دانلود کتاب مبانی امنیت سیستم ویندوز: اصول عملی برای کنترل هویت، دسترسی و فرآیند

Early-career professionals often need help to bridge the gap between academic and theoretical knowledge on one hand and the practical, hands-on, actionable skills needed when sitting at the keyboard. The purpose of this book is to lend a helping hand to readers learning cyber operations and developing security problem-solving skills. This is the result of 20 years of experience teaching hands-on cybersecurity courses to undergraduate and graduate students, many of whom have provided inspiration and feedback. The focus of this book is on the security of Windows systems and servers; it does not consider the configuration and security of Active Directory domains. Because Windows systems can and often use Active Directory for authentication and user management, these components of Active Directory are discussed as needed. The book starts with an introduction to PowerShell, which is commonly used by attackers and administrators. It covers features and configuration of PowerShell of interest to attackers and defenders, like how PowerShell history is recorded, how to create obfuscated PowerShell scripts, and how PowerShell manages credentials. The book continues with local and domain users and groups on Windows systems. When a user logs onto a Windows system, they go through the logon process and are assigned one (or two) access tokens; this is explained. Similarly, when a user wants to use administrative credentials or act as another user, they pass through User Account Control (UAC); this is also explained. Windows stores password hashes for local users in the Security Accounts Manager (SAM) database, while password hashes for domain users are in the Active Directory Data Store (ntds.dit). Privileged users can access these hashes, and attackers can crack the hashes with tools like John the Ripper. Windows grants rights and privileges based on a user’s group memberships; the text reviews these important local and domain groups as well as the individual rights and privileges. The Windows file system is covered, beginning with the basics, continuing with shortcuts, links, junctions, symbolic links, alternate data streams, and the Mark of the Web. Access control is described, including the techniques to view and modify Discretionary Access Control Lists (DACLs). The structure of the registry and tools to examine it are provided. Windows processes are examined, including tools to view and manage Windows processes. The notion of process integrity is described and related to UAC, and the key Windows boot processes are explained. Windows services and the tools to manage Windows services are described. The text includes more than 200 exercises at various levels of difficulty that can be used by an instructor using the book as a textbook or by a motivated reader who wants to practice the topics covered in the text. Readers should be familiar with Windows at a practical operational user level and should be familiar with Windows domains and domain controllers. The book assumes that the reader understands the basics of computer networking, including IP, TCP, and UDP. Readers are assumed to be competent programmers in a variety of languages; several are used throughout the text. I have found that American university computer science students in their third or fourth years well understand most of the required background. Readers should have access to Windows systems for testing and experimentation and to complete the various exercises. One way to build a testing laboratory is with virtualization. This allows users to emulate one or more complete systems, called guests, inside another, called the host.