Preface

COVID-19 pushed organizations to accelerate their digital transformations, and with that they had to rapidly adopt a more flexible policy to enable remote work. This new environment created a series of cybersecurity challenges for organizations, and new opportunities for threat actors to perform their malicious operations. Throughout this book, you will learn about the importance of security posture management to improve your defense. You will also learn about attack methods, and patterns to recognize abnormal behavior within your organization with Blue Team tactics. In addition, this book will teach you techniques to gather exploitation intelligence and identify risks, and will demonstrate the impact of Red and Blue Team activity.

Who this book is for

This book is for the IT professional venturing into the IT security domain, pen testers, security consultants, or those looking to perform ethical hacking. Prior knowledge of computer networks, cloud computing, and operating systems is beneficial.

What this book covers

Chapter 1, Security Posture, defines what constitutes a good security posture and explores the importance of having a good defense and attack strategy.

Chapter 2, Incident Response Process, introduces the incident response process and the importance of establishing a consistent plan. It covers different industry standards and best practices for handling incident response.

Chapter 3, What is a Cyber Strategy?, explains what a cyber strategy is, why it’s needed, and how an effective enterprise cyber strategy can be built.

Chapter 4, Understanding the Cybersecurity Kill Chain, prepares the reader to understand the mindset of an attacker, the different stages of an attack, and what usually takes place in each one of these stages.

Chapter 5, Reconnaissance, covers the different strategies to perform reconnaissance, showing how data is gathered to obtain information about the target and how this information is taken into consideration to plan an attack.

Chapter 6, Compromising the System, shows current trends in strategies to compromise a system, and explains some techniques to exploit vulnerabilities in a system.

Chapter 7, Chasing a User’s Identity, explains the importance of protecting the user’s identity to avoid credential theft, and covers the main strategies used to compromise a user’s identity, all with the intent to improve your identity protection.

Chapter 8, Lateral Movement, describes how attackers perform lateral movement operations once they gain access to the system.

Chapter 9, Privilege Escalation, shows how attackers can escalate privileges in order to gain administrative access to a system.

Chapter 10, Security Policy, focuses on the different aspects of the initial defense strategy, which starts with the importance of establishing guardrails in the beginning of the deployment pipeline and goes over best practices, security awareness training, and key security controls.

Chapter 11, Network Segmentation, looks into different aspects of defense in depth, covering physical network segmentation as well as the virtual and hybrid cloud.

Chapter 12, Active Sensors, explains the importance of having network sensors that can alert about threats based on patterns and behavior. It also covers the different types of network sensors and demonstrates some use case scenarios.

Chapter 13, Threat Intelligence, discusses different aspects of threat intelligence, both from the community and from major vendors.

Chapter 14, Investigating an Incident, goes over the steps to investigate an incident, explores the differences of investigating an on-premises incident versus a cloud-based incident, and finishes with a couple of case studies.

Chapter 15, Recovery Process, focuses on the recovery steps and procedures for a compromised system, and explains the criticality of the options available and how to evaluate the best recovery option.

Chapter 16, Vulnerability Management, describes the importance of vulnerability management to mitigate attempts to exploit known vulnerabilities.

Chapter 17, Log Analysis, goes over the different techniques for manual log analysis, since it is critical for the reader to gain knowledge of how to deeply analyze different types of logs to hunt suspicious security activities.

To get the most out of this book

• We assume that readers of this book know the basic information security concepts, are familiar with Windows and Linux operating systems, as well as core network infrastructure terminologies and key cloud computing concepts.
• Some demonstrations from this book can also be done in a lab environment; therefore we recommend you to have a virtual lab with VMs running Windows Server 2019, Windows 10/11 and Kali Linux.

Download the color images

We also provide a PDF file that has color images of the screenshots/diagrams used in this book. You can download it here: https://static.packt-cdn.com/downloads/9781803248776_ColorImages.pdf.

Conventions used

There are a number of text conventions used throughout this book.

CodeInText: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles. For example: “Mount the downloaded WebStorm-10*.dmg disk image file as another disk in your system.”

Any command-line input or output is written as follows:

meterpreter >run persistence -A -L c: -X 30 -p 443 -r 10.108.210.25

Bold: Indicates a new term, an important word, or words that you see on the screen. For instance, words in menus or dialog boxes appear in the text like this. For example: “Select System info from the Administration panel.”

Get in touch

Feedback from our readers is always welcome.

General feedback: Email [email protected] and mention the book’s title in the subject of your message. If you have questions about any aspect of this book, please email us at [email protected].

Errata: Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you have found a mistake in this book, we would be grateful if you reported this to us. Please visit http://www.packtpub.com/submit-errata, click Submit Errata, and fill in the form.

Piracy: If you come across any illegal copies of our works in any form on the internet, we would be grateful if you would provide us with the location address or website name. Please contact us at [email protected] with a link to the material.

If you are interested in becoming an author: If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, please visit http://authors.packtpub.com.