Book Image

Mastering Windows Security and Hardening - Second Edition

By : Mark Dunkerley, Matt Tumbarello
5 (1)
Book Image

Mastering Windows Security and Hardening - Second Edition

5 (1)
By: Mark Dunkerley, Matt Tumbarello

Overview of this book

Are you looking for the most current and effective ways to protect Windows-based systems from being compromised by intruders? This updated second edition is a detailed guide that helps you gain the expertise to implement efficient security measures and create robust defense solutions using modern technologies. The first part of the book covers security fundamentals with details around building and implementing baseline controls. As you advance, you’ll learn how to effectively secure and harden your Windows-based systems through hardware, virtualization, networking, and identity and access management (IAM). The second section will cover administering security controls for Windows clients and servers with remote policy management using Intune, Configuration Manager, Group Policy, Defender for Endpoint, and other Microsoft 365 and Azure cloud security technologies. In the last section, you’ll discover how to protect, detect, and respond with security monitoring, reporting, operations, testing, and auditing. By the end of this book, you’ll have developed an understanding of the processes and tools involved in enforcing security controls and implementing zero-trust security principles to protect Windows systems.
Table of Contents (21 chapters)
1
Part 1: Getting Started and Fundamentals
7
Part 2: Applying Security and Hardening
15
Part 3: Protecting, Detecting, and Responding for Windows Environments

Understanding XDR

XDR expands beyond the original detection and response capabilities of a single technology to include multiple technologies. You should now be familiar with Endpoint Detection and Response (EDR) for MDE and its comprehensive coverage across endpoints as a single technology. XDR not only covers endpoints but also expands into email, servers, cloud infrastructure, identity and access management, network, applications, and so on.

You are most likely monitoring, collecting data, running analysis, and responding to all the different technology areas mentioned previously as part of your security program. The challenge commonly faced is a lack of a unified view and context in the attack timeline within these technology areas, due to separate tools and solutions. XDR brings everything into a centralized view for greater efficiency, allowing for quicker response to incidents and alerts. XDR doesn't replace a SIEM or security orchestration automation and response ...