Book Image

Mastering Windows Security and Hardening

By : Mark Dunkerley, Matt Tumbarello
Book Image

Mastering Windows Security and Hardening

By: Mark Dunkerley, Matt Tumbarello

Overview of this book

Are you looking for effective ways to protect Windows-based systems from being compromised by unauthorized users? Mastering Windows Security and Hardening is a detailed guide that helps you gain expertise when implementing efficient security measures and creating robust defense solutions. We will begin with an introduction to Windows security fundamentals, baselining, and the importance of building a baseline for an organization. As you advance, you will learn how to effectively secure and harden your Windows-based system, protect identities, and even manage access. In the concluding chapters, the book will take you through testing, monitoring, and security operations. In addition to this, you’ll be equipped with the tools you need to ensure compliance and continuous monitoring through security operations. By the end of this book, you’ll have developed a full understanding of the processes and tools involved in securing and hardening your Windows environment.
Table of Contents (19 chapters)
Section 1: Getting Started
Section 2: Applying Security and Hardening
Section 3: Protecting, Detecting, and Responding for Windows Environments

Today's threats

The threat landscape within the cyber world is extremely diverse and is continually becoming more complex. The task of protecting users, data, and systems is becoming more difficult and requires the advancement of even more intelligent tools to keep the bad actors out. Today, criminals are more sophisticated, and large groups have formed with significant financial backing to support the wrongdoings of these groups. The following is a list of cyber threats:

To shed some light on real-world examples of data breach sources today, Verizon has created a 2020 Data Breach Investigations Report ( The report is built on a set of real-world data and contains some eye-opening data on attack sources:

  • External actors: 70%
  • Organized criminal groups: 55%
  • Internal actors: 30%
  • Partners: 1%
  • Multiple parties involved: 1%

The full report can be found here:

There are many types of cyberattacks in the world today, and this creates a diverse set of challenges for organizations. While not all threats are Windows-specific, there's a chance that Windows is the median or attack vector in which an attacker gains access by exploiting a vulnerability. An example of this could be an unpatched OS or an out-of-date application. The following list contains many common types of threats that could cause damage directly from a vulnerability within the Windows OS or by using the Windows OS as an attack vector.

Malware is software or code designed with malicious intent that exploits vulnerabilities found within the system. The following types of threats are considered malware:

  • Adware
  • Spyware
  • Virus (polymorphic, multipartite, macro, or boot sector)
  • Worm
  • Trojan
  • Rootkit
  • Bots/botnets
  • Ransomware
  • Logic bomb

In addition to malware, the following are types of attack techniques that can be used to exploit vulnerabilities:

  • Keylogger
  • Phishing
  • Spear phishing
  • Whale phishing
  • SQL injection attack
  • Cross-Site Scripting (XSS)
  • Denial of Service (DoS)
  • Session hijacking
  • Man-in-the-Middle Attacks (MITM)
  • Password attacks (brute-force, dictionary, or birthday attacks)
  • Credential reuse
  • Identity theft
  • Advanced persistent threats
  • Distributed Denial of Service (DDoS)
  • Intellectual property theft
  • Shoulder surfing
  • Golden Ticket: Kerberos attacks


    To learn more about the threats listed earlier, the National Institute of Standards and Technology (NIST) contains a glossary that provides more information on most, if not all, of the preceding list: