Network Security Strategies. Protect your network and enterprise against advanced cybersecurity attacks and threats

Description

Cover Title Page Copyright and Credits About Packt Contributors Table of Contents Preface Section 1: Network Security Concepts, Threats, and Vulnerabilities Chapter 1: Network Security Concepts Technical requirements An overview of network security Network security concepts Network security components Network and system hardening Network segmentation Network choke-points Defense-in-Depth Due diligence and cyber resilience Soft targets Continuous monitoring and improvement Post-deployment review Network security architecture approach Planning and analysis Designing Building Testing Deployment Post-deployment Network security best practices and guidelines Network Operations Center overview Proper incident management Functional ticketing system and knowledge base Monitoring policy A well-defined investigation process Reporting and dashboards Escalation High availability and failover Assessing network security effectiveness Key attributes to be considered The action priority matrix Threat modeling Assessing the nature of threats STRIDE PASTA Trike VAST OCTAVE Summary Questions Further reading Chapter 2: Security for Cloud and Wireless Networks Technical requirements An introduction to secure cloud computing AWS' shared responsibility model Major cybersecurity challenges with the cloud Amazon Web Services (AWS) AWS security features Well-defined identity capabilities Traceability Defense in depth Automation of security best practices Continuous data protection Security event response Microsoft Azure security technologies The Zero Trust model Security layers Identity management using Azure Infrastructure protection using Azure Criticality of infrastructure Encryption Identifying and classifying data Encryption on Azure Network security Internet protection Virtual networks Network integrations CipherCloud Securing cloud computing Security threats Countermeasures Wireless network security Wi-Fi attack surface analysis and exploitation techniques Wi-Fi data collection and analysis Wi-Fi attack and exploitation techniques  Best practices Security assessment approach Software-defined radio attacks Types of radio attacks Replay attacks Cryptanalysis attacks Reconnaissance attacks Mitigation techniques Summary Questions Further reading Chapter 3: Mitigating the Top Network Threats of 2020 Technical requirements The top 10 network attacks and how to fix them Phishing – the familiar foe How to fix phishing threats Rogue applications and fake security alerts – intimidation and imitation How to fix rogue applications and software threats Insider threats – the enemy inside the gates How to fix insider threats Viruses and worms – a prevailing peril  How to fix viruses and worms threats Botnets – an adversarial army at disposal How to fix botnet threats Trojan horse – covert entry  How to fix trojan threats Rootkit – clandestine malicious applications How to fix rootkit threats Malvertising – ads of chaos How to fix malvertising threats  DDoS – defending against one too many How to fix DDoS threats Ransomware – cyber extortions  How to fix ransomware threats Notable mentions Drive-by download Exploit kits and AI-ML-driven attacks Third-party and supply chain attacks Creating an integrated threat defense architecture Keeping up with vulnerabilities and threats Understanding various defense mechanisms  Safeguarding confidential information from third parties Implementing strong password policies Enhancing email security Vulnerability management policies Vulnerability management life cycle Network vulnerability assessments Utilizing scanning tools in vulnerability assessment Exercising continuous monitoring The NIST Risk Management Framework The NIST Release Special Publication 800-37 Summary Questions Further reading Section 2: Network Security Testing and Auditing Chapter 4: Network Penetration Testing and Best Practices Technical requirements Approach to network penetration testing Pre-engagement Reconnaissance Threat modeling Exploitation Post-exploitation Reporting Retesting Top penetration testing platforms Setting up our network Performing automated exploitation OpenVas Sparta  Armitage Performing manual exploitation Kali Linux Nmap Nikto Dirb Metasploit Browser Exploitation Framework (BeEF) Burp Suite Penetration testing best practices Case study Information gathering Scanning the servers Identifying and exploiting vulnerabilities Reporting Presentation A few other practices The concept of teaming Red team Blue team Purple team Capture the flag Engagement models and methodologies Black box Gray box White box Summary Questions Further reading Chapter 5: Advanced Network Attacks Technical requirements Critical infrastructure and prominent exploitation  Attack frameworks toward ICS industries The cyber kill chain Information sharing and analysis centers Understanding the threat landscape Top threats and vulnerable points in ICS industries Well-known critical infrastructure exploitation examples Penetration testing IoT networks and reverse engineering firmware Introduction to IoT network security Security challenges for IoT Penetration testing for IoT networks Reconnaissance  Evaluation Exploitation Reporting Setting up an IoT pen testing lab Software tool requirements Firmware software tools Web application software tools Platforms and tools for advanced testing UART communication Firmware reverse engineering and exploitation Exploiting VoIP networks and defense mechanisms VoIP threat landscape VoIP phone classifications Pros and cons of VoIP Analyzing VoIP security issues Vishing Denial of Service (DoS) Eavesdropping Countermeasures and defense vectors Top platforms for VoIP monitoring and security Summary Questions Further reading Chapter 6: Network Digital Forensics Technical requirements Concepts of network forensics Fundamentals of network forensics Technical capabilities for responding to forensic incidents Network protocols and communication layers Damballa network threat analysis  Forensics tools – network analysis and response Wireshark The NIKSUN Suite Security Onion Xplico NetworkMiner Hakabana NetWitness NextGen Solera Networks DS DSHELL LogRhythm Network Monitor Key approaches to network forensics Industry best practices and standards The four steps to dealing with digital evidence Advances in network forensics practices Big data analytics-based forensics Conducting a tabletop forensics exercise Familiarizing yourself with the stakeholders Creating the ideal scenario Gamification Document lessons learned Summary Questions Further reading Chapter 7: Performing Network Auditing Technical requirements Getting started with your audit What is a network audit? Why do we need a network audit? Key concepts of network auditing Understanding the fundamentals of an audit Understanding the types of audits Foundational pillars for network audits Policy Procedures Standards Controls Risk management in a network audit Risk assessment Risk management strategies Industry standards and governance framework Understanding the auditor's role Understanding the auditing process Performing a network security audit Planning and research phase Data gathering and data analysis phase Audit report and follow-up phase Exploring network audit tools Network assessment and auditing tools SolarWinds Open-AudIT Nmap NetformX Security assessment tools  Nessus Nipper Wireshark Network audit checklist Comprehensive checklist Planning phase Design and architecture review Physical inventory Network infrastructure security Infrastructure for monitoring and management Configuration management Performance monitoring and analysis Documentation Case study Network monitoring checklist NOC audit checklist Audit report (sampling) Auditing best practices and latest trends  Best practices Latest trends SolarWinds Network Automation Manager  SolarWinds NCM TrueSight Network Automation Summary Questions Further reading Section 3: Threat Management and Proactive Security Operations Chapter 8: Continuous and Effective Threat Management Technical requirements Cyber threat management concepts BCP/DR Cyber risk assessment Strategic governance framework Cyber resilience Governance, risk, and compliance (GRC) Cyber perimeter establishment Threat intelligence gathering Continuous threat monitoring  Actively managing risks and threats Unified threat management (UTM) Advanced persistent threats (APT) The essential eight Malware analysis Malware analysis process Malware analysis lab – overview Setting up a malware analysis lab Proposed malware analysis lab architecture Creating an isolated virtual network Creating and restoring snapshots Endpoint detection and response (EDR) Vulnerability and patch management Threat management best practices Addressing security leadership concerns  Conveying risk and threat management to leadership Strategies for boardroom discussions Cybersecurity and business outcomes Summary Questions Further reading Chapter 9: Proactive Security Strategies Technical requirements Advancing to proactive security Key considerations Evolving security challenges Steps to building a proactive security system Understanding how threat intelligence works Threat intelligence platforms FireEye iSIGHT IBM's X-Force Exchange IntSights's Enterprise Threat Intelligence & Mitigation Platform Digital Shadows SearchLight Understanding how threat hunting works Stages of threat hunting Components of threat hunting Developing a threat hunting plan Threat hunting maturity model Threat hunting platforms  MITRE ATT&CK Endgame threat hunting Cybereason Understanding deception technology Need for deception technology Deception technology vendors and platforms  Illusive Networks Attivo Networks Smokescreen IllusionBLACK Deception TrapX Security Security Information and Event Management (SIEM) Capabilities of SIEM SIEM platforms Splunk ArcSight Enterprise Security Manager IBM QRadar ELK SIEM AlienVault OSSIM Summary Questions Further reading Assessments Other Books You May Enjoy Index