{"product_id":"practical-vulnerability-management-isbn-9781593279882","title":"Practical Vulnerability Management","description":"\u003cb\u003e\u003ci\u003ePractical Vulnerability Management\u003c\/i\u003e shows you how to weed out system security weaknesses and squash cyber threats in their tracks.\u003c\/b\u003e\u003cbr\u003e\u003cbr\u003eBugs: they're everywhere. Software, firmware, hardware -- they all have them. Bugs even live in the cloud. And when one of these bugs is leveraged to wreak havoc or steal sensitive information, a company's prized technology assets suddenly become serious liabilities.\u003cbr\u003e\u003cbr\u003eFortunately, exploitable security weaknesses are entirely preventable; you just have to find them before the bad guys do. \u003ci\u003ePractical Vulnerability Management \u003c\/i\u003ewill help you achieve this goal on a budget, with a proactive process for detecting bugs and squashing the threat they pose.\u003cbr\u003e\u003cbr\u003eThe book starts by introducing the practice of vulnerability management, its tools and components, and detailing the ways it improves an enterprise's overall security posture. Then it's time to get your hands dirty! As the content shifts from conceptual to practical, you're guided through creating a vulnerability-management system from the ground up, using open-source software.\u003cbr\u003e\u003cbr\u003eAlong the way, you'll learn how to:\u003cbr\u003e\u003cli\u003eGenerate accurate and usable vulnerability intelligence\u003c\/li\u003e\u003cli\u003eScan your networked systems to identify and assess bugs and vulnerabilities\u003c\/li\u003e\u003cli\u003ePrioritize and respond to various security risks\u003c\/li\u003e\u003cli\u003eAutomate scans, data analysis, reporting, and other repetitive tasks\u003c\/li\u003e\u003cli\u003eCustomize the provided scripts to adapt them to your own needs\u003c\/li\u003e\u003cbr\u003ePlaying whack-a-bug won't cut it against today's advanced adversaries. Use this book to set up, maintain, and enhance an effective vulnerability management system, and ensure your organization is always a step ahead of hacks and attacks.\u003cb\u003eIntroduction\u003c\/b\u003e\u003cbr\u003e\u003cbr\u003e\u003cb\u003ePart I: Vulnerability Management Basics\u003c\/b\u003e\u003cbr\u003e\u003cb\u003eChapter 1: \u003c\/b\u003eBasic Concepts\u003cbr\u003e\u003cb\u003eChapter 2:\u003c\/b\u003e Sources of Information\u003cbr\u003e\u003cb\u003eChapter 3:\u003c\/b\u003e Vulnerability Scanners\u003cbr\u003e\u003cb\u003eChapter 4:\u003c\/b\u003e Automating Vulnerability Management\u003cbr\u003e\u003cb\u003eChapter 5:\u003c\/b\u003e Vulnerability Management Outcomes\u003cbr\u003e\u003cb\u003eChapter 6: \u003c\/b\u003eVulnerability Management and Organizational Priorities\u003cbr\u003e\u003cbr\u003e\u003cb\u003ePart II: Hands-on Vulnerability Management\u003c\/b\u003e\u003cbr\u003e\u003cb\u003eChapter 7:\u003c\/b\u003e Setting Up Your Environment\u003cbr\u003e\u003cb\u003eChapter 8:\u003c\/b\u003e Using the Data Collection Tools\u003cbr\u003e\u003cb\u003eChapter 9:\u003c\/b\u003e Getting Your Data into Usable Format\u003cbr\u003e\u003cb\u003eChapter 10:\u003c\/b\u003e Maintaining the Database\u003cbr\u003e\u003cb\u003eChapter 11:\u003c\/b\u003e Generating Asset and Vulnerability Reports\u003cbr\u003e\u003cb\u003eChapter 12:\u003c\/b\u003e Automating Scans and Reporting\u003cbr\u003e\u003cb\u003eChapter 13:\u003c\/b\u003e Advanced Reporting\u003cbr\u003e\u003cb\u003eChapter 14:\u003c\/b\u003e Advanced Topics\u003cbr\u003e\u003cb\u003eChapter 15.\u003c\/b\u003e Conclusion\u003cbr\u003e\u003cb\u003eIndex\u003c\/b\u003e\"An easy read and offers comprehensive solutions to keeping an organization secure and always prepared for possible attacks.\" \u003cbr\u003e\u003cb\u003e—Helga Labus, Help Net Security\u003c\/b\u003e\u003cb\u003eAndrew Magnusson\u003c\/b\u003e has been working in the information security field since 2002, in areas ranging from firewall configuration to security consulting to managing SOC2 compliance. As a consultant deploying enterprise vulnerability management tools he has seen how an organization's vulnerability management practices, or lack thereof, affects their overall information security posture.\u003cb\u003eINTRODUCTION\u003cbr\u003e\u003c\/b\u003e\u003cbr\u003eIt’s human nature to pay attention to the problems that are big and flashy, attracting lots of interest, such as \u003ci\u003eadvanced persistent threat (APT) \u003c\/i\u003egroups—state-sponsored attackers. APT-linked attackers have compromised major retailers, financial institutions, and even government networks. But when we focus all of our attention on APTs and other headline-generating activity, we miss basic issues. Even though you have new firewalls protecting your system and powerful traffic-monitoring devices, if you don’t keep up with the bread and butter of your security responsibilities, you’re leaving many chinks in your system’s armor. Neglecting the basics, like keeping your systems updated, can lead to serious consequences.\u003cbr\u003e\u003cbr\u003eConsider this example: suppose you’re an information security manager at a medium-sized e-commerce business. You’ve set up firewalls to block incoming traffic except for traffic to internet-facing services on systems in your \u003ci\u003edemilitarized zone (DMZ)\u003c\/i\u003e. You’ve turned on egress filtering to block unauthorized exit traffic. An antivirus is on the endpoints, and you’ve hardened your servers. You believe your system is safe. \u003cbr\u003e\u003cbr\u003eBut an old web service is running on an outdated version of Tomcat on a Linux server in the DMZ. It’s a relic from an ill-advised foray into selling some of your company’s valuable proprietary data to selected business partners. The initiative failed, but because you made some sales, you had a contractual obligation to keep that server up for another year. At the end of the year, the project was quietly shuttered, but the server is still running. Everyone has forgotten about it. But someone on the outside notices it. An attack comes in from a compromised server in Moldova, and your unpatched Tomcat server is vulnerable to a five-year-old Java issue. Now the attacker has a foothold in your network, and all your protections couldn’t stop it. Where did you fail?\u003cbr\u003e\u003cbr\u003eThis guide demonstrates the value of strong information security fundamentals. These are the most important components of a successful information security program. Unfortunately, they’re regularly neglected in favor of sexier topics, such as traffic analysis and automated malware sandboxing. Don’t get me wrong; these are great advances in the state of the art of information security. But without a strong grasp of the fundamentals, investment in more advanced tools and techniques is futile. \u003cbr\u003e\u003cbr\u003e\u003cb\u003eWho This Book Is For\u003cbr\u003e\u003c\/b\u003e\u003cbr\u003eThis book is for security practitioners tasked with defending their organization on a small budget and looking for ways to replicate functionality from commercially available vulnerability management tools. If you’re familiar with vulnerability management as a process, you’ll have a head start. To build your own vulnerability management system, you should be familiar with Linux and database concepts and have some experience in a programming language like Python. The scripts in this book are written in Python, but you can functionally re-create them in whichever modern scripting or programming language you prefer.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eBack to Basics\u003cbr\u003e\u003c\/b\u003e\u003cbr\u003eYou can consider a number of security topics as foundational, such as authentication management, network design, and asset management. Although these elements might not be exciting or interesting for an analyst to work on, they’re of critical importance. \u003cbr\u003e\u003cbr\u003eVulnerability management is one of the foundational concepts of information security. A perfectly written and configured software package doesn’t exist. Bugs are an inevitable part of software, and many bugs have security implications. Dealing with these software vulnerabilities is a perennial issue in information security; the practice of vulnerability management is required for a baseline level of security that can serve as a trusted foundation upon which to deploy more advanced and specialized tools.\u003cbr\u003e\u003cbr\u003eVulnerabilities affect an organization’s IT infrastructure at all levels, so vulnerability management affects all aspects of an IT security program. Endpoint security relies on workstations and servers being up-to-date with the latest software versions to minimize the attack surface. Zero-day vulnerabilities are always a concern. But removing the low-hanging fruit of known (and sometimes long-standing) vulnerabilities makes it more difficult for attackers to compromise an endpoint and gain a foothold in your environment. Network security does its best to ensure that only necessary traffic passes among internal network segments and to and from the internet. But if systems or network devices contain known vulnerabilities, even otherwise legitimate traffic might contain network-based attacks using known and trusted protocols. \u003ci\u003eIdentity and access management (IAM) \u003c\/i\u003erestricts users to the specific systems and data to which they’re entitled. But if the identity systems are vulnerable, attackers can simply sidestep them. \u003cbr\u003e\u003cbr\u003eIf your environment has a baseline level of security, any countermeasures you put in place can’t be easily bypassed by exploiting known vulnerabilities. Let’s consider an analogy: after World War I, France tried to protect itself from Germany by building a long line of forts and entrenchments along its German border. It was named the Maginot Line after the French minister of war. But when World War II began, the Germans ignored the barrier by simply going around it, invading France across the Belgian border instead. All of that expensive defensive infrastructure was irrelevant. The same goes for your environment. If it doesn’t have a foundational level of security, any additional countermeasures are no more than a Maginot Line. Attackers can easily avoid them because there is an easier path elsewhere. But by establishing a vulnerability management baseline and maintaining it via an active vulnerability management program, you can trust that additional security measures will add real value to your security program.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eVulnerability Management Is Not Patch Management\u003cbr\u003e\u003c\/b\u003e\u003cbr\u003e\u003ci\u003ePatch management\u003c\/i\u003e, perhaps in conjunction with a full \u003ci\u003esoftware configuration management (SCM) \u003c\/i\u003esystem, keeps track of the versions and patch levels of servers and endpoints across an enterprise. It can push patches remotely to keep systems up-to-date. But although traditional patch management and vulnerability management (as described in this guide) share many similarities, the underlying assumptions are very different. \u003cbr\u003e\u003cbr\u003ePatch management assumes that patches are available, a patch management system can manage all the devices on the network that need patches, and there is enough time and manpower to apply all patches. But in real environments, it’s very rare for all of these conditions to hold. Devices exist that aren’t managed by the SCM: for example, network devices like routers and firewalls, test machines, abandoned servers, and devices running operating systems that aren’t compatible with SCM agents. All these components are invisible to a typical SCM deployment and could easily become out-of-date without anyone noticing. Even if automated patching is practicable for endpoints, often you must handle servers and network devices manually, because automatically patching a server might lead to downtime when the organization can least afford it. On the other hand, manually patching servers and network devices takes time that overworked IT staff often can’t spare.\u003cbr\u003e\u003cbr\u003eVulnerability management takes a more pragmatic approach. Instead of asking, “How can we apply all of these patches?” vulnerability management asks, “Given our limited resources, how can we best improve our security posture by addressing the most important vulnerabilities?” Vulnerability management looks at the problem through a risk management lens. We start with the full domain of vulnerabilities that exist on networked devices—managed and unmanaged—and determine which of these vulnerabilities present the highest risk to the organization’s security. Once we’ve gathered that data, we have enough information to prioritize patching and remediation activities. If after this process is complete we have the capacity to apply more updates and remediation, so much the better. But by looking at the highest-risk issues first and using our limited time and resources wisely, we can improve the system’s security posture significantly with comparatively little effort. \u003cbr\u003e\u003cbr\u003e\u003cb\u003eMain Topics Covered\u003cbr\u003e\u003c\/b\u003e\u003cbr\u003eThis technical guide is divided into two main parts: conceptual and practical. In the first part, you’ll learn about the concepts and components of the vulnerability management process. In the second and larger part, you’ll look at a practical approach to building a free or low-cost vulnerability management system. Although you can follow the guide exactly, it’s most important for you to understand the concepts behind each script to adapt it to your own needs. Toward the end of the book, you’ll explore topics you might want to tackle once your vulnerability management system is up and running. One of those topics is purchasing a commercial tool to improve your vulnerability management program when you have the budget to do so.","brand":"No Starch Press","offers":[{"title":"Default Title","offer_id":46302246699237,"sku":"NP9781593279882","price":29.95,"currency_code":"USD","in_stock":false}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1842\/7735\/files\/9781593279882.jpg?v=1767735035","url":"https:\/\/k12savings.com\/products\/practical-vulnerability-management-isbn-9781593279882","provider":"K12savings","version":"1.0","type":"link"}