Mastering Windows Security and Hardening

Secure and protect your Windows environment from intruders, malware attacks, and other cyber threats

Mark Dunkerley , Matt Tumbarello 지음

Packt(GCO Science) 2020년 07월 08일 출간

작품소개

책소개

Enhance Windows security and protect your systems and servers from various cyber attacks

▶Book Description
Are you looking for effective ways to protect Windows-based systems from being compromised by unauthorized users?

Mastering Windows Security and Hardening is a detailed guide that helps you gain expertise when implementing efficient security measures and creating robust defense solutions.

We will begin with an introduction to Windows security fundamentals, baselining, and the importance of building a baseline for an organization. As you advance, you will learn how to effectively secure and harden your Windows-based system, protect identities, and even manage access. In the concluding chapters, the book will take you through testing, monitoring, and security operations. In addition to this, you'll be equipped with the tools you need to ensure compliance and continuous monitoring through security operations.

By the end of this book, you'll have developed a full understanding of the processes and tools involved in securing and hardening your Windows environment.

▶What You Will Learn
-Understand baselining and learn the best practices for building a baseline
-Get to grips with identity management and access management on Windows-based systems
-Delve into the device administration and remote management of Windows-based systems
-Explore security tips to harden your Windows server and keep clients secure
-Audit, assess, and test to ensure controls are successfully applied and enforced
-Monitor and report activities to stay on top of vulnerabilities

▶Key Features
-Protect your device using a zero-trust approach and advanced security techniques
-Implement efficient security measures using Microsoft Intune, Configuration Manager, and Azure solutions
-Understand how to create cyber-threat defense solutions effectively

▶Who This Book Is For
This book is for system administrators, cybersecurity and technology professionals, solutions architects, or anyone interested in learning how to secure their Windows-based systems. A basic understanding of Windows security concepts, Intune, Configuration Manager, Windows PowerShell, and Microsoft Azure will help you get the best out of this book.

목차

▶TABLE of CONTENTS
▷Section 1: Getting Started
-Chapter 1: Fundamentals of Windows Security
-Chapter 2: Building a Baseline
-Chapter 3: Server Infrastructure Management
-Chapter 4: End User Device Management

▷Section 2: Applying Security and Hardening
-Chapter 5: Hardware and Virtualization
-Chapter 6: Network Fundamentals for Hardening Windows
-Chapter 7: Identity and Access Management
-Chapter 8: Administration and Remote Management
-Chapter 9: Keeping Your Windows Client Secure
-Chapter 10: Keeping Your Windows Server Secure

▷Section 3: Protecting, Detecting, and Responding for Windows Environments
-Chapter 11: Security Monitoring and Reporting
-Chapter 12: Security Operations
-Chapter 13: Testing and Auditing
-Chapter 14: Top 10 Recommendations and the Future

책 속으로

▶What this book covers
- Chapter 1, Fundamentals of Windows Security, provides an introduction to the security world within IT and enterprises. We will cover how security is transforming the way we manage technology and discuss threats and breaches that are relevant today. We will look at current challenges and discuss a concept known as zero trust.

- Chapter 2, Building a Baseline, provides an overview of baselining and the importance of building a standard to be approved by leadership and adopted by everyone. We will cover what frameworks are and provide an overview of the more common frameworks for security and hardening an environment. We will then look at best practices within enterprises and cover the importance of change management to ensure that anything that falls outside the scope of policy receives the correct approvals.

- Chapter 3, Server Infrastructure Management, provides an overview of the data center and cloud models that are used today. We will then go into detail on each of the current models as they pertain to the cloud and review secure access management to Windows Server. We will also provide an overview of Windows Server management tools, as well as Azure services for managing Windows servers.

- Chapter 4, End User Device Management, provides an overview of the end user computing landscape. We will discuss the evolution of device management and review some major models that have emerged over the years. You will learn the importance of a centralized management solution as it pertains to security and how device management solutions are critical for a robust and compliant model. The management solutions covered include device imaging, Windows Autopilot, Microsoft Endpoint Configuration Manager (formerly SCCM), Intune Mobile Device Management (MDM), and Microsoft Endpoint Manager Admin Center.

- Chapter 5, Hardware and Virtualization, provides an overview of physical servers and virtualization. The chapter will cover hardware certification, enhancements in hardware security, and Virtualization-Based Security (VBS) concepts to secure and harden devices, including BIOS, UEFI, TPM 2.0, Secure Boot, and advanced protection with VBS.

- Chapter 6, Network Fundamentals for Hardening Windows, provides an overview of networking components and how they play a big role in hardening and securing your Windows environment. You will learn about Windows Defender Firewall and Advanced Security, Windows Defender Exploit Guard Network Protection, and how to configure them on your Windows devices. Additionally, you will be provided with the knowledge needed to understand the latest technology from Microsoft as it relates to network security for your Windows VMs in Azure.

- Chapter 7, Identity and Access Management, provides a comprehensive overview of identity management and the importance it plays in securing and hardening your Windows systems. Identity has become the foundation of securing users ？ this chapter will cover everything you need to do within the identity and access management area. We will provide more details on account and access management, authentication, MFA, passwordless authentication, conditional access, and identity protection.

- Chapter 8, Administration and Remote Management, provides details on different methods for administration and remote management as they relate to the Windows infrastructure. You will be provided with the knowledge needed to ensure that best practices are applied and will learn how to apply those best practices. The topics covered include enforcing policies with Configuration Manager and Intune, building security baselines, connecting securely to servers remotely, and an overview of PowerShell security.
...

출판사 서평

▶ Preface
Throughout this book, you will be provided with the knowledge needed to protect your Windows environment and the users that access it. It will cover a variety of topics that go beyond the hardening of just the operating system, including the management of devices, baselining, hardware, virtualization, networking, identity management, security operations, monitoring, auditing, and testing. The goal is to ensure that you understand the foundation of and multiple layers involved in providing improved protection for your Windows systems.

Since this is a book about security, it's important to understand what the core principles are that form an information security model and foundation. These principles are known as the CIA triad, which represents confidentiality, integrity, and availability. If you have pursued a security certification, such as the CISSP or Security +, certification for example, you will be very familiar with this model. If not, it is recommended that you familiarize yourself with it as a security professional. This book will not go into detail about the CIA triad but, as with any security, the concepts provided in this book will help you to ensure the confidentiality, integrity, and availability of information on the Windows systems you manage. At a high level, CIA represents the following:

？ Confidentiality involves ensuring that no one other than those authorized access information.
？ Integrity involves ensuring that the information being protected is original and has not been modified without the correct authorization.
？ Availability involves ensuring that information is always available when access is needed.

The book is split into three sections to help guide you and provide the understanding and knowledge needed to implement a solid Windows security foundation within your organization. The first section provides an overview of the fundamentals, including an overview of the management tools for the Windows server and client environment, and a review of the management models used to manage Windows systems and the importance of each of them. This section will also cover the concept of baselining and the importance of following a standard with defined procedures and processes that have leadership support and sign-off.

In the second section, we will dive into the technical aspects of what is needed to apply security and hardening to your Windows environment. This section will not only provide the technical details of how to harden both the Windows server and client OS, but we will review all the different management scenarios and the importance of administration and remote management from a security standpoint. Most importantly, ensuring secure administration and the remote management of your Windows systems is vital. We will review the networking components as they relate to the hardening of Windows and then provide information about identity and access management and how critical the protection of identity has become in the digital world today.

The final section provides more of an operational focus on how to best protect and monitor your Windows environment. It is critical for your security program to not only implement the recommended security controls but validate that controls are in place. To do this effectively, we need to perform auditing and testing against the configurations implemented to harden Windows environments. In addition, it's just as important to monitor environments and provide reporting. We will look at an in-depth overview of the security operations program and discuss the tools that can be used for efficient incident management.
...

작가정보

저자(글) Mark Dunkerley

Mark Dunkerley is a highly motivated and passionate technology leader. Mark was born in Newcastle Upon Tyne, UK, and resides in Orlando, Florida. He holds a bachelor's degree in business administration and a master's degree in business administration. He has worked in the technology field for 20 years and has experience in several technical areas. He has earned certifications from (ISC), AirWatch, Microsoft, CompTIA, VMware, AXELOS, Cisco, and EMC. Mark has been invited to speak at multiple conferences, including Microsoft and VMware events, is the author of Learning AirWatch published by Packt Publishing, and has published a number of case studies.

저자(글) Matt Tumbarello

Matt Tumbarello is a resident of Atlanta, Georgia, and a passionate solutions architect. He has been in the technology field for 15 years and has experience in working with products from Microsoft, VMware, Dell, and Citrix. He also has a background of working directly with Fortune 500 executives in a technical enablement role. Matthew was recently invited to Redmond and participates in Microsoft's Customer Connection program. He has published reviews for Azure security products, privileged access management tools, and mobile threat defense solutions. He also holds several Microsoft certifications.