دانلود کتاب مدافع فعال – غوطه ور شدن در طرز فکر امنیتی تهاجمی

In the early days of computing, neither the term cybersecurity nor the term information security existed. Instead, the original goals of computer security focused around government risk assessment, policy, and controls. By the mid-1980s, the ARPANET was expanding rapidly, the personal computer boom had begun, and companies were starting to use this thing called the Internet for communications, leading to concerns about security and privacy. At about the same time, some people were trying to gain access to what were then relatively primitive computer networks by nibbling mostly around the edges of equally primitive security measures. Sometimes their goal was just to see where they could go and what they could access. Others had more nefarious goals. Still others, however, had legal access via equipment located in their homes by virtue of a parent’s employment responsibilities, providing a fairly unusual early exposure to the technology of the time. I was one of these lucky people and this book is an indirect consequence of that exposure. Like many Gen-Xers, I was fortunate to have access to a personal computer in my home and at school from a very early age. However, unlike most children of that generation, my first foray into computing began not with a personal computer but with a mainframe terminal located in my house. We acquired this terminal as the result of my father taking a job running the college’s computing center in a small town in 1977. My earliest tinkering with this terminal involved mostly playing text-based games, such as Adventure, Zork, and Wumpus, but I also was able to use the early equivalent of instant messaging to chat with my father while he was at work. Uniquely, not only was there no telecom charge for the use of this terminal, there was no need to hear the screech of a modem, tie up the local phone line, or pay for the call, because terminal connectivity to the college was facilitated by a dry copper line. What I never realized was that this early exposure to the technology, which I took for granted, planted seeds that led me into an information security career. My interest in computer security started long before I was officially a member of a computer security team. My earliest involvement in computer security revolved around updating antivirus software and patching the Windows NT 4.0 machines I was responsible for supporting. Installing intrusion detection/ firewall software on servers was still a new concept, but it was a requirement on our systems that I had self-imposed. I was tenacious enough to prevent an outbreak of Nimda in our offices by returning to work after getting a tip to patch immediately. I also had the opportunity to learn the basics of incident response from a friend who had been attending SANS incident response training and was willing to share his knowledge. Over time, I became one of the people called when a machine was behaving strangely. Eventually, I took some formal training in digital forensics and landed my first job as an information security analyst. Always looking for an opportunity to grow my skills, I got involved with a cyber-defense course where I met my first offensive security practitioner. Intrigued by the experiences he shared with the group, I asked how I could learn more about offensive security. He recommended attending something called a Security BSides conference. I chose to attend BSidesROC (BSides Rochester), because it was the closest to my location. Not only did it open a whole new world to me, it also helped me realize what I had been missing as a defender. Today, I am one of the organizers of that conference.