Practical Cloud Security. 2nd Edition

Spis treści ebooka

• Preface
  • Who Should Read This Book
  • Navigating This Book
  • Whats New in the Second Edition
  • Conventions Used in This Book
  • OReilly Online Learning Platform
  • How to Contact Us
  • Acknowledgments
• 1. Principles and Concepts
  • Least Privilege
  • Defense in Depth
  • Zero Trust
  • Threat Actors, Diagrams, and Trust Boundaries
  • Cloud Service Delivery Models
  • The Cloud Shared Responsibility Model
  • Risk Management
  • Conclusion
  • Exercises
• 2. Data Asset Management and Protection
  • Data Identification and Classification
    • Example Data Classification Levels
    • Relevant Industry or Regulatory Requirements
  • Data Asset Management in the Cloud
  • Tagging Cloud Resources
  • Protecting Data in the Cloud
    • Tokenization
    • Encryption
      • Confidential computing
      • Encryption of data at rest
        • Key management
        • Server-side and client-side encryption
        • Cryptographic erasure
      • How encryption foils different types of attacks
        • Disk-level encryption
        • Platform-level encryption
        • Application-level encryption
  • Conclusion
  • Exercises
• 3. Cloud Asset Management and Protection
  • Differences from Traditional IT
  • Types of Cloud Assets
    • Compute Assets
      • Virtual machines
      • Containers
        • Native container model
        • Mini-VM container model
        • Container orchestration systems
      • Application Platform as a Service
      • Serverless functions
    • Storage Assets
      • Block storage
      • File storage
      • Object storage
      • Images
      • Cloud databases
      • Message queues
      • Configuration storage
      • Secrets configuration storage
      • Encryption key storage
      • Certificate storage
      • Source code repositories and deployment pipelines
    • Network Assets
      • Virtual private clouds and subnets
      • Content delivery networks
      • DNS records
      • TLS certificates
      • Load balancers, reverse proxies, and web application firewalls
  • Asset Management Pipeline
    • Procurement Leaks
    • Processing Leaks
    • Tooling Leaks
    • Findings Leaks
  • Tagging Cloud Assets
  • Conclusion
  • Exercises
• 4. Identity and Access Management
  • Differences from Traditional IT
  • Life Cycle for Identity and Access
  • Request
  • Approve
  • Create, Delete, Grant, or Revoke
  • Authentication
    • Cloud IAM Identities
    • Business-to-Consumer and Business-to-Employee
    • Multi-Factor Authentication
    • Passwords, Passphrases, and API Keys
    • Shared IDs
    • Federated Identity
    • Single Sign-On
      • SAML and OIDC
      • SSO with legacy applications
    • Instance Metadata and Identity Documents
    • Secrets Management
  • Authorization
    • Centralized Authorization
    • Roles
  • Revalidate
  • Putting It All Together in the Sample Application
  • Conclusion
  • Exercises
• 5. Vulnerability Management
  • Differences from Traditional IT
  • Vulnerable Areas
    • Data Access
    • Application
    • Middleware
    • Operating System
    • Network
    • Virtualized Infrastructure
    • Physical Infrastructure
  • Finding and Fixing Vulnerabilities
    • Network Vulnerability Scanners
    • Agentless Scanners and Configuration Management Systems
    • Agent-Based Scanners and Configuration Management Systems
      • Credentials
      • Deployment
      • Network
      • Least privilege
      • Choosing an agent-based or agentless scanner
    • Cloud Workload Protection Platforms
    • Container Scanners
    • Dynamic Application Scanners (DAST)
    • Static Application Scanners (SAST)
    • Software Composition Analysis Tools (SCA)
    • Interactive Application Scanners (IAST)
    • Runtime Application Self-Protection Scanners (RASP)
    • Manual Code Reviews
    • Penetration Tests
    • User Reports
    • Example Tools for Vulnerability and Configuration Management
  • Risk Management Processes
  • Vulnerability Management Metrics
    • Tool Coverage
    • Mean Time to Remediate
    • Systems/Applications with Open Vulnerabilities
    • Percentage of False Positives
    • Percentage of False Negatives
    • Vulnerability Recurrence Rate
  • Change Management
  • Putting It All Together in the Sample Application
  • Conclusion
  • Exercises
• 6. Network Security
  • Differences from Traditional IT
  • Concepts and Definitions
    • Zero Trust Networking
    • Allowlists and Denylists
    • DMZs
    • Proxies
    • Software-Defined Networking
    • Network Functions Virtualization
    • Overlay Networks and Encapsulation
    • Virtual Private Clouds
    • Network Address Translation
    • IPv6
  • Network Defense in Action in the Sample Application
    • Encryption in Motion
    • Firewalls and Network Segmentation
      • Perimeter control
      • Internal segmentation
      • Security groups
      • Service endpoints
      • Container firewalling and network segmentation
    • Allowing Administrative Access
      • Bastion hosts
      • Virtual private networks
      • Site-to-site VPNs
      • Client-to-site VPNs
    • Network Defense Tools
      • Web application firewalls
      • RASP modules
      • Anti-DDoS
      • Intrusion detection and prevention systems
    • Egress Filtering
    • Data Loss Prevention
  • Conclusion
  • Exercises
• 7. Detecting, Responding to, and Recovering from Security Incidents
  • Differences from Traditional IT
  • What to Watch
    • Privileged User Access
    • Logs from Defensive Tooling
      • Anti-DDoS
      • Web application firewalls
      • Firewalls and intrusion detection systems
      • Antivirus
      • Detection and response tools
      • File integrity monitoring
      • Cloud provider monitoring tools
    • Cloud Service Logs and Metrics
    • Operating System Logs and Metrics
    • Middleware Logs
    • Secrets Server
    • Your Application
  • How to Watch
    • Aggregation and Retention
    • Parsing Logs
    • Searching and Correlation
    • Alerting and Automated Response
    • Security Information and Event Managers
    • Threat Hunting
  • Preparing for an Incident
    • Team
    • Plans
    • Tools
  • Responding to an Incident
    • Cyber Kill Chains and MITRE ATT&CK
    • The OODA Loop
    • Cloud Forensics
    • Blocking Unauthorized Access
    • Stopping Data Exfiltration and Command and Control
  • Recovery
    • Redeploying IT Systems
    • Notifications
    • Lessons Learned
  • Example Metrics
  • Example Tools for Detection, Response, and Recovery
  • Detection and Response in a Sample Application
    • Monitoring the Protective Systems
    • Monitoring the Application
    • Monitoring the Administrators
    • Understanding the Auditing Infrastructure
  • Conclusion
  • Exercises
• A. Exercise Solutions
  • Chapter 1
  • Chapter 2
  • Chapter 3
  • Chapter 4
  • Chapter 5
  • Chapter 6
  • Chapter 7
• Index

pokaż cały spis treści

ukryj recenzje