2022版《精通Windows安全强化》：零信任原则守护网络安全

需积分: 5 12 浏览量更新于2024-06-14 收藏 20.86MB PDF 举报

"《精通Windows安全与强化第二版》是一本2022年出版的专业书籍，专为深入理解和提升Windows环境的安全性而设计。该书由Mark Dunkerley和Matt Tumbarello两位专家共同编撰，涵盖了如何利用零信任安全原则来保护系统免受网络威胁的实战指导。在《Mastering Windows Security and Hardening Second Edition》中，作者详细讲解了Windows操作系统的核心安全策略，包括但不限于用户身份验证、权限管理、防火墙配置、恶意软件防护以及最新的安全补丁和更新。书中内容旨在帮助读者建立一个坚固的防御体系，确保数据和系统的完整性，抵御诸如勒索软件、黑客攻击和内部威胁等现代网络安全挑战。作者强调，随着技术的发展，传统的安全模型已经不足以应对日益复杂的威胁环境，零信任原则成为了一个关键概念，它主张在未验证用户身份和授权之前，所有对系统的访问都应该被严格限制。通过本书，读者可以掌握如何在Windows环境中实施零信任原则，以及如何通过审计、监控和响应机制来及时发现并应对潜在威胁。版权方面，所有权利归Packt Publishing所有，未经出版商书面许可，不得复制、存储或通过任何形式或媒介传播书中的内容，除非用于批评性文章或评论。尽管出版社已尽力确保信息的准确性，但本书提供的信息是无担保的，作者和出版社不对因本书内容导致的直接或间接损失负责。值得注意的是，Packt Publishing在书中对提及的所有公司和产品商标进行了规范标注，体现了其尊重知识产权的态度。通过阅读这本书，无论是专业安全人员还是系统管理员，都将收获实用且最新的Windows安全知识，以便在实际工作中更好地保护企业资产和用户隐私。"

Preface

roughout this book, you will be provided with the knowledge needed to protect your

Windows environment and the users that access it. e book will cover a variety of topics

that go beyond the hardening of just the operating system to include the management of

devices, baselining, hardware, virtualization, networking, identity management, security

operations, monitoring, auditing, and testing. e goal is to ensure that you understand

the foundation of, and multiple layers involved in, providing improved protection for your

Windows systems.

Since this book focuses on security, it's important to understand the core principles that

form an information security model. ese principles are known as the CIA triad, which

stands for condentiality, integrity, and availability. If you have pursued a security

certication, such as the CISSP or Security+ certications, you will be very familiar with

this model. If not, it is recommended that you familiarize yourself with them as a security

professional. is book will not go into detail about the CIA triad, but the concepts

provided in this book will support the foundation of ensuring the condentiality, integrity,

and availability of information on the Windows systems you manage. At a high level, CIA

means the following:

• Condentiality involves ensuring that no one other than those who are authorized

to can access information.

• Integrity involves ensuring that the information being protected is original and has

not been modied without the correct authorization.

• Availability involves ensuring that information is always available when access

is needed.

is book is split into three sections to help guide you and provide the understanding and

knowledge that's needed to implement a solid Windows security foundation within your

organization. e rst section will cover getting started and foundations for Windows

security. e second section will focus on applying security and hardening with the third

section providing information to protect, detect, and respond for Windows environments.

Preface xvii

Chapter 5, Identity and Access Management, provides a comprehensive overview of

identity management and the importance it plays in securing Windows systems. Identity

has become the foundation of securing users – this chapter will cover everything you need

to do within the identity and access management area. We will provide details on account

and access management, authentication, MFA, passwordless authentication, conditional-

based access controls, and identity protection.

Chapter 6, Administration and Policy Management, provides details about dierent

methods for the administration and modern management of Windows endpoints. You

will be provided with the knowledge needed to ensure best practices are applied, looking

at topics around enforcing policies and security baselines with Conguration Manager

and Intune.

Chapter 7, Deploying Windows Securely, provides an overview of the end user computing

landscape. We will discuss device provisioning, upgrading Windows, and building

hardening images. You will learn about modern methods used to deploy Windows

using Intune and Windows Autopilot and deploying images in virtualized Windows

environments.

Chapter 8, Keeping Your Windows Client Secure, covers Windows clients and the concepts

used to keep them secure and updated. You will learn how to stay updated with Windows

Updates for Business, protect data with BitLocker encryption, enable passwordless sign-in

with Windows Hello for Business, and how to enforce policies, congurations, and

security baselines.

Chapter 9, Advanced Hardening for Windows Clients, provides a comprehensive review

of advanced hardening congurations that are applied to Windows clients to protect

enterprise browsers, secure Microso 365 apps, and apply zero-trust security principals

to reduce the attack surface. You will learn advanced techniques for applying policies to

third-party products using Intune, how to enable advanced features of Microso Defender

to protect against unwanted apps and ransomware, and how to enable hardware-based

virtualized isolation for Microso Edge and Oce. You will also learn how to enable a

removable storage access control policy to protect against data loss with removable media.

Chapter 10, Mitigating Common Attack Vectors, covers common attack techniques used by

attackers to intercept communications and try to move laterally throughout the network.

You will learn about dierent types of adversary-in-the-middle attacks and how to prevent

them, as well as ways to protect against lateral movement and privilege escalation through

Kerberos tickets. You will also learn about using Windows privacy settings to safeguard

users' privacy from apps and services that run on Windows clients.

xviii Preface

Chapter 11, Server Infrastructure Management, provides an overview of the data center

and cloud models that are used today. We will then go into detail on each of the current

models as they pertain to the cloud and review secure access management to Windows

Server. We will also provide an overview of Windows Server management tools, as well

as Azure services for managing Windows servers.

Chapter 12, Keeping Your Windows Server Secure, looks at the Windows Server OS and

introduces server roles and the security-related features of Windows Server 2022. You will

learn about the techniques used to keep your Windows Server secure by implementing

Windows Server Update Services (WSUS), Azure Update Management, onboarding

machines to Microso Defender for Endpoint, and enforcing a security baseline. You will

also learn how to implement application control policies and PowerShell security.

Chapter 13, Security Monitoring and Reporting, talks about the dierent tools available

to collect telemetry data, as well as insights and recommendations for securing your

environment. is chapter will inform you about the ways in which to act on these

recommendations. e technologies covered include Microso Defender for Endpoint,

Azure Log Analytics, Azure Monitor, and Microso Defender for Cloud.

Chapter 14, Security Operations, talks about the security operations center (SOC) in an

organization and discusses the various tools used to ingest and analyze data to detect,

protect, and alert you to incidents. e technologies covered include Extended Detection

and Response (XDR), the Microso 365 Defender Portal, Microso Defender for Cloud

Apps, Defender for Cloud, Microso Sentinel, and Microso Defender Security Center.

is chapter also talks about data protection with Microso 365 and the importance of

ensuring that up-to-date business continuity and disaster recovery plans are in place.

Chapter 15, Testing and Auditing, discusses validating that controls are in place and

enforced. You will learn about the importance of continual vulnerability scanning and the

importance of penetration testing to ensure that the environment is assessed in terms of

protecting against the latest threats.

Chapter 16, Top 10 Recommendations and the Future, provides recommendations and

actions to take away aer reading this book. It also provides some insight into the

direction that device security and management is headed, as well as insights into our

thoughts on the importance of security in the future.

Preface xix

To get the most out of this book

We will primarily focus on the most current versions of Windows available today,

including Windows Server 2022, Windows 11, and the resources available within

Microso Azure. We understand migrating to the latest Windows OS and shiing

workloads from on-premises to the cloud is not an overnight task and may take

years. In general, the concepts we provide throughout this book can be used within

most congurations of Windows but could vary slightly depending on the build or

version. Upgrading to the latest supported versions of Windows is critical to provide

for the eective hardening of your systems and should be a driving factor to push your

migrations forward. It is strongly encouraged to upgrade as soon as possible as Microso

will no longer release security patches or oer support for deprecated versions.

To get the most out of this book, the following items will be needed to follow along with

any provided examples. anks to cloud technology, you will be able to quickly enable an

environment to build the infrastructure and foundation needed to support your journey

throughout this book.

It is recommended that you set up an Oce 365 subscription (add your own custom

domain), which will in turn create an Azure Active Directory (AAD) tenant. Once

the AAD tenant has been set up, this will allow you to add an Azure subscription

to begin consuming Azure resources tied to your Oce 365 subscription and your

custom domains.

Oce 365 E5 30-day free trial: https://go.microsoft.com/fwlink/

p/?LinkID=698279&culture=en-US&country=US

Azure Account with $200 credit for 30 days: https://azure.microsoft.com/

en-us/free/

Cloud subscriptions required:

• An Azure subscription

• Microso Enterprise E5 (M365 E5 includes Intune licensing, Microso Defender

for Endpoint, and Windows Enterprise)

• An Intune subscription and license

• Windows 10 E3 or E5

• Enterprise Mobility + Security E3 or E5 (includes Azure AD Premium P2)

剩余815页未读，继续阅读

jordan22

粉丝: 0
资源: 9

2022版《精通Windows安全强化》：零信任原则守护网络安全

Packt.Mastering.Windows.Security.and.Hardening.第二版

programming windows security第二版

Mastering Linux Security and Hardening

Mastering Windows PowerShell Scripting - Second Edition(pdf+epub).zip

Mastering-Linux-Shell-Scripting-Second-Edition:Packt出版的Mastering Linux Shell Scripting-Second Edition

Mastering-QGIS-Second-Edition:Packt出版的Mastering QGIS Second Edition

Mastering Embedded Linux Programming - Second Edition.zip

Mastering JavaScript Functional Programming, Second Edition.pdf

Mastering Embedded Linux Programming - Second Edition.pdf

Mastering Windows Server 2019, 2nd Edition.epub

最新资源