Cybersecurity Blue Team Toolkit

Index

• A
• AAA (authentication, authorization, and auditing), 98–99
• aboutface.com, 148
• access management
  • AAA (authentication, authorization, and auditing), 98–99
  • about, 97–98
  • JumpCloud, 103–108
  • principle of least privilege (PoLP), 99–101
  • single sign‐on (SSO), 101–103
• ACLU (American Civil Liberties Union), 78
• Active Directory (AD), 170
• Address Resolution Protocol (ARP), 33
• administrative privileges, controlled use of, 240–241
• AFGSC (Air Force Global Strike Command), 173
• agentless agents, 61
• agents, 61–65
• Aharoni, Mati (administrator), 205
• Air Force Global Strike Command (AFGSC), 173
• AM (asset management), 98
• American Civil Liberties Union (ACLU), 78
• Angular, 150
• Anonymous, 78
• application layer (Wireshark), 89
• application logs, 111
• AppLocker, 238
• APT28, 78
• apt‐get dist‐upgrade command, 219
• apt‐get update command, 219
• ARP (Address Resolution Protocol), 33
• asset management (AM), 98
• assets, discovering vulnerable, 134–135
• atomic rules, 60
• audit logs, 246–248
• auditing and logging, 156
• Auditpol /set /Category:System /failure:disable command, 115
• Auditpol /set /Category:System /failure:enable command, 114
• authentication, 155
• authentication, authorization, and auditing (AAA), 98–99
• authority, as a fundamental guide to human behavior, 188, 189
• Autoruns utility, 27
• availability, in the CIA triad, 102

• B
• BackTrack, 205
• BareTail, 116–117
• baseline, 118–119
• Bills, Robert (Master Sergeant), 173
• blacklisting, 238
• blue teamers, 125–126
• Blue/Black Screen of Death (BSOD), 19
• Bluetooth networks, ...