What this book covers
Chapter 1, Ransomware Attack Vectors and the Threat Landscape, explains the basics of how ransomware attacks work, the attack chain, and the different attack vectors that are commonly used. The chapter also covers some known ransomware groups and what kind of attack methods they used.
Chapter 2, Building a Secure Foundation, provides a high-level overview of the different countermeasures across all the different attack surfaces, such as networking, infrastructure, endpoints, identity, and SaaS services. It also goes into how to build a secure network foundation and Windows environment.
Chapter 3, Security Monitoring Using Microsoft Sentinel and Defender, teaches you how to configure and set up security monitoring for Windows-based environments using services such as Microsoft Sentinel and Microsoft Defender for Cloud. It also covers architecture design, implementation, and best practices in terms of the key events to monitor.
Chapter 4, Ransomware Countermeasures – Windows Endpoints, Identity, and SaaS, takes you through the different countermeasures to secure Windows-based endpoints, using functionality such as Azure AD and Microsoft Endpoint Manager. In addition, it covers the different ways to secure the identities of end users with password policies and monitor end user activity across devices and SaaS services, before exploring the methods used to reduce the risk of phishing attacks via email.
Chapter 5, Ransomware Countermeasures – Microsoft Azure Workloads, covers different countermeasures and security mechanisms within Windows Server and other parts of the virtual infrastructure. It also covers some best practices regarding network segmentation for virtual infrastructure and includes guidelines for best practices within Microsoft Azure.
Chapter 6, Ransomware Countermeasures – Networking and Zero-Trust Access, covers the best practices regarding network segmentation for end user connectivity and security for Windows-based endpoints and how we can secure our external web services against DDoS attacks. It also covers SASE service models and how they can help reduce the risk for the mobile workforce.
Chapter 7, Protecting Information Using Azure Information Protection and Data Protection, details the different ways to encrypt data to reduce the risk of sensitive information falling into the hands of an attacker. It also covers services such as Azure Information Protection and other best practices related to data protection and backup.
Chapter 8, Ransomware Forensics, explains how to do forensics on impacted systems and how to organize the work when your business has been impacted by an attack. It also covers some different ways to look for evidence of how attackers have compromised a system.
Chapter 9, Monitoring the Threat Landscape, focuses on different tips and tools for monitoring the threat landscape and the use of different tools to monitor your own security exposure using tools such as Microsoft Defender External Attack Surface Management and GreyNoise.
Chapter 10, Best Practices for Protecting Windows from Ransomware Attacks, includes best practices and security settings in Windows, such as LAPS, Windows Firewall, and Tamper Protection, and how to protect your machines from credential harvesting tools such as Mimikatz. Finally, it goes into how to keep your infrastructure up to date using Update Management tools.
