Investigating the Cyber Breach The Digital Forensics Guide for the Network Engineer

by Muniz, Joseph; Lakhani, Aamir

• ISBN13: 9781587145025
• ISBN10: 1587145022
• Edition: 1st
• Format: Paperback
• Copyright: 2018-02-07
• Publisher: Cisco Press

Summary

Today, cybersecurity professionals recognize that they can’t possibly prevent every breach, but they can substantially reduce risk by quickly identifying and blocking breaches as they happen. Investigating The Cyber Breach: The Digital Forensics Guide for the Network Engineer is the first comprehensive guide to doing just that. Writing for working networking and security professionals, senior cybersecurity experts Joseph Muñiz and Aamir Lakhani show exactly how to hunt attackers, track their movements within networks, and halt their data exfiltration and thefts of intellectual property. Muñiz and Lakhani show how to use tools ranging from open source software to enterprise solutions: tools for cloning, data analytics, network and endpoint breach detection, case management, monitoring, analysis, and more. Unlike previous digital forensics books focused primarily on collecting evidence for later prosecution, this one focuses on using digital forensics tools to hunt threats, improve threat intelligence, root out dormant malware, and respond quickly and effectively to network compromises happening right now.

Author Biography

Joseph Muniz is an architect at Cisco Systems and a security researcher. He has extensive experience in designing security solutions and architectures for the top Fortune 500 corporations and the U.S. government. Joseph’s current role gives him visibility into the latest trends in cybersecurity, from both leading vendors and customers. Examples of Joseph’s research include his RSA talk titled “Social Media Deception,” which has been quoted by many sources (search for “Emily Williams Social Engineering”), as well as his articles in PenTest Magazine regarding various security topics. Joseph runs The Security Blogger website, a popular resource for security, hacking, and product implementation. He is the author and contributor of several publications covering various penetration testing, certification, and security topics. You can follow Joseph at www.thesecurityblogger.com and @SecureBlogger.

Aamir Lakhani is a leading senior security strategist. He is responsible for providing IT security solutions to major enterprises and government organizations. Aamir creates technical security strategies and leads security implementation projects for Fortune 500 companies. Industries of focus include healthcare providers, educational institutions, financial institutions, and government organizations. He has designed offensive counter-defense measures for the Department of Defense and national intelligence agencies. He has also assisted organizations with safeguarding IT and physical environments from attacks perpetrated by underground cybercriminal groups. Aamir is considered an industry leader for creating detailed security architectures within complex computing environments. His areas of expertise include cyber defense, mobile application threats, malware management, Advanced Persistent Threat (APT) research, and investigations relating to the Internet’s dark security movement.

Table of Contents

1. Cyber Crime and Defenses
2. Digital Forensics
3. Building a Lab
4. Investigations
5. Collecting and Preserving Evidence
6. Windows File Forensics
7. Network Forensics
8. Mobile Device and Web
9. Cisco Security Forensic Capabilities
10. Case Study and Wrap-Up