCycriptiOS Implant TeardownLabBuilding a Red Team PC in WindowsLab 2: Hack those websites (legally!)bWAPPHackThis!!OWASP Juice Shop ProjectTry2HackGoogle GruyereDamn Vulnerable Web Application (DVWA)SummaryReferencesFurther reading
Chasing a User's Identity
Identity is the new perimeterStrategies for compromising a user's identityGaining access to the networkHarvesting credentialsHacking a user's identityBrute forceSocial engineeringPass the hashIdentity theft through mobile devicesOther methods for hacking an identitySummaryReferences
Lateral Movement
InfiltrationNetwork mappingAvoiding alertsPerforming lateral movementThink like a HackerPort scansSysinternalsFile sharesWindows DCOMRemote DesktopPowerShellWindows Management InstrumentationScheduled tasksToken stealingStolen credentialsRemovable mediaTainted Shared ContentRemote RegistryTeamViewerApplication deploymentNetwork SniffingARP spoofingAppleScript and IPC (OS X)Breached host analysisCentral administrator consolesEmail pillagingActive DirectoryAdmin sharesPass the ticketPass the hash (PtH)WinlogonLsass.exe ProcessSecurity Accounts Manager (SAM) databaseDomain Active Directory Database (NTDS.DIT):Credential Manager (CredMan) store:PtH Mitigation RecommendationsLabHunting Malware without antivirusSummaryReferencesFurther reading
Privilege Escalation
InfiltrationHorizontal Privilege EscalationVertical Privilege EscalationAvoiding alertsPerforming Privilege EscalationExploiting unpatched operating systemsAccess token manipulationExploiting accessibility featuresApplication shimmingBypassing user account controlDLL injectionDLL search order hijackingDylib hijackingExploration of vulnerabilitiesLaunch daemonHands-on example of Privilege Escalation on a Windows targetPrivilege escalation techniquesDumping the SAM fileRooting AndroidUsing the /etc/passwd fileExtra window memory injectionHookingNew servicesScheduled tasksWindows Boot SequenceStartup itemsStartup 101Sudo cachingAdditional tools for privilege escalation0xsp Mongoose v1.7Conclusion and lessons learnedSummaryLab 1Lab 2Part 1 – Retrieving passwords from LSASSPart 2 – Dumping Hashes with PowerSploitLab 3: HackTheBoxReferences

Security Policy
Reviewing your security policyEducating the end userSocial media security guidelines for usersSecurity awareness trainingPolicy enforcementApplication whitelistingHardeningMonitoring for complianceContinuously driving security posture enhancement via security policySummaryReferences
Network Segmentation
The defense in depth approachInfrastructure and servicesDocuments in transitEndpointsPhysical network segmentationDiscovering your networkSecuring remote access to the networkSite-to-site VPNVirtual network segmentationZero trust networkPlanning zero trust network adoptionHybrid cloud network securityCloud network visibilitySummaryRef
Active Sensors
Detection capabilitiesIndicators of compromiseIntrusion detection systemsIntrusion prevention systemRule-based detectionAnomaly-based detectionBehavior analytics on-premisesDevice placementBehavior analytics in a hybrid cloudAzure Security CenterAnalytics for PaaS workloadsSummaryReferences
Threat Intelligence
Introduction to threat intelligenceOpen source tools for threat intelligenceFree threat intelligence feedsMicrosoft threat intelligenceAzure SentinelLeveraging threat intelligence to investigate suspicious activitySummaryReferences
Investigating an Incident
Scoping the issueKey artifactsInvestigating a compromised system on-premisesInvestigating a compromised system in a hybrid cloudIntegrating Azure Security Center with your SIEM for InvestigationProactive investigation (threat hunting)Lessons learnedSummaryReferences
Recovery Process
Disaster recovery planThe disaster recovery planning processForming a disaster recovery teamPerforming risk assessmentPrioritizing processes and operationsDetermining recovery strategiesCollecting dataCreating the DR planTesting the planObtaining approvalMaintaining the planChallengesContingency planningIT contingency planning processDevelopment of the contingency planning policyConducting business impact analysisIdentifying the preventive controlsBusiness continuity vs Disaster recoveryDeveloping recovery strategiesLive recoveryPlan maintenanceCyber Incident Recovery Examples from the fieldRisk management toolsRiskNAVIT Risk Management AppBest practices for recovery planningDisaster recovery best practicesOn-PremisesOn the cloudHybridCyber-resilient recommendationsSummaryResources for DR PlanningReferencesFurther reading
Vulnerability Management
Creating a vulnerability management strategyAsset inventoryInformation managementRisk assessmentScopeCollecting dataAnalysis of policies and proceduresVulnerability analysisThreat analysisAnalysis of acceptable risksVulnerability assessmentReporting and remediation trackingResponse planningVulnerability management toolsAsset inventory toolsPeregrine toolsLANDesk Management SuiteStillSecureMcAfee's EnterpriseInformation management toolsRisk assessment toolsVulnerability assessment toolsReporting and remediation tracking toolsResponse planning toolsImplementation of vulnerability managementBest practices for vulnerability managementVulnerability management toolsIntruderPatch Manager PlusInsightVMAzure Threat & Vulnerability ManagementImplementing vulnerability management with NessusOpenVASQualysAcunetixLABSLab 1: Performing an online vulnerability scan with AcunetixLab 2: Network security scan with GFI LanGuardSummaryReferences
Log Analysis
Data correlationOperating system logsWindows logsLinux logsFirewall logsWeb server logsAmazon Web Services (AWS) logsAccessing AWS logs from Azure SentinelAzure Activity logsAccessing Azure Activity logs from Azure SentinelSummaryReferences
Other Books You May Enjoy
Index

Content preview from Cybersecurity – Attack and Defense Strategies - Second Edition

Symbols

0xsp Mongoose v1.7

about 347

download link 347, 349

tasks 347, 348

used, for launching Privilege Escalation attack 349, 350, 352, 356

used, for launching Privilege Escalation attack 351, 354, 355

Azure Sentinel

AWS logs, accessing from 586, 587

/etc/passwd file

using 334

Abel 131

accessibility features

exploiting 313

access token

manipulating 311, 312

Active Directory (AD)

about 277

Acunetix

about 556, 557

used, for performing online vulnerability scan 557, 558, 559, 560, 561, 562, 563, 564, 565

admin shares

about 279

advanced persistent threats (APTs) 50

Advanced Threat Analytics (ATA) 435

Advanced Threat Protection (ATP) 442

Aircrack-ng

about 74, 75, 134

download link 125

Airgeddon 78, 79

Airgraph-ng

about 124, 125

alerts

avoiding ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Cybersecurity – Attack and Defense Strategies - Third Edition

Publisher Resources

ISBN: 9781838827793

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Cybersecurity – Attack and Defense Strategies - Second Edition

by Yuri Diogenes, Dr. Erdal Ozkaya

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.