What this book covers
Chapter 1, Security Posture, defines what constitutes a good security posture and explores the importance of having a good defense and attack strategy.
Chapter 2, Incident Response Process, introduces the incident response process and the importance of establishing a consistent plan. It covers different industry standards and best practices for handling incident response.
Chapter 3, What is a Cyber Strategy?, explains what a cyber strategy is, why it’s needed, and how an effective enterprise cyber strategy can be built.
Chapter 4, Understanding the Cybersecurity Kill Chain, prepares the reader to understand the mindset of an attacker, the different stages of an attack, and what usually takes place in each one of these stages.
Chapter 5, Reconnaissance, covers the different strategies to perform reconnaissance, showing how data is gathered to obtain information about the target and how this information is taken into consideration to plan an attack.
Chapter 6, Compromising the System, shows current trends in strategies to compromise a system, and explains some techniques to exploit vulnerabilities in a system.
Chapter 7, Chasing a User’s Identity, explains the importance of protecting the user’s identity to avoid credential theft, and covers the main strategies used to compromise a user’s identity, all with the intent to improve your identity protection.
Chapter 8, Lateral Movement, describes how attackers perform lateral movement operations once they gain access to the system.
Chapter 9, Privilege Escalation, shows how attackers can escalate privileges in order to gain administrative access to a system.
Chapter 10, Security Policy, focuses on the different aspects of the initial defense strategy, which starts with the importance of establishing guardrails in the beginning of the deployment pipeline and goes over best practices, security awareness training, and key security controls.
Chapter 11, Network Segmentation, looks into different aspects of defense in depth, covering physical network segmentation as well as the virtual and hybrid cloud.
Chapter 12, Active Sensors, explains the importance of having network sensors that can alert about threats based on patterns and behavior. It also covers the different types of network sensors and demonstrates some use case scenarios.
Chapter 13, Threat Intelligence, discusses different aspects of threat intelligence, both from the community and from major vendors.
Chapter 14, Investigating an Incident, goes over the steps to investigate an incident, explores the differences of investigating an on-premises incident versus a cloud-based incident, and finishes with a couple of case studies.
Chapter 15, Recovery Process, focuses on the recovery steps and procedures for a compromised system, and explains the criticality of the options available and how to evaluate the best recovery option.
Chapter 16, Vulnerability Management, describes the importance of vulnerability management to mitigate attempts to exploit known vulnerabilities.
Chapter 17, Log Analysis, goes over the different techniques for manual log analysis, since it is critical for the reader to gain knowledge of how to deeply analyze different types of logs to hunt suspicious security activities.
