Network Security Strategies
Protect your network and enterprise against advanced cybersecurity attacks and threats
BIRMINGHAM - MUMBAI
- Title Page
- Copyright and Credits
- About Packt
- Contributors
- Preface
- Section 1: Network Security Concepts, Threats, and Vulnerabilities
- Network Security Concepts
- Technical requirements
- An overview of network security
- Network security concepts
- Network security components
- Network and system hardening
- Network segmentation
- Network choke-points
- Defense-in-Depth
- Due diligence and cyber resilience
- Soft targets
- Continuous monitoring and improvement
- Post-deployment review
- Network security architecture approach
- Planning and analysis
- Designing
- Building
- Testing
- Deployment
- Post-deployment
- Network security best practices and guidelines
- Network Operations Center overview
- Proper incident management
- Functional ticketing system and knowledge base
- Monitoring policy
- A well-defined investigation process
- Reporting and dashboards
- Escalation
- High availability and failover
- Assessing network security effectiveness
- Key attributes to be considered
- The action priority matrix
- Threat modeling
- Assessing the nature of threats
- STRIDE
- PASTA
- Trike
- VAST
- OCTAVE
- Summary
- Questions
- Further reading
- Security for Cloud and Wireless Networks
- Technical requirements
- An introduction to secure cloud computing
- AWS' shared responsibility model
- Major cybersecurity challenges with the cloud
- Amazon Web Services (AWS)
- AWS security features
- Well-defined identity capabilities
- Traceability
- Defense in depth
- Automation of security best practices
- Continuous data protection
- Security event response
- Microsoft Azure security technologies
- The Zero Trust model
- Security layers
- Identity management using Azure
- Infrastructure protection using Azure
- Criticality of infrastructure
- Encryption
- Identifying and classifying data
- Encryption on Azure
- Network security
- Internet protection
- Virtual networks
- Network integrations
- CipherCloud
- Securing cloud computing
- Security threats
- Countermeasures
- Wireless network security
- Wi-Fi attack surface analysis and exploitation techniques
- Wi-Fi data collection and analysis
- Wi-Fi attack and exploitation techniques
- Best practices
- Security assessment approach
- Software-defined radio attacks
- Types of radio attacks
- Replay attacks
- Cryptanalysis attacks
- Reconnaissance attacks
- Mitigation techniques
- Summary
- Questions
- Further reading
- Mitigating the Top Network Threats of 2020
- Technical requirements
- The top 10 network attacks and how to fix them
- Phishing – the familiar foe
- How to fix phishing threats
- Rogue applications and fake security alerts – intimidation and imitation
- How to fix rogue applications and software threats
- Insider threats – the enemy inside the gates
- How to fix insider threats
- Viruses and worms – a prevailing peril
- How to fix viruses and worms threats
- Botnets – an adversarial army at disposal
- How to fix botnet threats
- Trojan horse – covert entry
- How to fix trojan threats
- Rootkit – clandestine malicious applications
- How to fix rootkit threats
- Malvertising – ads of chaos
- How to fix malvertising threats
- DDoS – defending against one too many
- How to fix DDoS threats
- Ransomware – cyber extortions
- How to fix ransomware threats
- Notable mentions
- Drive-by download
- Exploit kits and AI-ML-driven attacks
- Third-party and supply chain attacks
- Creating an integrated threat defense architecture
- Keeping up with vulnerabilities and threats
- Understanding various defense mechanisms
- Safeguarding confidential information from third parties
- Implementing strong password policies
- Enhancing email security
- Vulnerability management policies
- Vulnerability management life cycle
- Network vulnerability assessments
- Utilizing scanning tools in vulnerability assessment
- Exercising continuous monitoring
- The NIST Risk Management Framework
- The NIST Release Special Publication 800-37
- Summary
- Questions
- Further reading
- Section 2: Network Security Testing and Auditing
- Network Penetration Testing and Best Practices
- Technical requirements
- Approach to network penetration testing
- Pre-engagement
- Reconnaissance
- Threat modeling
- Exploitation
- Post-exploitation
- Reporting
- Retesting
- Top penetration testing platforms
- Setting up our network
- Performing automated exploitation
- OpenVas
- Sparta
- Armitage
- Performing manual exploitation
- Kali Linux
- Nmap
- Nikto
- Dirb
- Metasploit
- Browser Exploitation Framework (BeEF)
- Burp Suite
- Penetration testing best practices
- Case study
- Information gathering
- Scanning the servers
- Identifying and exploiting vulnerabilities
- Reporting
- Presentation
- A few other practices
- The concept of teaming
- Red team
- Blue team
- Purple team
- Capture the flag
- Engagement models and methodologies
- Black box
- Gray box
- White box
- Summary
- Questions
- Further reading
- Advanced Network Attacks
- Technical requirements
- Critical infrastructure and prominent exploitation
- Attack frameworks toward ICS industries
- The cyber kill chain
- Information sharing and analysis centers
- Understanding the threat landscape
- Top threats and vulnerable points in ICS industries
- Well-known critical infrastructure exploitation examples
- Penetration testing IoT networks and reverse engineering firmware
- Introduction to IoT network security
- Security challenges for IoT
- Penetration testing for IoT networks
- Reconnaissance
- Evaluation
- Exploitation
- Reporting
- Setting up an IoT pen testing lab
- Software tool requirements
- Firmware software tools
- Web application software tools
- Platforms and tools for advanced testing
- UART communication
- Firmware reverse engineering and exploitation
- Exploiting VoIP networks and defense mechanisms
- VoIP threat landscape
- VoIP phone classifications
- Pros and cons of VoIP
- Analyzing VoIP security issues
- Vishing
- Denial of Service (DoS)
- Eavesdropping
- Countermeasures and defense vectors
- Top platforms for VoIP monitoring and security
- Summary
- Questions
- Further reading
- Network Digital Forensics
- Technical requirements
- Concepts of network forensics
- Fundamentals of network forensics
- Technical capabilities for responding to forensic incidents
- Network protocols and communication layers
- Damballa network threat analysis
- Forensics tools – network analysis and response
- Wireshark
- The NIKSUN Suite
- Security Onion
- Xplico
- NetworkMiner
- Hakabana
- NetWitness NextGen
- Solera Networks DS
- DSHELL
- LogRhythm Network Monitor
- Key approaches to network forensics
- Industry best practices and standards
- The four steps to dealing with digital evidence
- Advances in network forensics practices
- Big data analytics-based forensics
- Conducting a tabletop forensics exercise
- Familiarizing yourself with the stakeholders
- Creating the ideal scenario
- Gamification
- Document lessons learned
- Summary
- Questions
- Further reading
- Performing Network Auditing
- Technical requirements
- Getting started with your audit
- What is a network audit?
- Why do we need a network audit?
- Key concepts of network auditing
- Understanding the fundamentals of an audit
- Understanding the types of audits
- Foundational pillars for network audits
- Policy
- Procedures
- Standards
- Controls
- Risk management in a network audit
- Risk assessment
- Risk management strategies
- Industry standards and governance framework
- Understanding the auditor's role
- Understanding the auditing process
- Performing a network security audit
- Planning and research phase
- Data gathering and data analysis phase
- Audit report and follow-up phase
- Exploring network audit tools
- Network assessment and auditing tools
- SolarWinds
- Open-AudIT
- Nmap
- NetformX
- Security assessment tools
- Nessus
- Nipper
- Wireshark
- Network audit checklist
- Comprehensive checklist
- Planning phase
- Design and architecture review
- Physical inventory
- Network infrastructure security
- Infrastructure for monitoring and management
- Configuration management
- Performance monitoring and analysis
- Documentation
- Case study
- Network monitoring checklist
- NOC audit checklist
- Audit report (sampling)
- Auditing best practices and latest trends
- Best practices
- Latest trends
- SolarWinds Network Automation Manager
- SolarWinds NCM
- TrueSight Network Automation
- Summary
- Questions
- Further reading
- Section 3: Threat Management and Proactive Security Operations
- Continuous and Effective Threat Management
- Technical requirements
- Cyber threat management concepts
- BCP/DR
- Cyber risk assessment
- Strategic governance framework
- Cyber resilience
- Governance, risk, and compliance (GRC)
- Cyber perimeter establishment
- Threat intelligence gathering
- Continuous threat monitoring
- Actively managing risks and threats
- Unified threat management (UTM)
- Advanced persistent threats (APT)
- The essential eight
- Malware analysis
- Malware analysis process
- Malware analysis lab – overview
- Setting up a malware analysis lab
- Proposed malware analysis lab architecture
- Creating an isolated virtual network
- Creating and restoring snapshots
- Endpoint detection and response (EDR)
- Vulnerability and patch management
- Threat management best practices
- Addressing security leadership concerns
- Conveying risk and threat management to leadership
- Strategies for boardroom discussions
- Cybersecurity and business outcomes
- Summary
- Questions
- Further reading
- Proactive Security Strategies
- Technical requirements
- Advancing to proactive security
- Key considerations
- Evolving security challenges
- Steps to building a proactive security system
- Understanding how threat intelligence works
- Threat intelligence platforms
- FireEye iSIGHT
- IBM's X-Force Exchange
- IntSights's Enterprise Threat Intelligence and Mitigation Platform
- Digital Shadows SearchLight
- Understanding how threat hunting works
- Stages of threat hunting
- Components of threat hunting
- Developing a threat hunting plan
- Threat hunting maturity model
- Threat hunting platforms
- MITRE Framework
- Endgame threat hunting
- Cybereason
- Understanding deception technology
- Need for deception technology
- Deception technology vendors and platforms
- Illusive Networks
- Attivo Networks
- Smokescreen IllusionBLACK Deception
- TrapX Security
- Security Information and Event Management (SIEM)
- Capabilities of SIEM
- SIEM platforms
- Splunk
- ArcSight Enterprise Security Manager
- IBM QRadar
- ELK SIEM
- AlienVault OSSIM
- Summary
- Questions
- Further reading
- Assessments
- Other Books You May Enjoy
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.