Windows Ransomware Detection and Protection: Securing Windows endpoints, the cloud, and infrastructure using Microsoft Intune, Sentinel, and Defender
- Length: 290 pages
- Edition: 1
- Language: English
- Publisher: Packt Publishing
- Publication Date: 2023-03-17
- ISBN-10: 1803246340
- ISBN-13: 9781803246345
- Sales Rank: #2559885 (See Top 100 Books)
Protect your end users and IT infrastructure against common ransomware attack vectors and efficiently monitor future threats
Purchase of the print or Kindle book includes a free PDF eBook
Key Features
- Learn to build security monitoring solutions based on Microsoft 365 and Sentinel
- Understand how Zero-Trust access and SASE services can help in mitigating risks
- Build a secure foundation for Windows endpoints, email, infrastructure, and cloud services
Book Description
If you’re looking for an effective way to secure your environment against ransomware attacks, this is the book for you. From teaching you how to monitor security threats to establishing countermeasures to protect against ransomware attacks, Windows Ransomware Detection and Protection has it all covered.
The book begins by helping you understand how ransomware attacks work, identifying different attack vectors, and showing you how to build a secure network foundation and Windows environment. You’ll then explore ransomware countermeasures in different segments, such as Identity and Access Management, networking, Endpoint Manager, cloud, and infrastructure, and learn how to protect against attacks. As you move forward, you’ll get to grips with the forensics involved in making important considerations when your system is attacked or compromised with ransomware, the steps you should follow, and how you can monitor the threat landscape for future threats by exploring different online data sources and building processes.
By the end of this ransomware book, you’ll have learned how configuration settings and scripts can be used to protect Windows from ransomware attacks with 50 tips on security settings to secure your Windows workload.
What you will learn
- Understand how ransomware has evolved into a larger threat
- Secure identity-based access using services like multifactor authentication
- Enrich data with threat intelligence and other external data sources
- Protect devices with Microsoft Defender and Network Protection
- Find out how to secure users in Active Directory and Azure Active Directory
- Secure your Windows endpoints using Endpoint Manager
- Design network architecture in Azure to reduce the risk of lateral movement
Who this book is for
This book is for Windows administrators, cloud administrators, CISOs, and blue team members looking to understand the ransomware problem, how attackers execute intrusions, and how you can use the techniques to counteract attacks. Security administrators who want more insights into how they can secure their environment will also find this book useful. Basic Windows and cloud experience is needed to understand the concepts in this book.
Cover Title Page Copyright and Credits Contributors About the reviewers Table of Contents Preface Part 1: Ransomware Basics Chapter 1: Ransomware Attack Vectors and the Threat Landscape Evolution of ransomware Attack vectors Exploiting known vulnerabilities Access through credential stuffing Access through brute-force attacks Access through a compromised workstation or end user machine How does ransomware work? Diavol ransomware Conti ransomware Sodinokibi/REvil ransomware LockBit ransomware The latest additions Looking at the big picture Identity-based attacks How are vulnerabilities utilized for attacks? Monitoring vulnerabilities Summary Chapter 2: Building a Secure Foundation Zero-trust design principles Identity pillar – zero-trust maturity Device pillar – zero-trust maturity Network pillar – zero-trust maturity Application pillar – zero-trust maturity Data pillar – zero-trust maturity Network access Vulnerability and patch management Vulnerability management example for PrintNightmare Identity and access control User life cycle management Ensuring strong passwords and authentication methods Role-based access control and using least privilege Security logging and monitoring A secure foundation within Microsoft Azure Summary Part 2: Protect and Detect Chapter 3: Security Monitoring Using Microsoft Sentinel and Defender Technical requirements Understanding Microsoft Sentinel and Microsoft Defender Designing and implementing Microsoft Sentinel Collecting logs and data sources Performing Kusto and log queries Seeing the full picture Creating analytics rules and handling incidents Analytics rules Ransomware detection – looking for initial compromise Detecting vulnerabilities with Defender Summary Chapter 4: Ransomware Countermeasures – Windows Endpoints, Identity, and SaaS Technical requirements Securing endpoints ASR rules Microsoft Defender and antimalware Update management Securing Microsoft Office apps Securing the web browser Other miscellaneous endpoint countermeasures DNS filtering PowerShell SMB protocol LOLBins Default applications Securing user identity Securing Active Directory Securing email services Protecting the domains Protecting the content and URLs Other countermeasures Summary Chapter 5: Ransomware Countermeasures – Microsoft Azure Workloads Technical requirements Network segmentation and design Identity and access management in Microsoft Azure Hub-and-spoke virtual networks The anatomy of a VM in Azure Microsoft Defender for Servers Azure Policy Azure Backup Overall recommendations for Azure-based workloads Summary Chapter 6: Ransomware Countermeasures – Networking and Zero-Trust Access Attackers and lateral movement Providing users with secure access to services Microsoft Citrix Cloudflare SASE File access Remote management services DDoS protection Summary Chapter 7: Protecting Information Using Azure Information Protection and Data Protection Technical requirements Data exfiltration Data classification Azure Information Protection DLP features and the future of AIP Encryption on SQL Server Best practices for backups and data protection Summary Part 3: Assume Breach Chapter 8: Ransomware Forensics You got ransomware, now what? Phase one – validating an alert Phase two – discovering the impact Phase three – understanding the attack vector and what to look for A manual approach An automatic approach Closing the door Summary Chapter 9: Monitoring the Threat Landscape How to monitor the threat landscape Threat management What does the future hold? Summary Chapter 10: Best Practices for Protecting Windows from Ransomware Attacks Best practices and security settings in Windows Remote desktop management Administrative shares LAPS and restrict usage of local accounts Windows Firewall best practices Tamper Protection Automatic patching of infrastructure File Server Resource Manager and file groups Other top tips to protect against ransomware Summary Index Other Books You May Enjoy
Donate to keep this site alive
How to download source code?
1. Go to: https://github.com/PacktPublishing
2. In the Find a repository… box, search the book title: Windows Ransomware Detection and Protection: Securing Windows endpoints, the cloud, and infrastructure using Microsoft Intune, Sentinel, and Defender, sometime you may not get the results, please search the main title.
3. Click the book title in the search results.
3. Click Code to download.
1. Disable the AdBlock plugin. Otherwise, you may not get any links.
2. Solve the CAPTCHA.
3. Click download link.
4. Lead to download server to download.
