کتاب امنیت عملی ابری، ویرایش دوم

اصول و مفاهیم

Least Privilege • Defense in Depth • Zero Trust • Threat Actors, Diagrams, and Trust Boundaries • Cloud Service Delivery Models • The Cloud Shared Responsibility Model • Risk Management • Conclusion • Exercises

مدیریت و حفاظت از دارایی داده

Data Identification and Classification • Example Data Classification Levels • Relevant Industry or Regulatory Requirements • Data Asset Management in the Cloud • Tagging Cloud Resources • Protecting Data in the Cloud • Tokenization • Encryption • Conclusion • Exercises

مدیریت و حفاظت از دارایی ابری

Differences from Traditional IT • Types of Cloud Assets • Compute Assets • Storage Assets • Network Assets • Asset Management Pipeline • Procurement Leaks • Processing Leaks • Tooling Leaks • Findings Leaks • Tagging Cloud Assets • Conclusion • Exercises

مدیریت هویت و دسترسی

Differences from Traditional IT • Life Cycle for Identity and Access • Request • Approve • Create, Delete, Grant, or Revoke • Authentication • Cloud IAM Identities • Business-to-Consumer and Business-to-Employee • Multi-Factor Authentication • Passwords, Passphrases, and API Keys • Shared IDs • Federated Identity • Single Sign-On • Instance Metadata and Identity Documents • Secrets Management • Authorization • Centralized Authorization • Roles • Revalidate • Putting It All Together in the Sample Application • Conclusion • Exercises

مدیریت آسیب‌پذیری

Differences from Traditional IT • Vulnerable Areas • Data Access • Application • Middleware • Operating System • Network • Virtualized Infrastructure • Physical Infrastructure • Finding and Fixing Vulnerabilities • Network Vulnerability Scanners • Agentless Scanners and Configuration Management Systems • Agent-Based Scanners and Configuration Management Systems • Cloud Workload Protection Platforms • Container Scanners • Dynamic Application Scanners (DAST) • Static Application Scanners (SAST) • Software Composition Analysis Tools (SCA) • Interactive Application Scanners (IAST) • Runtime Application Self-Protection Scanners (RASP) • Manual Code Reviews • Penetration Tests • User Reports • Example Tools for Vulnerability and Configuration Management • Risk Management Processes • Vulnerability Management Metrics • Tool Coverage • Mean Time to Remediate • Systems/Applications with Open Vulnerabilities • Percentage of False Positives • Percentage of False Negatives • Vulnerability Recurrence Rate • Change Management • Putting It All Together in the Sample Application • Conclusion • Exercises

امنیت شبکه

Differences from Traditional IT • Concepts and Definitions • Zero Trust Networking • Allowlists and Denylists • DMZs • Proxies • Software-Defined Networking • Network Functions Virtualization • Overlay Networks and Encapsulation • Virtual Private Clouds • Network Address Translation • IPv6 • Network Defense in Action in the Sample Application • Encryption in Motion • Firewalls and Network Segmentation • Allowing Administrative Access • Network Defense Tools • Egress Filtering • Data Loss Prevention • Conclusion • Exercises

شناسایی، پاسخ و بازیابی از حوادث امنیتی

Differences from Traditional IT • What to Watch • Privileged User Access • Logs from Defensive Tooling • Cloud Service Logs and Metrics • Operating System Logs and Metrics • Middleware Logs • Secrets Server • Your Application • How to Watch • Aggregation and Retention • Parsing Logs • Searching and Correlation • Alerting and Automated Response • Security Information and Event Managers • Threat Hunting • Preparing for an Incident • Team • Plans • Tools • Responding to an Incident • Cyber Kill Chains and MITRE ATT&CK • The OODA Loop • Cloud Forensics • Blocking Unauthorized Access • Stopping Data Exfiltration and Command and Control • Recovery • Redeploying IT Systems • Notifications • Lessons Learned • Example Metrics • Example Tools for Detection, Response, and Recovery • Detection and Response in a Sample Application • Monitoring the Protective Systems • Monitoring the Application • Monitoring the Administrators • Understanding the Auditing Infrastructure • Conclusion • Exercises