Security eBooks
Python for Cybersecurity
Python For Cybersecurity: Using Python for Cyber Offense and Defense delivers an intuitive and hands-on explanation of using Python for cybersecurity. It relies on the MITRE ATT&CK framework to structure its exploration of cyberattack techniques, attack defenses, and the key cybersecurity challenges facing network administrators and other stakeholders today. Offering downloadable sample code, the book is written to help you discover how to use Python in a wide variety of cybersecurity situations, including: Reconnaissance, resource development, initial access, and execution; Persistence, privilege escalation, defense evasion, and credential access; Discovery, lateral movement, collection, and command and control; Exfiltration and impact. Each chapter includes discussions of several techniques and sub-techniques that could be used to achieve an attacker's objectives in any of these use cases. The ideal resource for anyone with a professional or personal interest in c ...
Python For Cybersecurity: Using Python for Cyber Offense and Defense delivers an intuitive and hands-on explanation of using Python for cybersecurity. It relies on the MITRE ATT&CK framework to structure its exploration of cyberattack techniques, attack defenses, and the key cybersecurity challenges facing network administrators and other stakeholders today. Offering downloadable sample code, the book is written to help you discover how to use Python in a wide variety of cybersecurity situations, including: Reconnaissance, resource development, initial access, and execution; Persistence, privilege escalation, defense evasion, and credential access; Discovery, lateral movement, collection, and command and control; Exfiltration and impact. Each chapter includes discussions of several techniques and sub-techniques that could be used to achieve an attacker's objectives in any of these use cases. The ideal resource for anyone with a professional or personal interest in c ...
Azure Cloud Security for Absolute Beginners
Implement cloud security with Azure security tools, configurations and policies that address the needs of businesses and governments alike. This book introduces you to the most important security solutions available in Azure and provides you with step-by-step guidance to effectively set up security and deploy an application on top of Azure platform services, as well as on top of Azure infrastructure. Author Pushpa Herath begins by teaching you the fundamentals of Azure security. An easy to follow exploration of management groups, subscriptions, management locks and Azure policies further elaborate the concepts underlying Azure cloud security. Next, you will learn about Azure Active Directory (AAD) and the utilization of AAD in application and infrastructure security. Essential aspects of maintaining secure application keys and certificates are further explained in the context of Azure Key Vault. New application security implementations such as Azur ...
Implement cloud security with Azure security tools, configurations and policies that address the needs of businesses and governments alike. This book introduces you to the most important security solutions available in Azure and provides you with step-by-step guidance to effectively set up security and deploy an application on top of Azure platform services, as well as on top of Azure infrastructure. Author Pushpa Herath begins by teaching you the fundamentals of Azure security. An easy to follow exploration of management groups, subscriptions, management locks and Azure policies further elaborate the concepts underlying Azure cloud security. Next, you will learn about Azure Active Directory (AAD) and the utilization of AAD in application and infrastructure security. Essential aspects of maintaining secure application keys and certificates are further explained in the context of Azure Key Vault. New application security implementations such as Azur ...
Mastering Kali Linux for Advanced Penetration Testing, 4th Edition
Remote working has given hackers plenty of opportunities as more confidential information is shared over the internet than ever before. In this new edition of Mastering Kali Linux for Advanced Penetration Testing, you'll learn an offensive approach to enhance your penetration testing skills by testing the sophisticated tactics employed by real hackers. You'll go through laboratory integration to cloud services so that you learn another dimension of exploitation that is typically forgotten during a penetration test. You'll explore different ways of installing and running Kali Linux in a VM and containerized environment and deploying vulnerable cloud services on AWS using containers, exploiting misconfigured S3 buckets to gain access to EC2 instances. This book delves into passive and active reconnaissance, from obtaining user information to large-scale port scanning. Building on this, different vulnerability assessments are explored, including threat modeling. See how hackers use lat ...
Remote working has given hackers plenty of opportunities as more confidential information is shared over the internet than ever before. In this new edition of Mastering Kali Linux for Advanced Penetration Testing, you'll learn an offensive approach to enhance your penetration testing skills by testing the sophisticated tactics employed by real hackers. You'll go through laboratory integration to cloud services so that you learn another dimension of exploitation that is typically forgotten during a penetration test. You'll explore different ways of installing and running Kali Linux in a VM and containerized environment and deploying vulnerable cloud services on AWS using containers, exploiting misconfigured S3 buckets to gain access to EC2 instances. This book delves into passive and active reconnaissance, from obtaining user information to large-scale port scanning. Building on this, different vulnerability assessments are explored, including threat modeling. See how hackers use lat ...
Taking Kubernetes from Test to Production
With Kubernetes came many new concepts, particularly around networking and traffic management. Alongside these new concepts were entirely new classes of tools, designed for ephemeral, containerized, and distributed application deployments. In particular, Ingress controllers and service meshes did not exist prior to the Kubernetes era. Nor were Layer 4 and Layer 7 protocols and traffic typically managed from the same control plane. At a granular level, Kubernetes introduces new complexities around security and management. Simple tasks like load balancing are very different in a realm where infrastructure is 100% ephemeral and often moving constantly - both in terms of setting up new instances with fresh IP addresses and geographically moving around the globe. These new traffic management concepts and tools have the power to vastly improve developer experience and accelerate app development and delivery cycles through greater resilience, higher performance, and better security. ...
With Kubernetes came many new concepts, particularly around networking and traffic management. Alongside these new concepts were entirely new classes of tools, designed for ephemeral, containerized, and distributed application deployments. In particular, Ingress controllers and service meshes did not exist prior to the Kubernetes era. Nor were Layer 4 and Layer 7 protocols and traffic typically managed from the same control plane. At a granular level, Kubernetes introduces new complexities around security and management. Simple tasks like load balancing are very different in a realm where infrastructure is 100% ephemeral and often moving constantly - both in terms of setting up new instances with fresh IP addresses and geographically moving around the globe. These new traffic management concepts and tools have the power to vastly improve developer experience and accelerate app development and delivery cycles through greater resilience, higher performance, and better security. ...
The Hardware Hacking Handbook
Embedded devices are chip-size microcomputers small enough to be included in the structure of the object they control, and they're everywhere - in phones, cars, credit cards, laptops, medical equipment, even critical infrastructure. This means understanding their security is critical. The Hardware Hacking Handbook takes you deep inside different types of embedded systems, revealing the designs, components, security limits, and reverse-engineering challenges you need to know for executing effective hardware attacks. Written with wit and infused with hands-on lab experiments, this handbook puts you in the role of an attacker interested in breaking security to do good. Starting with a crash course on the architecture of embedded devices, threat modeling, and attack trees, you'll go on to explore hardware interfaces, ports and communication protocols, electrical signaling, tips for analyzing firmware images, and more. Along the way, you'll use a home testing lab to ...
Embedded devices are chip-size microcomputers small enough to be included in the structure of the object they control, and they're everywhere - in phones, cars, credit cards, laptops, medical equipment, even critical infrastructure. This means understanding their security is critical. The Hardware Hacking Handbook takes you deep inside different types of embedded systems, revealing the designs, components, security limits, and reverse-engineering challenges you need to know for executing effective hardware attacks. Written with wit and infused with hands-on lab experiments, this handbook puts you in the role of an attacker interested in breaking security to do good. Starting with a crash course on the architecture of embedded devices, threat modeling, and attack trees, you'll go on to explore hardware interfaces, ports and communication protocols, electrical signaling, tips for analyzing firmware images, and more. Along the way, you'll use a home testing lab to ...
Full Stack Python Security
Full Stack Python Security: Cryptography, TLS, and attack resistance teaches you everything you'll need to build secure Python web applications. As you work through the insightful code snippets and engaging examples, you'll put security standards, best practices, and more into action. Along the way, you'll get exposure to important libraries and tools in the Python ecosystem. Security is a full-stack concern, encompassing user interfaces, APIs, web servers, network infrastructure, and everything in between. Master the powerful libraries, frameworks, and tools in the Python ecosystem and you can protect your systems top to bottom. Packed with realistic examples, lucid illustrations, and working code, this book shows you exactly how to secure Python-based web applications. Full Stack Python Security: Cryptography, TLS, and attack resistance teaches you everything you need to secure Python and Django-based web apps. In it, seasoned security pro Dennis Byrne demy ...
Full Stack Python Security: Cryptography, TLS, and attack resistance teaches you everything you'll need to build secure Python web applications. As you work through the insightful code snippets and engaging examples, you'll put security standards, best practices, and more into action. Along the way, you'll get exposure to important libraries and tools in the Python ecosystem. Security is a full-stack concern, encompassing user interfaces, APIs, web servers, network infrastructure, and everything in between. Master the powerful libraries, frameworks, and tools in the Python ecosystem and you can protect your systems top to bottom. Packed with realistic examples, lucid illustrations, and working code, this book shows you exactly how to secure Python-based web applications. Full Stack Python Security: Cryptography, TLS, and attack resistance teaches you everything you need to secure Python and Django-based web apps. In it, seasoned security pro Dennis Byrne demy ...
Adversarial Tradecraft in Cybersecurity
Little has been written about what to do when live hackers are on your system and running amok. Even experienced hackers tend to choke up when they realize the network defender has caught them and is zoning in on their implants in real time. This book will provide tips and tricks all along the kill chain of an attack, showing where hackers can have the upper hand in a live conflict and how defenders can outsmart them in this adversarial game of computer cat and mouse. This book contains two subsections in each chapter, specifically focusing on the offensive and defensive teams. It begins by introducing you to adversarial operations and principles of computer conflict where you will explore the core principles of deception, humanity, economy, and more about human-on-human conflicts. Additionally, you will understand everything from planning to setting up infrastructure and tooling that both sides should have in place. Throughout this book, you will learn how to gain an advantage ove ...
Little has been written about what to do when live hackers are on your system and running amok. Even experienced hackers tend to choke up when they realize the network defender has caught them and is zoning in on their implants in real time. This book will provide tips and tricks all along the kill chain of an attack, showing where hackers can have the upper hand in a live conflict and how defenders can outsmart them in this adversarial game of computer cat and mouse. This book contains two subsections in each chapter, specifically focusing on the offensive and defensive teams. It begins by introducing you to adversarial operations and principles of computer conflict where you will explore the core principles of deception, humanity, economy, and more about human-on-human conflicts. Additionally, you will understand everything from planning to setting up infrastructure and tooling that both sides should have in place. Throughout this book, you will learn how to gain an advantage ove ...
AWS Penetration Testing
Cloud security has always been treated as the highest priority by AWS while designing a robust cloud infrastructure. AWS has now extended its support to allow users and security experts to perform penetration tests on its environment. This has not only revealed a number of loopholes and brought vulnerable points in their existing system to the fore, but has also opened up opportunities for organizations to build a secure cloud environment. This book teaches you how to perform penetration tests in a controlled AWS environment. You'll begin by performing security assessments of major AWS resources such as Amazon EC2 instances, Amazon S3, Amazon API Gateway, and AWS Lambda. Throughout the course of this book, you'll also learn about specific tests such as exploiting applications, compromising Identity and Access Management (IAM) keys, testing permissions flaws, and discovering weak policies. Moving on, you'll discover how to establish private-cloud access through b ...
Cloud security has always been treated as the highest priority by AWS while designing a robust cloud infrastructure. AWS has now extended its support to allow users and security experts to perform penetration tests on its environment. This has not only revealed a number of loopholes and brought vulnerable points in their existing system to the fore, but has also opened up opportunities for organizations to build a secure cloud environment. This book teaches you how to perform penetration tests in a controlled AWS environment. You'll begin by performing security assessments of major AWS resources such as Amazon EC2 instances, Amazon S3, Amazon API Gateway, and AWS Lambda. Throughout the course of this book, you'll also learn about specific tests such as exploiting applications, compromising Identity and Access Management (IAM) keys, testing permissions flaws, and discovering weak policies. Moving on, you'll discover how to establish private-cloud access through b ...
Advanced ASP.NET Core 3 Security
Incorporate security best practices into ASP.NET Core. This book covers security-related features available within the framework, explains where these feature may fall short, and delves into security topics rarely covered elsewhere. Get ready to dive deep into ASP.NET Core 3.1 source code, clarifying how particular features work and addressing how to fix problems. For straightforward use cases, the ASP.NET Core framework does a good job in preventing certain types of attacks from happening. But for some types of attacks, or situations that are not straightforward, there is very little guidance available on how to safely implement solutions. And worse, there is a lot of bad advice online on how to implement functionality, be it encrypting unsafely hard-coded parameters that need to be generated at runtime, or articles which advocate for certain solutions that are vulnerable to obvious injection attacks. Even more concerning is the functions in ASP.NET Core that are not ...
Incorporate security best practices into ASP.NET Core. This book covers security-related features available within the framework, explains where these feature may fall short, and delves into security topics rarely covered elsewhere. Get ready to dive deep into ASP.NET Core 3.1 source code, clarifying how particular features work and addressing how to fix problems. For straightforward use cases, the ASP.NET Core framework does a good job in preventing certain types of attacks from happening. But for some types of attacks, or situations that are not straightforward, there is very little guidance available on how to safely implement solutions. And worse, there is a lot of bad advice online on how to implement functionality, be it encrypting unsafely hard-coded parameters that need to be generated at runtime, or articles which advocate for certain solutions that are vulnerable to obvious injection attacks. Even more concerning is the functions in ASP.NET Core that are not ...
Web Security for Developers
The world has changed. Today, every time you make a site live, you're opening it up to attack. A first-time developer can easily be discouraged by the difficulties involved with properly securing a website. But have hope: an army of security researchers is out there discovering, documenting, and fixing security flaws. Thankfully, the tools you'll need to secure your site are freely available and generally easy to use. Web Security for Developers will teach you how your websites are vulnerable to attack and how to protect them. Each chapter breaks down a major security vulnerability and explores a real-world attack, coupled with plenty of code to show you both the vulnerability and the fix. You'll learn how to: Protect against SQL injection attacks, malicious JavaScript, and cross-site request forgery; Add authentication and shape access control to protect accounts; Lock down user accounts to prevent attacks that rely on guessing passwords, stealing ...
The world has changed. Today, every time you make a site live, you're opening it up to attack. A first-time developer can easily be discouraged by the difficulties involved with properly securing a website. But have hope: an army of security researchers is out there discovering, documenting, and fixing security flaws. Thankfully, the tools you'll need to secure your site are freely available and generally easy to use. Web Security for Developers will teach you how your websites are vulnerable to attack and how to protect them. Each chapter breaks down a major security vulnerability and explores a real-world attack, coupled with plenty of code to show you both the vulnerability and the fix. You'll learn how to: Protect against SQL injection attacks, malicious JavaScript, and cross-site request forgery; Add authentication and shape access control to protect accounts; Lock down user accounts to prevent attacks that rely on guessing passwords, stealing ...
Microservices Security in Action
Unlike traditional enterprise applications, Microservices applications are collections of independent components that function as a system. Securing the messages, queues, and API endpoints requires new approaches to security both in the infrastructure and the code. Microservices Security in Action teaches you how to address microservices-specific security challenges throughout the system. This practical guide includes plentiful hands-on exercises using industry-leading open-source tools and examples using Java and Spring Boot. Integrating independent services into a single system presents special security challenges in a microservices deployment. With proper planning, however, you can build in security from the start. Learn to create secure services and protect application data throughout development and deployment. As microservices continue to change enterprise application systems, developers and architects must learn to integrate security ...
Unlike traditional enterprise applications, Microservices applications are collections of independent components that function as a system. Securing the messages, queues, and API endpoints requires new approaches to security both in the infrastructure and the code. Microservices Security in Action teaches you how to address microservices-specific security challenges throughout the system. This practical guide includes plentiful hands-on exercises using industry-leading open-source tools and examples using Java and Spring Boot. Integrating independent services into a single system presents special security challenges in a microservices deployment. With proper planning, however, you can build in security from the start. Learn to create secure services and protect application data throughout development and deployment. As microservices continue to change enterprise application systems, developers and architects must learn to integrate security ...