دانلود کتابچه راهنمای تیم آبی – واکنش به حوادث

A lot has changed in the years since the first edition of Blue Team Handbook: Incident Response (BTHb:INRE) was published in 2014. A few blue team–focused books have appeared; meanwhile, red team books still proliferate. If you are not familiar with these terms as they relate to cybersecurity, the blue team is charged with monitoring and defending the organization’s information systems—from endpoints to on-premises servers to cloud service providers to software as a service (SaaS)—and with ensuring that the endpoint uses all these resources securely. The red team has the task of behaving like an adversary, which involves external penetration testing and taking advantage of any successes to see how far it can get into the network, explore, and find valuable resources. Adversaries are effectively pummeling modern businesses and governments into digital submission, and as a result, BTHb:INRE must evolve. This edition features numerous updates. These include enhancements to the Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned (PICERL) incident response (IR) process; memory analysis quick steps; automation tools; Linux lsof; a Volatility 3 quick reference; and a new chapter on PowerShell for Windows. Many of the techniques described can be used in all phases of the IR process. It is my sincere desire that you will continue to gain value from the BTHb series and that this book will prove to be a reference you keep handy.