دانلود کتابچه راهنمای امنیت دفاعی – بهترین شیوه‌ها برای ایمن‌سازی زیرساخت‌ها – ویرایش دوم

Over the last decade, technology adoption has exploded worldwide and corporations have struggled to keep pace. Usability and revenue creation have been the key motivating factors, often ignoring the proactive design and security required for longterm stability. With the increase of breaking news hacks, record-breaking data leaks, and ransomware attacks, it is our job not only to scrape by with default installs but also to secure our data and assets to the best of our abilities. There will always be cases where you will walk into an environment that is a metaphorical train wreck with so many fires that you don’t even know where to start. This book will give you what you need to create a solid and secure design for the majority of situations that you may encounter. Modern attacks can occur for many different motivations and are perpetrated by people ranging from organized crime groups seeking to monetize breaches, through to hacktivists seeking to enact retribution on the organizations they deem to be immoral or counter to public interest. Whatever the motivation and whomever the attacker, a large number of attacks are organized and carried out by skilled individuals, often with funding. This change in landscape has led to many organizations engaging in a game of Info‐ Sec catch-up, often realizing that their information security program has either not received the executive backing that it required or simply never existed in the first place. These organizations are seeking to correct this and begin along the path to initiating or maturing their information security efforts. There is, however, a problem. Information security is an industry that is currently undergoing a period of negative unemployment; that is, there are more open positions than there are candidates to fill those positions. Hiring people is hard, and hiring good people is harder. For those seeking employment, this can be an advantageous situation; however, it is a high risk for employers seeking to hire someone for an information security position as they would be instilling a certain amount of trust with possible high-dollar assets in a new hire. A large number of issues encountered by companies with an immature information security program can be remedied, or at least vastly reduced, with some basic security hygiene. The knee-jerk reaction to the task of inheriting a new and immature security department can be to buy as many devices with pretty blinky LEDs as possible, in the hope that they will remedy issues. Some people would rather pay another company to set up an outsourcing agreement, which can be leveraged in order to assist. Both of these options require money. Many organizations that are new to information security do not have the budget to undertake either of these solutions to the problem— using the tools that are already in the environment may well be all you have. Our goal is to not only make this a standard that can be applied to most enterprise networks but also be a little entertaining to read along the way. There are already deep-dive standards out there from a variety of government and private organizations that can drone on and on about the validity of one security measure or the next. We want this to be an informative dialog backed by real-life experiences in the industry. There will be good policy, best practices, code snippets, screenshots, walkthroughs, and snark all mixed in together. We want to reach out to the masses—the net admins who can’t get approval to hire help; directors who want to know they aren’t the only ones fighting the battles that we see day in and day out; and the people who are getting their hands dirty in the trenches and aren’t even close to being ready to start down the path of reading whitepapers and RFCs. This book is designed to serve as a Security 101 handbook that is applicable to as many environments as possible, in order to drive maximum improvement in your security posture for the minimum financial spend. Types of positions that will be able to take away knowledge and actionable data from this include upper-level chief information officers (CIOs), directors, security analysts, systems administrators, and other technological roles.