› › The Foundations Of Threat Hunting

The Foundations of Threat Hunting

Author : Chad Maurice

Publisher : Packt Publishing Ltd

Page : 246 pages

File Size : 13,87 MB

Release : 2022-06-17

Category : Computers

ISBN : 1803237287

Get eBook

Book Description

Build and mature a threat hunting team capable of repeatably stalking and trapping advanced adversaries in the darkest parts of an enterprise Key Features • Learn foundational concepts for effective threat hunting teams in pursuit of cyber adversaries • Recognize processes and requirements for executing and conducting a hunt • Customize a defensive cyber framework needed to grow and mature a hunt team Book Description Threat hunting is a concept that takes traditional cyber defense and spins it onto its head. It moves the bar for network defenses beyond looking at the known threats and allows a team to pursue adversaries that are attacking in novel ways that have not previously been seen. To successfully track down and remove these advanced attackers, a solid understanding of the foundational concepts and requirements of the threat hunting framework is needed. Moreover, to confidently employ threat hunting in a business landscape, the same team will need to be able to customize that framework to fit a customer's particular use case. This book breaks down the fundamental pieces of a threat hunting team, the stages of a hunt, and the process that needs to be followed through planning, execution, and recovery. It will take you through the process of threat hunting, starting from understanding cybersecurity basics through to the in-depth requirements of building a mature hunting capability. This is provided through written instructions as well as multiple story-driven scenarios that show the correct (and incorrect) way to effectively conduct a threat hunt. By the end of this cyber threat hunting book, you'll be able to identify the processes of handicapping an immature cyber threat hunt team and systematically progress the hunting capabilities to maturity. What you will learn • Understand what is required to conduct a threat hunt • Know everything your team needs to concentrate on for a successful hunt • Discover why intelligence must be included in a threat hunt • Recognize the phases of planning in order to prioritize efforts • Balance the considerations concerning toolset selection and employment • Achieve a mature team without wasting your resources Who this book is for This book is for anyone interested in learning how to organize and execute effective cyber threat hunts, establishing extra defense capabilities within their company, and wanting to mature an organization's cybersecurity posture. It will also be useful for anyone looking for a framework to help a hunt team grow and evolve.



Practical Threat Intelligence and Data-Driven Threat Hunting

Author : Valentina Costa-Gazcón

Publisher : Packt Publishing Ltd

Page : 398 pages

File Size : 17,32 MB

Release : 2021-02-12

Category : Computers

ISBN : 1838551638

Get eBook

Book Description

Get to grips with cyber threat intelligence and data-driven threat hunting while exploring expert tips and techniques Key Features Set up an environment to centralize all data in an Elasticsearch, Logstash, and Kibana (ELK) server that enables threat hunting Carry out atomic hunts to start the threat hunting process and understand the environment Perform advanced hunting using MITRE ATT&CK Evals emulations and Mordor datasets Book DescriptionThreat hunting (TH) provides cybersecurity analysts and enterprises with the opportunity to proactively defend themselves by getting ahead of threats before they can cause major damage to their business. This book is not only an introduction for those who don’t know much about the cyber threat intelligence (CTI) and TH world, but also a guide for those with more advanced knowledge of other cybersecurity fields who are looking to implement a TH program from scratch. You will start by exploring what threat intelligence is and how it can be used to detect and prevent cyber threats. As you progress, you’ll learn how to collect data, along with understanding it by developing data models. The book will also show you how to set up an environment for TH using open source tools. Later, you will focus on how to plan a hunt with practical examples, before going on to explore the MITRE ATT&CK framework. By the end of this book, you’ll have the skills you need to be able to carry out effective hunts in your own environment.What you will learn Understand what CTI is, its key concepts, and how it is useful for preventing threats and protecting your organization Explore the different stages of the TH process Model the data collected and understand how to document the findings Simulate threat actor activity in a lab environment Use the information collected to detect breaches and validate the results of your queries Use documentation and strategies to communicate processes to senior management and the wider business Who this book is for If you are looking to start out in the cyber intelligence and threat hunting domains and want to know more about how to implement a threat hunting division with open-source tools, then this cyber threat intelligence book is for you.



The Foundations of Threat Hunting

Author : Chad Maurice

Publisher : Packt Publishing

Page : 246 pages

File Size : 48,17 MB

Release : 2022-06-17

Category :

ISBN : 9781803242996

Get eBook

Book Description

Build and mature a threat hunting team capable of repeatably stalking and trapping advanced adversaries in the darkest parts of an enterprise Key Features: Learn foundational concepts for effective threat hunting teams in pursuit of cyber adversaries Recognize processes and requirements for executing and conducting a hunt Customize a defensive cyber framework needed to grow and mature a hunt team Book Description: Threat hunting is a concept that takes traditional cyber defense and spins it onto its head. It moves the bar for network defenses beyond looking at the known threats and allows a team to pursue adversaries that are attacking in novel ways that have not previously been seen. To successfully track down and remove these advanced attackers, a solid understanding of the foundational concepts and requirements of the threat hunting framework is needed. Moreover, to confidently employ threat hunting in a business landscape, the same team will need to be able to customize that framework to fit a customer's particular use case. This book breaks down the fundamental pieces of a threat hunting team, the stages of a hunt, and the process that needs to be followed through planning, execution, and recovery. It will take you through the process of threat hunting, starting from understanding cybersecurity basics through to the in-depth requirements of building a mature hunting capability. This is provided through written instructions as well as multiple story-driven scenarios that show the correct (and incorrect) way to effectively conduct a threat hunt. By the end of this cyber threat hunting book, you'll be able to identify the processes of handicapping an immature cyber threat hunt team and systematically progress the hunting capabilities to maturity. What You Will Learn: Understand what is required to conduct a threat hunt Know everything your team needs to concentrate on for a successful hunt Discover why intelligence must be included in a threat hunt Recognize the phases of planning in order to prioritize efforts Balance the considerations concerning toolset selection and employment Achieve a mature team without wasting your resources Who this book is for: This book is for anyone interested in learning how to organize and execute effective cyber threat hunts, establishing extra defense capabilities within their company, and wanting to mature an organization's cybersecurity posture. It will also be useful for anyone looking for a framework to help a hunt team grow and evolve.



Threat Hunting in the Cloud

Author : Chris Peiris

Publisher : John Wiley & Sons

Page : 636 pages

File Size : 30,15 MB

Release : 2021-08-31

Category : Computers

ISBN : 1119804108

Get eBook

Book Description

Implement a vendor-neutral and multi-cloud cybersecurity and risk mitigation framework with advice from seasoned threat hunting pros In Threat Hunting in the Cloud: Defending AWS, Azure and Other Cloud Platforms Against Cyberattacks, celebrated cybersecurity professionals and authors Chris Peiris, Binil Pillai, and Abbas Kudrati leverage their decades of experience building large scale cyber fusion centers to deliver the ideal threat hunting resource for both business and technical audiences. You'll find insightful analyses of cloud platform security tools and, using the industry leading MITRE ATT&CK framework, discussions of the most common threat vectors. You'll discover how to build a side-by-side cybersecurity fusion center on both Microsoft Azure and Amazon Web Services and deliver a multi-cloud strategy for enterprise customers. And you will find out how to create a vendor-neutral environment with rapid disaster recovery capability for maximum risk mitigation. With this book you'll learn: Key business and technical drivers of cybersecurity threat hunting frameworks in today's technological environment Metrics available to assess threat hunting effectiveness regardless of an organization's size How threat hunting works with vendor-specific single cloud security offerings and on multi-cloud implementations A detailed analysis of key threat vectors such as email phishing, ransomware and nation state attacks Comprehensive AWS and Azure "how to" solutions through the lens of MITRE Threat Hunting Framework Tactics, Techniques and Procedures (TTPs) Azure and AWS risk mitigation strategies to combat key TTPs such as privilege escalation, credential theft, lateral movement, defend against command & control systems, and prevent data exfiltration Tools available on both the Azure and AWS cloud platforms which provide automated responses to attacks, and orchestrate preventative measures and recovery strategies Many critical components for successful adoption of multi-cloud threat hunting framework such as Threat Hunting Maturity Model, Zero Trust Computing, Human Elements of Threat Hunting, Integration of Threat Hunting with Security Operation Centers (SOCs) and Cyber Fusion Centers The Future of Threat Hunting with the advances in Artificial Intelligence, Machine Learning, Quantum Computing and the proliferation of IoT devices. Perfect for technical executives (i.e., CTO, CISO), technical managers, architects, system admins and consultants with hands-on responsibility for cloud platforms, Threat Hunting in the Cloud is also an indispensable guide for business executives (i.e., CFO, COO CEO, board members) and managers who need to understand their organization's cybersecurity risk framework and mitigation strategy.



Security Strategies in Windows Platforms and Applications

Author : Robert Shimonski

Publisher : Jones & Bartlett Learning

Page : 754 pages

File Size : 31,84 MB

Release : 2023-11-06

Category : Computers

ISBN : 1284302288

Get eBook

Book Description

Revised and updated to keep pace with this ever-changing field, Security Strategies in Windows Platforms and Applications, Fourth Edition focuses on new risks, threats, and vulnerabilities associated with the Microsoft Windows operating system, placing a particular emphasis on Windows 11, and Windows Server 2022. The Fourth Edition highlights how to use tools and techniques to decrease risks arising from vulnerabilities in Microsoft Windows operating systems and applications. The book also includes a resource for readers desiring more information on Microsoft Windows OS hardening, application security, and incident management. With its accessible writing style, and step-by-step examples, this must-have resource will ensure readers are educated on the latest Windows security strategies and techniques.



Digital Forensics and Incident Response

Author : Gerard Johansen

Publisher : Packt Publishing Ltd

Page : 532 pages

File Size : 39,15 MB

Release : 2022-12-16

Category : Computers

ISBN : 1803230258

Get eBook

Book Description

Incident response tools and techniques for effective cyber threat response Key Features Create a solid incident response framework and manage cyber incidents effectively Learn to apply digital forensics tools and techniques to investigate cyber threats Explore the real-world threat of ransomware and apply proper incident response techniques for investigation and recovery Book DescriptionAn understanding of how digital forensics integrates with the overall response to cybersecurity incidents is key to securing your organization’s infrastructure from attacks. This updated third edition will help you perform cutting-edge digital forensic activities and incident response with a new focus on responding to ransomware attacks. After covering the fundamentals of incident response that are critical to any information security team, you’ll explore incident response frameworks. From understanding their importance to creating a swift and effective response to security incidents, the book will guide you using examples. Later, you’ll cover digital forensic techniques, from acquiring evidence and examining volatile memory through to hard drive examination and network-based evidence. You’ll be able to apply these techniques to the current threat of ransomware. As you progress, you’ll discover the role that threat intelligence plays in the incident response process. You’ll also learn how to prepare an incident response report that documents the findings of your analysis. Finally, in addition to various incident response activities, the book will address malware analysis and demonstrate how you can proactively use your digital forensic skills in threat hunting. By the end of this book, you’ll be able to investigate and report unwanted security breaches and incidents in your organization.What you will learn Create and deploy an incident response capability within your own organization Perform proper evidence acquisition and handling Analyze the evidence collected and determine the root cause of a security incident Integrate digital forensic techniques and procedures into the overall incident response process Understand different techniques for threat hunting Write incident reports that document the key findings of your analysis Apply incident response practices to ransomware attacks Leverage cyber threat intelligence to augment digital forensics findings Who this book is for This book is for cybersecurity and information security professionals who want to implement digital forensics and incident response in their organizations. You’ll also find the book helpful if you’re new to the concept of digital forensics and looking to get started with the fundamentals. A basic understanding of operating systems and some knowledge of networking fundamentals are required to get started with this book.



Attribution of Advanced Persistent Threats

Author : Timo Steffens

Publisher : Springer Nature

Page : 207 pages

File Size : 21,72 MB

Release : 2020-07-20

Category : Computers

ISBN : 3662613131

Get eBook

Book Description

An increasing number of countries develop capabilities for cyber-espionage and sabotage. The sheer number of reported network compromises suggests that some of these countries view cyber-means as integral and well-established elements of their strategical toolbox. At the same time the relevance of such attacks for society and politics is also increasing. Digital means were used to influence the US presidential election in 2016, repeatedly led to power outages in Ukraine, and caused economic losses of hundreds of millions of dollars with a malfunctioning ransomware. In all these cases the question who was behind the attacks is not only relevant from a legal perspective, but also has a political and social dimension. Attribution is the process of tracking and identifying the actors behind these cyber-attacks. Often it is considered an art, not a science. This book systematically analyses how hackers operate, which mistakes they make, and which traces they leave behind. Using examples from real cases the author explains the analytic methods used to ascertain the origin of Advanced Persistent Threats.



Security, Privacy, and Forensics Issues in Big Data

Author : Joshi, Ramesh C.

Publisher : IGI Global

Page : 474 pages

File Size : 23,86 MB

Release : 2019-08-30

Category : Computers

ISBN : 1522597441

Get eBook

Book Description

With the proliferation of devices connected to the internet and connected to each other, the volume of data collected, stored, and processed is increasing every day, which brings new challenges in terms of information security. As big data expands with the help of public clouds, traditional security solutions tailored to private computing infrastructures and confined to a well-defined security perimeter, such as firewalls and demilitarized zones (DMZs), are no longer effective. New security functions are required to work over the heterogenous composition of diverse hardware, operating systems, and network domains. Security, Privacy, and Forensics Issues in Big Data is an essential research book that examines recent advancements in big data and the impact that these advancements have on information security and privacy measures needed for these networks. Highlighting a range of topics including cryptography, data analytics, and threat detection, this is an excellent reference source for students, software developers and engineers, security analysts, IT consultants, academicians, researchers, and professionals.



Hunting Cyber Criminals

Author : Vinny Troia

Publisher : John Wiley & Sons

Page : 544 pages

File Size : 23,78 MB

Release : 2020-02-11

Category : Computers

ISBN : 1119540925

Get eBook

Book Description

The skills and tools for collecting, verifying and correlating information from different types of systems is an essential skill when tracking down hackers. This book explores Open Source Intelligence Gathering (OSINT) inside out from multiple perspectives, including those of hackers and seasoned intelligence experts. OSINT refers to the techniques and tools required to harvest publicly available data concerning a person or an organization. With several years of experience of tracking hackers with OSINT, the author whips up a classical plot-line involving a hunt for a threat actor. While taking the audience through the thrilling investigative drama, the author immerses the audience with in-depth knowledge of state-of-the-art OSINT tools and techniques. Technical users will want a basic understanding of the Linux command line in order to follow the examples. But a person with no Linux or programming experience can still gain a lot from this book through the commentaries. This book’s unique digital investigation proposition is a combination of story-telling, tutorials, and case studies. The book explores digital investigation from multiple angles: Through the eyes of the author who has several years of experience in the subject. Through the mind of the hacker who collects massive amounts of data from multiple online sources to identify targets as well as ways to hit the targets. Through the eyes of industry leaders. This book is ideal for: Investigation professionals, forensic analysts, and CISO/CIO and other executives wanting to understand the mindset of a hacker and how seemingly harmless information can be used to target their organization. Security analysts, forensic investigators, and SOC teams looking for new approaches on digital investigations from the perspective of collecting and parsing publicly available information. CISOs and defense teams will find this book useful because it takes the perspective of infiltrating an organization from the mindset of a hacker. The commentary provided by outside experts will also provide them with ideas to further protect their organization’s data.