Sign In Start Free Trial
Account

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Book Overview & Buying Incident Response for Windows
  • Table Of Contents Toc
Incident Response for Windows

Incident Response for Windows

By : Anatoly Tykushin, Ostrovskaya
4.8 (9)
close
close
Incident Response for Windows

Incident Response for Windows

4.8 (9)
By: Anatoly Tykushin, Ostrovskaya

Overview of this book

Cybersecurity threats are constantly evolving, posing serious risks to organizations. Incident Response for Windows, by cybersecurity experts Anatoly Tykushin and Svetlana Ostrovskaya, provides a practical hands-on guide to mitigating threats in Windows environments, drawing from their real-world experience in incident response and digital forensics. Designed for cybersecurity professionals, IT administrators, and digital forensics practitioners, the book covers the stages of modern cyberattacks, including reconnaissance, infiltration, network propagation, and data exfiltration. It takes a step-by-step approach to incident response, from preparation and detection to containment, eradication, and recovery. You will also explore Windows endpoint forensic evidence and essential tools for gaining visibility into Windows infrastructure. The final chapters focus on threat hunting and proactive strategies to identify cyber incidents before they escalate. By the end of this book, you will gain expertise in forensic evidence collection, threat hunting, containment, eradication, and recovery, equipping them to detect, analyze, and respond to cyber threats while strengthening your organization's security posture
Table of Contents (20 chapters)
close
close
1
Part 1: Understanding the Threat Landscape and Attack Life Cycle
4
Part 2: Incident Response Procedures and Endpoint Forensic Evidence Collection
7
Part 3: Incident Analysis and Threat Hunting on Windows Systems
15
Part 4: Incident Investigation Management and Reporting

Endpoint Forensic Evidence Collection

After an incident has occurred, in accordance with an efficient incident response plan, it becomes essential to initiate the steps of incident verification and analysis. These steps cannot be effectively carried out in the absence of forensic evidence collected from the cybersecurity controls already in place or forensic data gathered from the endpoint under suspicion. While cybersecurity controls themselves already provide some valuable insights, forensic evidence acquisition is still required to dive deeper into incident details and get the full picture of malicious activities. It is important to note that the artifacts to be collected may vary depending on the host’s Operating System (OS), its version (desktop or server), its architecture, and so on.

We will cover the various methods for collecting forensic evidence from Windows OS endpoints as part of the incident verification and analysis steps mentioned earlier. We will also discuss...

Visually different images
CONTINUE READING
83
Tech Concepts
36
Programming languages
73
Tech Tools
Icon Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.
Icon Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.
Icon 50+ new titles added per month and exclusive early access to books as they are being written.
Incident Response for Windows
notes
bookmark Notes and Bookmarks search Search in title playlist Add to playlist font-size Font size

Change the font size

margin-width Margin width

Change margin width

day-mode Day/Sepia/Night Modes

Change background colour

Close icon Search
Country selected

Close icon Your notes and bookmarks

Confirmation

Modal Close icon
claim successful

Buy this book with your credits?

Modal Close icon
Are you sure you want to buy this book with one of your credits?
Close
YES, BUY

Submit Your Feedback

Modal Close icon
Modal Close icon
Modal Close icon