Reverse Deception: Organized Cyber Threat Counter-Exploitation by Sean Bodmer Page B

However, that is what security teams and security policies were created for: providing a safe, operationally viable network that has high confidentiality, integrity, and availability. When dealing with enterprise networks, you can easily get lost in policies and laws, and may feel unable to be understood by your leadership.
    For the purpose of this book, we are going to put all of the politics aside and concentrate on the possible and effective. You need to absorb these concepts and best practices, and begin working out how you can integrate these TTP into your daily workflow, team roles, and budget.
    If you read this book thoroughly, you will walk away with the knowledge only a few of us exercise daily. However, you do need a good understanding of all the pieces and players. We all face threats working in our modern world overloaded with technology, and only a few of these technologies actually help us detect and thwart adversaries attempting to access and operate within our networks for personal or professional gains.
    All host-based antivirus platforms and threat-prevention systems provide a level of security geared toward the average threats and are always playing catch-up . An antivirus firm needs a sample of malware prior to generating a signature to detect that variant or family of malware, and that could take days to weeks. By that time, your threat or adversary has already come, gone, and installed a new backdoor. Almost every traditional network security appliance can be bypassed by advanced and persistent threats. Only a handful of network security platforms have attempted to actually integrate persistent threat detection and early warning into an actionable model. We will introduce methods and procedures for integrating specific systems and tools in a fashion that can be used to turn our practices into repeatable processes. Our goal is also to demonstrate how to update and educate stakeholders of enterprise networks in order to better defend themselves with a little passive aggression.

    What This Book Covers
    Do you fret over the integrity of your network? Read this book if you are interested in not only defense, but also engagement and counter exploitation of active threats in your network. Those seeking knowledge and wisdom surrounding the domains of network security, cyber law, threat mitigation, and proactive security, and most important, those working in or a part of the cyber world, should read this book. It has been written to cater to all audiences, ranging from managers to technicians.
    Our book is meant to inform, advise, and provide a train of thought to follow when your network is under threat and is assumed under the control of a remote entity. This book will walk you through the ecosystem of targeted and opportunistic criminals, where they commune, and how to engage them from inside the legal boundary of your own network. You’ll learn which tools and techniques are available to interact or game them using the principles of counterintelligence and operational deception. We also provide you with several accepted techniques for analyzing and characterizing (profiling) cyber threats operating against your network. And we cover one of the most ignored aspects of countering cyber threats: operationally vetted legal guidance from a cyber lawyer.
    This book is meant to be a tome of best practices and wisdom of tools, tactics, and techniques that have and are being used to actively counter opportunistic and targeted cyber threats. Please treat this book as if one of us were in the room discussing with you the options available when you are faced with an intrusion.
    This comprehensive guide is designed for the IT security professional, but the information is communicated in clear language so that laymen can understand the examples presented. The book will enable you to identify, detect, diagnose, and react with appropriate prioritized actions. It explains how IT security professionals can identify these new,