Index
A
- AAA (authentication, authorization, and accounting) architecture, TACACS+
- accepting risk, Mitigate
- access control lists (ACLs), Routers, Logical
- access restrictions (physical access), Restrict Access
- accounting, TACACS+
- actions on objectives (in Intrusion Kill Chain), Use Cases, Tabletops, and Drills
- Active Directory Domain Services (AD DS), Active Directory Domain Services-Group Policy Objects
- Active DirectoryModule, Information Gathering
- administrator accounts, Roles and Responsibilities
- AES3 algorithm, Salting
- alerts
- alternate system, using for disaster recovery, Alternate System
- Ansible, Unix Desktops
- antimalware software, Endpoint Protection Tools
- antivirus software, Endpoint Protection Tools
- AP Twitter hack, Why 2FA?
- Apache web servers, Application
- application logs, Application Logs
- application segmentation, Application
- application servers, Unix Application Servers
- applications, documenting, Applications
- apt-get update command (Debian Linux), Third-Party Software Updates
- ARIN (American Registry for Internet Numbers), Websites
- ARP (Address Resolution Protocol) cache, Information Gathering
- Assembly language, 0xAssembly
- assessment of risks, Assess
- asset management, Asset Management and Documentation-Conclusion
- attacks
- auditing team, Establish Teams
- authentication
- authenticated vulnerability scans, Authenticated versus Unauthenticated Scans
- authentication system logs and alerts from, Authentication Systems
- between domains or forests in Active Directory, Forest
- centralized, benefits of, Password Storage Locations and Methods
- in AAA architecture, TACACS+
- multifactor or two-factor, Multifactor Authentication-Where It Should Be Implemented
- port-level, 802.1X standard, Switches, NACs
- settings in Windows Group Policy, Password Storage Locations and Methods
- SQL Server, MS SQL Authentication
- authorization, TACACS+
- automated dynamic testing, Automated Dynamic Testing
- automated static testing, Automated Static Testing
- Autopsy, Disk and File Analysis
- avoidance of risk, Mitigate
- awk command (Unix), Log Analysis
B
- backups, Backups
- badges (physical access control), Restrict Access
- Baseboard Management Controllers (BMCs), Password Storage Locations and Methods
- baselines, establishing for user security awareness, Establish Baselines, Important Metrics
- bastion hosts, Management Network
- batches of remediation work, Program Initialization
- BCP (see business continuity planning)
- Bcrypt hashing algorithm, Salting
- binary updates (operating system), Core Operating System Updates
- biometric readings, 2FA Methods
- BitLocker Drive Encryption (Windows), Full-Disk Encryption
- blue team (defensive) techniques, Purple Teaming
- (see also purple teaming)
- BMC/ILOs, security vulnerabilities, Password Storage Locations and Methods
- bring your own device (BYOD) policies, NACs
- Bro tool
- brute force attacks, Use Case Analysis
- builtwith module, running on recon-ng, recon-ng
- builtwith.com, Technology
- business continuity planning, Disaster Recovery
C
- C and C++, /* C and C++ */
- C2 (see command and control)
- CAINE free/open source IR tools, All in One
- cameras (surveillance), placement of, Video Surveillance
- Capture the Flags (CTFs), Expanding Your Team and Skillsets
- cardholder data, regulation by PCI DSS, Payment Card Industry Data Security Standard (PCI DSS)
- CCTV (closed-circuit television) cameras, Video Surveillance
- Center for Internet Security (CIS), Center for Internet Security
- centralized infrastructure, Centralization
- centralized log aggregation, Where to Log
- certificates, documenting, Other
- change tracking (assets), Change Tracking
- chroot utility (Unix), chroot
- CIA (confidentiality, integrity, and availability), Disaster Recovery
- client-side attacks, protecting against with EMET, Custom Configuration
- Cloud Control Matrix (CCM), Cloud Control Matrix
- Cloud Security Alliance (CSA), Identify, Cloud Control Matrix
- COBIT (Control Objectives for Information and Related Technologies), Control Objectives for Information and Related Technologies
- code review, Peer Review
- collisions (in hashing), Hashing
- command and control (C2), Use Cases, Tabletops, and Drills
- Committee of Sponsoring Organizations of the Treadway Commission (COSO), The Committee of Sponsoring Organizations of the Treadway Commission
- Common Vulnerability Scoring System (CVSS), Remediation Prioritization
- communications
- company assets, OSINT information and access to, Company assets
- compliance frameworks (see industry compliance frameworks)
- compliance standards (see industry compliance standards)
- confidentiality, integrity, and availability (CIA), Disaster Recovery
- configurations
- backing up for network devices, Firmware/Software Patching
- basic configuration, EMET, Basic Configuration
- configuration management tools, Managing file integrity
- custom configuration, EMET, Custom Configuration
- email servers, Email Servers
- for iOS and macOS devices, macOS
- misconfigurations in Windows OS and software, Microsoft Windows Infrastructure
- organized, Logical
- context, adding to vendor-supplied severity ratings, Remediation Prioritization
- contractors, physical security measures for, Contractor Actions
- Control Panel (Windows)
- critical security controls, Identify
- Cross Domain and Forest Trusts, Forest
- cryptography (see encryption)
- CTFs (Capture the Flags), Expanding Your Team and Skillsets
- curl utility, Log Analysis
- customer data, breaches of, Personal assets
- customization, network design, Logical
- Cyber Kill Chain, Use Cases, Tabletops, and Drills
D
- data at rest (backup data), security considerations, Security Considerations
- data exfiltration, Use Cases, Tabletops, and Drills, Egress Filtering, Documents, Use Case Analysis
- data in transit, security considerations, Security Considerations
- data mining, Personal assets
- database administrators (DBAs), Roles and Responsibilities
- datacenters
- DCs (see domain controllers)
- ddfldd tool, Disk and File Analysis
- DDoS amplification, SNMP
- decommissioning assets, Defining the Lifecycle
- default accounts, Authentication Systems
- default deny/whitelisting, Logical
- defensive security, Purple Teaming
- degaussing, Defining the Lifecycle
- delivery (weaponized payload), Use Cases, Tabletops, and Drills
- demilitarized zone (DMZ), Physical
- denial of service (DoS) attacks, Network Infrastructure
- dependencies
- deployment of assets, Defining the Lifecycle
- DES/3DES, upgrade for, Salting
- desktops
- development, Development-Conclusion
- development or test networks, Physical
- DHCP (Dynamic Host Configuration Protocol), Information Gathering, Automation
- directory information, Family Educational Rights and Privacy Act (FERPA), Family Educational Rights and Privacy Act
- disaster recovery, Disaster Recovery-Conclusion
- disk and file analysis in IR, Disk and File Analysis
- disk forensics, full-disk encryption and, Full-Disk Encryption
- disposal of assets
- DNS
- DNS servers, DNS Servers-DNS Servers
- preventing and safeguarding against attacks on, DNS Servers
- DNSSEC (DNS Security Extensions), DNS Servers
- documentation (in asset management), Documentation-Conclusion
- documents, sensitive information included in, Documents
- Domain Admin–level access (AD DS), Accounts
- domain controllers (in AD DS), Domain Controllers
- Domain Naming Master, Domain Controllers
- domains
- DR (see disaster recovery)
- dumpster diving, Physical assets
- Duo Security, 2FA Methods
- dynamic testing, Automated Dynamic Testing
E
- Ebbinghaus forgetting curve, Broken Processes
- education versus training, Broken Processes
- educational records, Family Educational Rights and Privacy Act
- egress filtering, Egress Filtering
- email addresses, Company assets
- email aliases and group nesting, Email Servers
- email servers, Email Servers
- encryption
- endpoints, Endpoints-Conclusion
- Enhanced Interior Gateway Routing Protocol (EIGRP), Routers
- Enhanced Mitigation Experience Toolkit (EMET), EMET-Enterprise Deployment Strategies
- ePHI (Electronic Protected Health Information), Health Insurance Portability & Accountability Act
- Ethernet tap (Ethertap), Network-Based IDS
- evaluator (tabletop exercises), Use Cases, Tabletops, and Drills
- exchangeable image file format (EXIF), Technology
- executive champions (for asset management), Executive Champions
- executive team (security), Establish Teams
- Exploit Database, exploits running on Windows platform, Microsoft Windows Infrastructure
- exploitation (in Intrusion Kill Chain), Use Cases, Tabletops, and Drills
F
- fail over, invoking, Invoking a Fail Over...and Back
- FakeAV malware, Third-Party Updates
- Family Educational Rights and Privacy Act (FERPA), Family Educational Rights and Privacy Act
- Federal Trade Commission (FTC), Health Insurance Portability & Accountability Act
- FEMA (Federal Emergency Management Agency), tabletop templates, Use Cases, Tabletops, and Drills
- file permissions (Unix systems), File permissions
- file shares, Open Shares
- files
- FileVault (OS X), Full-Disk Encryption
- financial industry, Financial
- fine-grained password policies, Password Security Objects-Multifactor Authentication
- firewalls
- firmware/software patching, Firmware/Software Patching
- Flexible Single Master Operation (FSMO) roles, Domain Controllers
- forest (Active Directory), Forest
- fragmented packets, Routers
- FreeBSD platforms, Unix Application Servers
- FTC (Federal Trade Commission), Health Insurance Portability & Accountability Act
- full-disk encryption, Defining the Lifecycle, Full-Disk Encryption
G
- gamification, Gamification
- Global Catalogs (GCs), FSMO roles and, Domain Controllers
- GO language, GO func()
- goals (key), determining for disaster recovery, Incident Processes
- Google Authenticator, 2FA Methods
- Google Dorking, Documents
- government data, regulations on, Government
- Gramm-Leach Bliley Act (GLBA), Gramm-Leach Bliley Act
- grep command (Unix), Log Analysis
- group nesting, Email Servers
- Group Policy Objects (GPOs), Group Policy Objects
- groups (Active Directory), Groups
- guest captive portals, NACs
- guest network access, Physical
H
- hardening endpoints, Hardening Endpoints-Endpoint Protection Tools
- hardening network devices, Device Hardening-Routers
- hardening Unix application servers, Hardening a Unix Application Server-Mandatory Access Controls
- hardware failure of mission-critical platform, Scenarios
- The Harvester, theharvester.py
- hash-based one time passwords (HOTP), How It Works
- hashing, Hashing
- Health Insurance Portability & Accountability Act (HIPAA), Information Classification, Health Insurance Portability & Accountability Act
- penalties for failure to follow guidelines, Healthcare
- healthcare industry, regulations on, Healthcare
- hello (mail server), Email Servers
- HHS (US Department of Health and Human Services), Health Insurance Portability & Accountability Act, Healthcare
- high availability, High Availability
- high-level technology processes in IR, Incident Processes
- homebrew, distributing third-party software to macOS hosts, macOS
- host-based firewalls (Unix systems), Host-based firewalls
- host-based IDS (HIDS), Host-Based IDS
- HOTP (hash-based one time passwords), How It Works
- HTTP, Services
- HTTPS, Services
I
- Identify, Protect, Detect, Respond, Recover (NIST Framework), Lay the Groundwork
- identifying threats and risks, Identify
- IDS and IPS, IDS and IPS-Conclusion
- IEEE 802.1 protocol specifications, NACs
- images, software and firmware, Firmware/Software Patching
- incident manager, choosing, Incident Processes
- incident response (IR), Positive Reinforcement, Incident Response-Conclusion
- incident, defining, Pre-Incident Processes
- industry compliance frameworks, Frameworks-NIST CyberSecurity Framework
- industry compliance standards, Lay the Groundwork, Information Classification, Industry Compliance Standards and Frameworks-Sarbanes-Oxley Act
- industry conferences or meetups, Expanding Your Team and Skillsets
- inetd and xinetd utilities (Unix), Disable services, Disable Services
- information classification, Information Classification
- information gathering (in asset management), Information Gathering
- information security
- Information Security program (see security program, creating)
- Information Sharing and Analysis Centers (ISACs), Identify
- Infrastructure Master, Domain Controllers
- Initiative for Open Authentication (OAUTH), How It Works
- installation, remote access trojan or backdoor on victim system, Use Cases, Tabletops, and Drills
- Integrated Lights Out (ILO) cards, Password Storage Locations and Methods
- Interior Gateway Protocol (IGP), Routers
- International Organization for Standardization (see ISO)
- internet access, blocking when not required, Logical
- internet-connected devices, Shodan search engine for, Websites
- intrusion detection systems (see IDS and IPS)
- Intrusion Kill Chain, Use Cases, Tabletops, and Drills, Designing the SIEM
- intrusion prevention systems (see IDS and IPS)
- iOS, configurations for devices, macOS
- IP addresses
- IPSec VPNs
- advantages of, VPNs
- security considerations, VPNs
- IPv6, security considerations, IPv6: A Cautionary Note
- ISACs (Information Sharing and Analysis Centers), Identify
- ISO (International Organization for Standardization), ISO-27000 Series
- ISO-27000 series, ISO-27000 Series
L
- LAMP (Linux, Apache, MySQL, and PHP) stack, Application
- launchctl command (macOS), Disable Services
- least privilege design, Logical
- lifecycle, defining for assets, Defining the Lifecycle
- Linux, Unix Application Servers
- (see also Unix application servers)
- commands to manage services, Disable services, Disable Services
- firewalls on desktops, Desktop Firewalls
- full-disk encryption, Full-Disk Encryption
- in LAMP stacks, Application
- procedure documentaion on, Language
- Security Onion, NIDS tools, Network-Based IDS
- using systemd to manage services, Disable services, Disable Services
- vulnerability of Grand Unified Bootloader to password bypass, Password Storage Locations and Methods
- Local Administrator Password Solution (LAPS), Accounts
- Lockheed Martin, Intrusion Kill Chain, Use Cases, Tabletops, and Drills
- locking server racks, Datacenters
- logging, Logging and Monitoring-Conclusion
- logical network segmentation, Logical
- long haul, planning for in incident response, Incident Processes
- long term (milestones), Create Milestones
M
- MAC addresses, Automation
- macOS
- mail servers, vulnerability scans of, Authenticated versus Unauthenticated Scans
- malicious media, Include Physical Security Training
- Maltego, Maltego-Maltego
- malware, Identify
- man-in-the-middle attacks on SSL, VPNs
- managed layer-2 switches, Switches
- management (in asset lifecycle), Defining the Lifecycle
- management network, creating, Management Network
- mandatory access controls (MAC) on Unix, Mandatory Access Controls
- MD5 hashing algorithm, Hashing
- MDM (mobile device management), Mobile Device Management
- media
- memory analysis in incident response, Memory Analysis
- mentoring, Expanding Your Team and Skillsets
- metadata, Technology
- Metasploit, recon-ng
- metrics from security awareness program, Gaining Meaningful Metrics-Important Metrics
- Microsoft SQL Server (see SQL Server)
- Microsoft SysInternals Suite, Accounts, Disable Services
- Microsoft Windows (see Windows infrastructure; Windows systems)
- milestones, creating for security programs, Create Milestones
- mitigation of risks, Mitigate
- Mixed Authentication mode (SQL Server), MS SQL Authentication
- mobile device management (MDM), Mobile Device Management
- moderator or facilitator (tabletop exercises), Use Cases, Tabletops, and Drills
- monitoring, Logging and Monitoring
- mount and umount commands (Unix systems), Separate disk partitions
- mount point options on Unix systems, Separate disk partitions
- MS-08-067 (remote code execution bug), Upgrade
- MS-SQL Server (see SQL Server)
- multi-layered design, Logical
- multifactor authentication (MFA), Multifactor Authentication-Where It Should Be Implemented
- MXToolbox, Email Servers
- MySQL, Application
N
- NACs (see network access controls)
- National Council of ISACs, Identify
- National Institute of Standards and Technology (see NIST)
- Netdisco, Networking Equipment
- network access controls (NACs), Logical, NACs
- advantages and examples of, NACs
- network infrastructure, Network Infrastructure
- network segmentation, Network Segmentation-Software-Defined Networking
- network-based IDS (NIDS), Network-Based IDS
- networks
- next year (milestones), Create Milestones
- NIST (National Institute of Standards and Technology), Center for Internet Security
- nmap utility, Information Gathering
O
- OAUTH (Initiative for Open Authentication), How It Works
- objectives
- OCTAVE risk framework, Establish Teams
- offensive security, Red Teaming
- online forums, security concerns, Personal assets
- open mail relay, Email Servers
- open shares, Open Shares
- Open Shortest Path First (OSPF), Routers
- open-source intelligence (OSINT), Open Source Intelligence
- operating systems
- operational aspects (physical security), Operational-Include Physical Security Training
- Organizational Units (OUs), OUs
- OS Query, Endpoint Visibility
- OS X, full-disk encryption with FileVault, Full-Disk Encryption
- OSSEC, Managing file integrity, Host-Based IDS
- out of band authentication (OOBA), How It Works
- outsourcing
P
- package management (Unix-based platforms), Third-Party Software Updates
- packet filters, Host-based firewalls
- pandemic scenario for disaster planning, Scenarios
- participants (tabletop exercises), Use Cases, Tabletops, and Drills
- partitioning, disk partitions in Unix, Separate disk partitions
- passive DNS server, implementing, DNS Servers
- password management, Password Management and Multifactor Authentication-Multifactor Authentication
- complex passwords and passphrases, Basic Password Practices
- cracking passwords, Basic Password Practices
- encryption, hashing, and salting, Encryption, Hashing, and Salting-Salting
- upgrades for insecure algorithms, Salting
- multifactor authentication (MFA), Multifactor Authentication-Where It Should Be Implemented
- password security objects, Password Security Objects
- password storage locations and methods, Password Storage Locations and Methods
- pasword breaches, Password Breaches
- resetting passwords, Password Resets
- software for, Password Management Software
- patches (third-party) for Windows infrastructure, Third-Party Patches
- patching and configuration management for backup systems, Security Considerations
- Payment Card Industry Data Security Standard (PCI DSS), Information Classification, Payment Card Industry Data Security Standard (PCI DSS)
- PCAP (packet capture) files, analysis of, PCAP Analysis
- PDC Emulator, Domain Controllers
- peer review, Peer Review
- penetration testing versus vulnerability assessment, Vulnerability Management
- Perl, #!/Python/Ruby/Perl
- personal assets, OSINT intelligence on, Personal assets
- using recon-ng whois-pocs module, recon-ng
- personally identifiable information (PII)
- PGP email address search (recon-ng), recon-ng
- PHI (Protected Health Information) breaches, Healthcare
- phishing, Identify, User Education, Email Servers
- PhotoRec, Disk and File Analysis
- PHP, Application, <? PHP ?>
- physical assets, OSINT intelligence about, Physical assets
- physical disposal of assets, Defining the Lifecycle
- physical network segmentation, Physical
- physical security, Physical Security-Conclusion, Company assets
- platform-specific documentation for procedures, Language
- policies, Policies-Conclusion
- port-level authentication, Switches, NACs
- positive reinforcement in user security education program, Positive Reinforcement
- post-incident processes, Post-Incident Processes
- PowerShell (Windows), Information Gathering
- pre-incident processes, Pre-Incident Processes
- pretexts to gain access to restricted areas, Include Physical Security Training
- printers
- prioritization, risk and threat remediation, Prioritize
- privilege escalation vulnerability, Authenticated versus Unauthenticated Scans
- procedures, Procedures
- Process Explorer and Process Monitor, Disable Services
- processes (incident response), Processes-Tools and Technology
- procurement of assets, Defining the Lifecycle
- Profile Manager tool (Apple), macOS
- programming language, choosing, Language Selection-<? PHP ?>
- protections for information, Information Classification
- proxy logs, Proxy and Firewall Logs
- ps command (Unix), Disable services, Disable Services
- Puppet, Unix Desktops
- purple teaming, Purple Teaming-Conclusion
- Python, #!/Python/Ruby/Perl
R
- rainbow tables, Basic Password Practices, Hashing
- RAM, analyzing in incident response, Memory Analysis
- ransomware attacks, Identify, Use Case Analysis
- Rapid Assessment of Web Resources (see Rawr)
- Rawr, Rawr-Conclusion
- rc or init scripts on Unix systems, Disable services, Disable Services
- recon-ng, recon-ng-recon-ng
- reconnaissance
- recovery point objective, Recovery Point Objective
- recovery strategies, Recovery Strategies-System Function Reassignment
- recovery time objective, Recovery Time Objective
- recursive queries, restricting on DNS servers, DNS Servers
- red teaming, Purple Teaming, Red Teaming-Conclusion
- regulated industries, Regulated Industries-Conclusion
- regulatory compliance, Industry Compliance Standards and Frameworks
- remediation (risk), Mitigate
- remediation prioritization, Remediation Prioritization
- remote code execution, protecting against with EMET, Custom Configuration
- remote offices, securing equipment in, Datacenters
- repetition based on active recall, Broken Processes
- reporting on assets, Monitoring and Reporting
- resources, Useful Resources
- Responder, Responder-Rawr
- Response Policy Zone (RPZ) DNS records, DNS Servers
- responsibilities and roles, segmenting, Roles and Responsibilities
- reverse DNS (rDNS), Email Servers
- RID Master, Domain Controllers
- risk acceptance, Risk Acceptance
- risk assessment, Assess
- risk management, Assess Threats and Risks-Monitor
- risk team, Establish Teams
- roles
- root directory, changing for running processes on Unix, chroot
- routers, security considerations, Routers
- routing
- Routing Information Protocol version 2 (RIPv2), Routers
- RPO (see recovery point objective)
- RSA tokens, 2FA Methods
- RTO (see recovery time objective)
- Ruby, #!/Python/Ruby/Perl
- rules, establishing for user security education program, Scope and Create Program Rules and Guidelines
S
- SA (system administrator) user security (SQL Server), SA User Security
- salting, Salting
- Samhain, Managing file integrity, Host-Based IDS
- SANS
- Sarbanes-Oxley Act (SOX), Sarbanes-Oxley Act
- SCADA systems, Endpoint Visibility
- scenarios, using to test disaster planning, Scenarios
- Schema Master, Domain Controllers
- scripting languages, #!/Python/Ruby/Perl
- secure coding guidelines, Secure Coding Guidelines
- security awareness, User Education
- (see also user education)
- security considerations
- security IDs (SIDs)
- filtering and selective authentication, Forest
- unresolved, preventing, Groups
- security information and event management (SIEM) platforms, Log Analysis, Security Information and Event Management
- security program, creating, Creating a Security Program-Conclusion
- assessing threats and risks, Assess Threats and Risks-Monitor
- baseline security posture, Baseline Security Posture
- establishing teams, Establish Teams
- expanding your team's skillsets, Expanding Your Team and Skillsets
- milestones, Create Milestones
- prioritizing remediation, Prioritize
- use cases, tabletops, and drills, Use Cases, Tabletops, and Drills-Use Cases, Tabletops, and Drills
- security team, Establish Teams
- security through obscurity, Security through Obscurity
- security, resources on, Useful Resources
- sed command (Unix), Log Analysis
- segmentation, Segmentation-Conclusion
- server/service attacks, protecting against with EMET, Custom Configuration
- servers
- service accounts, Accounts
- services
- SETUID permission (Unix systems), File permissions
- severity ratings (vulnerabilities), Remediation Prioritization
- SHA1 algorithm, upgrades for, Salting
- shared user accounts, avoiding, Accounts
- Shodan, Websites
- shoulder surfing, Physical assets
- shredding (data disposal), Defining the Lifecycle
- SIEMs (see security information and event management platforms)
- sign-in/sign-out for visitors, Visitor Actions
- signatures, writing for IDS/IPS, Writing Your Own Signatures-Writing Your Own Signatures
- sinkhole server (DNS), DNS Servers
- skillsets, expanding for your team, Expanding Your Team and Skillsets
- Sleuth Kit, Disk and File Analysis
- SMS, deprecation as secure standard, 2FA Methods
- SMTP servers
- SNMP (Simple Network Management Protocol), Information Gathering, SNMP
- changing default community strings, SNMP
- community strings, SNMP
- use as amplifier for DoS attacks, SNMP
- Snort tool, Network-Based IDS, IPS
- social engineering attacks, Bridging the Gap
- social media posts, security concerns, Personal assets
- software
- Software Update Service (macOS Server), macOS
- software-defined networking, Software-Defined Networking
- Solaris, Unix Application Servers
- (see also Unix application servers)
- source code, updating from, Core Operating System Updates
- SOX (see Sarbanes-Oxley Act)
- spam, Email Servers
- split-tunneling, VPNs
- SQL Server, MS-SQL Server-SA User Security
- sshd service
- SSL/TLS VPNs
- advantages of, VPNs
- security considerations, VPNs
- staff members, physical security and, Authentication Maintenance
- standards and procedures, Standards and Procedures-Conclusion
- startup scripts (rc or init) on Unix systems, Disable services, Disable Services
- stateful firewalls (on hosts), Host-based firewalls
- static testing, Automated Static Testing
- success rate and progress, tracking from security awareness program, Tracking Success Rate and Progress
- Suricata (NIDS tool), Network-Based IDS
- switches, Switches
- system administrator (SA) user security, SQL Server, SA User Security
- System Center Configuration Manager (SCCM), Third-Party Patches, Enterprise Deployment Strategies
- system development lifecycle, System Development Lifecycle
- system function reassignment, System Function Reassignment
- systemd, Disable services, Disable Services
T
- tabletop exercises
- items to include in, Use Cases, Tabletops, and Drills
- key groups or members in, Use Cases, Tabletops, and Drills
- post-exercise actions and questions, Use Cases, Tabletops, and Drills
- templates for, Use Cases, Tabletops, and Drills
- TACACS+, TACACS+
- tailgating, Include Physical Security Training, Company assets
- TCP ports, scanning with nmap, Services
- tcpdump, PCAP analysis with, PCAP Analysis
- teams
- technologies
- telnet, Services
- template policies, Topics
- Teredo, IPv6: A Cautionary Note
- Terminal Access Controller Access-Control System Plus, TACACS+
- testing, Testing-Peer Review
- third-party applications
- third-party patches for Windows infrastructure, Third-Party Patches
- this year (milestones), Create Milestones
- threats
- time-based one time passwords (TOTP), How It Works
- tools and technology (IR), Tools and Technology-All in One
- training versus education, Broken Processes
- transferring risk, Mitigate
- trusts (Forest Trusts in AD), Forest
- tshark (command-line Wireshark), PCAP Analysis
- tunneling protocols, devices prebuilt to use, IPv6: A Cautionary Note
- Twitter, AP Twitter hack, Why 2FA?
- two-factor authentication (2FA), Multifactor Authentication-Where It Should Be Implemented
U
- U2F (Universal 2nd factor), How It Works
- UDP ports, scanning with nmap, Services
- umask settings (Unix systems), File permissions
- unauthenticated vulnerability scans, Authenticated versus Unauthenticated Scans
- Unix application servers, Unix Application Servers-Conclusion
- Unix command-line tools, Log Analysis
- Unix-based operating systems
- updates
- upgrades
- US Department of Health and Human Services (HHS), Health Insurance Portability & Accountability Act, Healthcare
- use cases
- user access to data in disaster recovery, Security Considerations
- user accounts
- in Active Directory Domain Services, Accounts
- shared accounts, avoiding, Accounts
- user desks, physical security precautions, Restrict Access
- user education, User Education-Conclusion
- users
V
- validation of user input, Secure Coding Guidelines
- vendor-supplied ratings for vulnerabilities, Remediation Prioritization
- video surveillance, Video Surveillance
- virtual environments
- visibility (endpoint), Endpoint Visibility
- visitors, physical security measures for, Identify Visitors and Contractors
- VLAN hopping attacks, Switches
- VLANs (Virtual Local Area Networks), Switches, Logical
- benefits of, VLANs
- planning, approaches to, VLANs
- separation of devices by NACs, NACs
- voice signature, 2FA Methods
- Volatility Framework, Memory Analysis
- VPNs (virtual private networks), VPNs
- IPSec
- advantages of, VPNs
- security considerations, VPNs
- secure setup, VPNs
- SSL/TLS
- advantages of, VPNs
- security considerations, VPNs
- vulnerabilities
- vulnerability management, Vulnerability Management-Conclusion
W
- warm standby, Warm Standby
- weaponization (in Intrusion Kill Chain), Use Cases, Tabletops, and Drills
- web applications, segmentation, Application
- web browsers
- web servers, Payment Card Industry Data Security Standard (PCI DSS)
- websites for OSINT gathering, Websites-Websites
- Windows Authentication mode (SQL Server), MS SQL Authentication
- Windows infrastructure, Microsoft Windows Infrastructure-Conclusion
- Windows Server 2008 Native Mode, Setting a Fine-Grained Password Policy
- Windows Server Update Services (WSUS), Third-Party Patches
- Windows systems
- built-in firewall, Desktop Firewalls
- disabling services, Disable Services
- Event Viewer, Where to Log
- full-drive encryption, using BitLocker, Full-Disk Encryption
- keeping endpoints up to date, Microsoft Windows
- PowerShell, Information Gathering
- security vulnerability, mapping anonymous session to hidden share IPC$, Password Storage Locations and Methods
- Windows Management Interface (WMI), Information Gathering
- Windows Update for Business, Microsoft Windows
- Windows Update service, Microsoft Windows
- wiping data from drives, Defining the Lifecycle
- wireless protocols, transmission of PCI DSS data over, Payment Card Industry Data Security Standard (PCI DSS)
- Wireshark
- WMI (Windows Management Interface), Information Gathering
- workspaces (recon-ng), recon-ng
Defensive Security Handbook, 1st Edition
Published by
O'Reilly Media, Inc., 2017