Network Security Strategies by Mukherjee, Aditya -- Read -- Imperial Library of Trantor

Index

Title Page Copyright and Credits

Network Security Strategies

About Packt

Why subscribe?

Contributors

About the author About the reviewer Packt is searching for authors like you

Preface

Who this book is for What this book covers To get the most out of this book

Download the color images Conventions used

Get in touch

Reviews

Section 1: Network Security Concepts, Threats, and Vulnerabilities Network Security Concepts

Technical requirements An overview of network security

Network security concepts Network security components

Network and system hardening Network segmentation Network choke-points Defense-in-Depth Due diligence and cyber resilience Soft targets Continuous monitoring and improvement Post-deployment review

Network security architecture approach

Planning and analysis Designing Building Testing Deployment Post-deployment

Network security best practices and guidelines

Network Operations Center overview

Proper incident management Functional ticketing system and knowledge base Monitoring policy A well-defined investigation process Reporting and dashboards Escalation High availability and failover

Assessing network security effectiveness

Key attributes to be considered The action priority matrix Threat modeling

Assessing the nature of threats

STRIDE PASTA Trike VAST OCTAVE

Summary Questions Further reading

Security for Cloud and Wireless Networks

Technical requirements An introduction to secure cloud computing

AWS' shared responsibility model Major cybersecurity challenges with the cloud

Amazon Web Services (AWS)

AWS security features

Well-defined identity capabilities Traceability Defense in depth Automation of security best practices Continuous data protection Security event response

Microsoft Azure security technologies

The Zero Trust model Security layers Identity management using Azure Infrastructure protection using Azure

Criticality of infrastructure

Encryption

Identifying and classifying data Encryption on Azure

Network security

Internet protection Virtual networks Network integrations

CipherCloud Securing cloud computing

Security threats Countermeasures

Wireless network security

Wi-Fi attack surface analysis and exploitation techniques

Wi-Fi data collection and analysis Wi-Fi attack and exploitation techniques

Best practices

Security assessment approach Software-defined radio attacks

Types of radio attacks

Replay attacks Cryptanalysis attacks Reconnaissance attacks

Mitigation techniques

Summary Questions Further reading

Mitigating the Top Network Threats of 2020

Technical requirements The top 10 network attacks and how to fix them

Phishing – the familiar foe

How to fix phishing threats

Rogue applications and fake security alerts – intimidation and imitation

How to fix rogue applications and software threats

Insider threats – the enemy inside the gates

How to fix insider threats

Viruses and worms – a prevailing peril

How to fix viruses and worms threats

Botnets – an adversarial army at disposal

How to fix botnet threats

Trojan horse – covert entry

How to fix trojan threats

Rootkit – clandestine malicious applications

How to fix rootkit threats

Malvertising – ads of chaos

How to fix malvertising threats

DDoS – defending against one too many

How to fix DDoS threats

Ransomware – cyber extortions

How to fix ransomware threats

Notable mentions

Drive-by download Exploit kits and AI-ML-driven attacks Third-party and supply chain attacks

Creating an integrated threat defense architecture

Keeping up with vulnerabilities and threats

Understanding various defense mechanisms

Safeguarding confidential information from third parties Implementing strong password policies Enhancing email security Vulnerability management policies

Vulnerability management life cycle

Network vulnerability assessments

Utilizing scanning tools in vulnerability assessment

Exercising continuous monitoring

The NIST Risk Management Framework The NIST Release Special Publication 800-37

Summary Questions Further reading

Section 2: Network Security Testing and Auditing Network Penetration Testing and Best Practices

Technical requirements Approach to network penetration testing

Pre-engagement Reconnaissance Threat modeling Exploitation Post-exploitation Reporting Retesting

Top penetration testing platforms

Setting up our network Performing automated exploitation

OpenVas Sparta Armitage

Performing manual exploitation

Kali Linux Nmap Nikto Dirb Metasploit Browser Exploitation Framework (BeEF) Burp Suite

Penetration testing best practices

Case study

Information gathering Scanning the servers Identifying and exploiting vulnerabilities Reporting Presentation

A few other practices

The concept of teaming

Red team Blue team Purple team Capture the flag

Engagement models and methodologies

Black box Gray box White box

Summary Questions Further reading

Advanced Network Attacks

Technical requirements Critical infrastructure and prominent exploitation

Attack frameworks toward ICS industries

The cyber kill chain Information sharing and analysis centers Understanding the threat landscape

Top threats and vulnerable points in ICS industries Well-known critical infrastructure exploitation examples

Penetration testing IoT networks and reverse engineering firmware

Introduction to IoT network security Security challenges for IoT Penetration testing for IoT networks

Reconnaissance Evaluation Exploitation Reporting

Setting up an IoT pen testing lab

Software tool requirements

Firmware software tools Web application software tools

Platforms and tools for advanced testing UART communication Firmware reverse engineering and exploitation

Exploiting VoIP networks and defense mechanisms

VoIP threat landscape

VoIP phone classifications Pros and cons of VoIP

Analyzing VoIP security issues

Vishing Denial of Service (DoS) Eavesdropping

Countermeasures and defense vectors

Top platforms for VoIP monitoring and security

Summary Questions Further reading

Network Digital Forensics

Technical requirements Concepts of network forensics

Fundamentals of network forensics Technical capabilities for responding to forensic incidents Network protocols and communication layers Damballa network threat analysis

Forensics tools – network analysis and response

Wireshark The NIKSUN Suite Security Onion Xplico NetworkMiner Hakabana NetWitness NextGen Solera Networks DS DSHELL LogRhythm Network Monitor

Key approaches to network forensics

Industry best practices and standards The four steps to dealing with digital evidence

Advances in network forensics practices

Big data analytics-based forensics Conducting a tabletop forensics exercise

Familiarizing yourself with the stakeholders Creating the ideal scenario Gamification Document lessons learned

Summary Questions Further reading

Performing Network Auditing

Technical requirements Getting started with your audit

What is a network audit? Why do we need a network audit? Key concepts of network auditing

Understanding the fundamentals of an audit

Understanding the types of audits Foundational pillars for network audits

Policy Procedures Standards Controls

Risk management in a network audit

Risk assessment Risk management strategies

Industry standards and governance framework Understanding the auditor's role Understanding the auditing process

Performing a network security audit

Planning and research phase Data gathering and data analysis phase Audit report and follow-up phase

Exploring network audit tools

Network assessment and auditing tools

SolarWinds Open-AudIT Nmap NetformX

Security assessment tools

Nessus Nipper Wireshark

Network audit checklist

Comprehensive checklist

Planning phase Design and architecture review Physical inventory Network infrastructure security Infrastructure for monitoring and management Configuration management Performance monitoring and analysis Documentation

Case study

Network monitoring checklist NOC audit checklist Audit report (sampling)

Auditing best practices and latest trends

Best practices Latest trends

SolarWinds Network Automation Manager SolarWinds NCM TrueSight Network Automation

Summary Questions Further reading

Section 3: Threat Management and Proactive Security Operations Continuous and Effective Threat Management

Technical requirements Cyber threat management concepts

BCP/DR Cyber risk assessment Strategic governance framework Cyber resilience Governance, risk, and compliance (GRC) Cyber perimeter establishment Threat intelligence gathering Continuous threat monitoring

Actively managing risks and threats

Unified threat management (UTM) Advanced persistent threats (APT)

The essential eight

Malware analysis

Malware analysis process Malware analysis lab – overview Setting up a malware analysis lab Proposed malware analysis lab architecture

Creating an isolated virtual network Creating and restoring snapshots

Endpoint detection and response (EDR) Vulnerability and patch management

Threat management best practices Addressing security leadership concerns

Conveying risk and threat management to leadership

Strategies for boardroom discussions

Cybersecurity and business outcomes

Summary Questions Further reading

Proactive Security Strategies

Technical requirements Advancing to proactive security

Key considerations Evolving security challenges Steps to building a proactive security system

Understanding how threat intelligence works

Threat intelligence platforms

FireEye iSIGHT IBM's X-Force Exchange IntSights's Enterprise Threat Intelligence and Mitigation Platform Digital Shadows SearchLight

Understanding how threat hunting works

Stages of threat hunting Components of threat hunting Developing a threat hunting plan Threat hunting maturity model Threat hunting platforms

MITRE Framework Endgame threat hunting Cybereason

Understanding deception technology

Need for deception technology Deception technology vendors and platforms

Illusive Networks Attivo Networks Smokescreen IllusionBLACK Deception TrapX Security

Security Information and Event Management (SIEM)

Capabilities of SIEM SIEM platforms

Splunk ArcSight Enterprise Security Manager IBM QRadar ELK SIEM AlienVault OSSIM

Summary Questions Further reading

Assessments

Chapter 1 Chapter 2 Chapter 3 Chapter 4 Chapter 5 Chapter 6 Chapter 7 Chapter 8 Chapter 9

Other Books You May Enjoy

Leave a review - let other readers know what you think

← Prev
Back
Next →

← Prev
Back
Next →