You're reading from Incident Response for Windows Adapt effective strategies for managing sophisticated cyberattacks targeting Windows systems

Product type Paperback

Published in Aug 2024

Publisher Packt

ISBN-13 9781804619322

Length 244 pages

Edition 1st Edition

Concepts

Cybersecurity

Authors (2):

Anatoly Tykushin

Svetlana Ostrovskaya

View More author details

Table of Contents (20) Chapters

Preface

1. Part 1: Understanding the Threat Landscape and Attack Life Cycle

2. Chapter 1: Introduction to the Threat Landscape FREE CHAPTER

3. Chapter 2: Understanding the Attack Life Cycle

4. Part 2: Incident Response Procedures and Endpoint Forensic Evidence Collection

5. Chapter 3: Phases of an Efficient Incident Response on Windows Infrastructure

6. Chapter 4: Endpoint Forensic Evidence Collection

7. Part 3: Incident Analysis and Threat Hunting on Windows Systems

8. Chapter 5: Gaining Access to the Network

9. Chapter 6: Establishing a Foothold

10. Chapter 7: Network and Key Assets Discovery

11. Chapter 8: Network Propagation

12. Chapter 9: Data Collection and Exfiltration

13. Chapter 10: Impact

14. Chapter 11: Threat Hunting and Analysis of TTPs

15. Part 4: Incident Investigation Management and Reporting

16. Chapter 12: Incident Containment, Eradication, and Recovery

17. Chapter 13: Incident Investigation Closure and Reporting

18. Index

Why subscribe?

19. Other Books You May Enjoy

Incident Investigation Closure and Reporting

Throughout the book, we have been focusing on technical aspects of the incident response (IR) and handling phases. Chapter 3 introduced IR team (IRT) roles and responsibilities and a process overview. In Chapter 12, several metrics were introduced to align with business on various actions that might interrupt business processes and affect continuity.

The chapter will start with the incident closure process, covering all necessary types of reports, supporting files such as evidence acquisition and handover forms, responsibilities, and quality assurance. Then, the committee review, submission, and closing of the case will be described and applied to IRT roles. Once the paperwork is done, the committee review is passed, and visibility over the impact is achieved, the management team can trigger or close the external incident escalation to regulators, third parties, and law enforcement agencies.

By the end of this chapter, the reader will...