Security Incidents & Response Against Cyber Attacks (EAI/Springer Innovations in Communication and Computing)

✍ Scribed by Akashdeep Bhardwaj (editor), Varun Sapra (editor)

• Publisher: Springer
• Year: 2021
• Tongue: English
• Leaves: 251
• Category: Library

✦ Synopsis

This book provides use case scenarios of machine learning, artificial intelligence, and real-time domains to supplement cyber security operations and proactively predict attacks and preempt cyber incidents. The authors discuss cybersecurity incident planning, starting from a draft response plan, to assigning responsibilities, to use of external experts, to equipping organization teams to address incidents, to preparing communication strategy and cyber insurance. They also discuss classifications and methods to detect cybersecurity incidents, how to organize the incident response team, how to conduct situational awareness, how to contain and eradicate incidents, and how to cleanup and recover. The book shares real-world experiences and knowledge from authors from academia and industry.

✦ Table of Contents

Preface
Acknowledgments
About the Book
Contents
Chapter 1: Introduction to Security Incidents and Response Against Cyber Attacks
1.1 Introduction
1.2 Security Incidents
1.3 CERT and CSIRT
1.4 Standards and Guidelines
1.5 Cyberattacks
1.6 Response Against Cyberattacks
1.7 Organization of the Book
1.7.1 Chapter 1: Introduction to Security Incidents and Response Against Cyber Attacks
1.7.2 Chapter 2: By Failing to Prepare, You Are Preparing to Fail
1.7.3 Chapter 3: Design of Block-Chain Polynomial Digests for Secure Message Authentication
1.7.4 Chapter 4: Collaborative Approaches for Security of Cloud and Knowledge Management Systems: Benefits and Risks
1.7.5 Chapter 5: Exploring Potential of Transfer Deep Learning for Malicious Android Applications Detection
1.7.6 Chapter 6: Exploring and Analysing Surface, Deep, Dark Web, and Attacks
1.7.7 Chapter 7: Securing ERP Cyber Systems by Preventing Holistic Industrial Intrusion
1.7.8 Chapter 8: Infrastructure Design to Secure Cloud Environments Against DDoS-Based Attacks
1.7.9 Chapter 9: Classifying Cyberattacks Amid Covid-19 Using Support Vector Machine
1.7.10 Chapter 10: Cybersecurity Incident Response Against Advanced Persistent Threats (APTs)
1.7.11 Chapter 11: IoT Architecture Vulnerabilities and Security Measures
1.7.12 Chapter 12: Authentication Attacks
1.7.13 Acknowledgments
References
Chapter 2: By Failing to Prepare, You Are Preparing to Fail
2.1 Introduction
2.2 Plan & Prepare
2.3 Strategy & Governance
2.4 Departmental Representation
2.5 Interested Parties
2.6 Stakeholder Representation
2.7 Government Stakeholders
2.8 Develop Policy and Procedures
2.9 Team & Resourcing
2.10 IM/IR Skill Requirement
2.11 Outsource Vendors
2.12 IM/IR Training & Awareness
2.13 Incident Drills & Testing
2.13.1 Red Teaming
2.13.2 VAPT
2.14 Conclusion
References
Chapter 3: Design of Block-Chain Polynomial Digests for Secure Message Authentication
3.1 Introduction
3.2 Background
3.3 Motivation
3.4 Analysis of Standard Digest Functions
3.4.1 Merkle–Damgard Construction
3.4.2 MD-5 Digest Function
3.4.3 SHA-160 Digest Function
3.4.4 SHA2-256 Digest Function
3.4.5 SHA3 Digest Function
3.4.6 Contemporary Digest Functions: A Security Analysis
3.5 Polynomial Digest
3.5.1 Design Challenges
3.5.2 Design Principles
3.5.2.1 MD Strengthening
3.5.2.2 Intermediate Hash Generation
3.5.2.3 Polynomial Product: A Contemporary Way to Achieve Avalanche Effect
3.5.2.4 Final Hash Generation
3.5.3 Experimental Analysis
3.5.3.1 Analysis of Collision and Pre-image Resistance (Modifying the Individual Bytes)
3.5.3.2 Analysis of Collision and Pre-image Resistance (Interchanging the Individual Bytes)
3.5.3.3 Analysis of Second Pre-image Resistance
3.5.3.4 Confusion and Diffusion Analysis
3.5.3.5 Analysis of Avalanche Response
3.6 Analysis of Near-Collision Response
3.6.1 Analysis of Input to Output Distribution
3.6.2 Runtime Analysis
3.7 Discussion
3.8 Conclusion
References
Chapter 4: Collaborative Approaches for Security of Cloud and Knowledge Management Systems: Benefits and Risks
4.1 Introduction
4.2 Literature Review
4.3 Knowledge Management and Cloud Computing Benefits and Risks
4.3.1 Benefits and Risk
4.3.2 Risks
4.4 Methods for Security Over Knowledge Management and Cloud Computing
4.4.1 Software Provides Access Control and Identity Management
4.4.2 Passwords
4.4.3 Memory Cards
4.4.4 Smart Cards
4.4.5 Biometrics
4.5 Autonomic Security
4.6 Conclusion and Future Work
References
Chapter 5: Exploring Potential of Transfer Deep Learning for Malicious Android Applications Detection
5.1 Introduction
5.2 Related Works
5.3 Transfer Learning for Android Malware Detection
5.4 Experimental Setup
5.4.1 Deep Learning: Convolutional Neural Network
5.5 Experimental Setup
5.6 Conclusion
References
Chapter 6: Exploring and Analysing Surface, Deep, Dark Web and Attacks
6.1 Introduction
6.2 Search Engines Work
6.2.1 Web Browsers
6.2.2 Invisible Web or Deep Web
6.2.3 What Is Hidden Deep Inside the Web?
6.2.4 Research on Deep Web and Dark Web
6.3 Trending Research
6.4 Distinct Characteristics Between Deep Web and Dark Web
6.5 Benefits of Deep Web
6.6 Deep Web Access Procedure in TOR
6.7 How TOR Works
6.7.1 TOR Offers Anonymity
6.7.2 Measures to be Taken Before Gaining Access to TOR
6.7.3 Attacks Inside the Dark Web
6.8 Conclusion
References
Chapter 7: Securing ERP Cyber Systems by Preventing Holistic Industrial Intrusion
7.1 ERP Systems
7.2 Integrations in ERP
7.3 Challenges in ERP Systems
7.4 Cyber Threats on ERP Systems
7.5 Potential Solutions
7.5.1 Terminology
7.5.2 An Internal and External Application Tier with DMZ
7.5.3 An External Application Tier with Reverse Proxy in DMZ
7.5.4 DMZ Sharing the File System with Application Tier on Internet
7.5.5 Hybrid Setup
7.5.6 Few Precautions
7.6 Conclusion
References
Chapter 8: Infrastructure Design to Secure Cloud Environments Against DDoS-Based Attacks
8.1 Introduction
8.1.1 Distributed Denial of Service Attacks
8.1.2 Types of DDoS Attacks
8.1.2.1 Volumetric DDoS Attacks
8.1.2.2 Application Layer DDoS Attacks
8.1.2.3 Reflection or Protocol DDoS Attacks
8.1.3 DDoS Attack Tools
8.2 Literature Review
8.2.1 DDoS Attack Classification
8.3 Methodology
8.4 Review of Solutions for DDoS Attacks on Clouds
8.4.1 Cyberattack Trends
8.4.2 Cybersecurity Survey
8.4.3 DDoS Mitigation Strategies
8.4.3.1 Volumetric DDoS Attacks
8.4.3.2 Protocol DDoS Attacks
8.4.3.3 Application Layer DDoS Attacks
8.4.3.4 Reflection Attacks
8.4.4 Review of DDoS Mitigation Solutions
8.4.4.1 On-Premise DDoS Mitigation Solutions
8.4.4.2 ISP DDoS Mitigation Solutions
8.4.4.3 Scrubbing Defense DDoS Mitigation Solutions
8.5 Experimental Results
8.5.1 Performance Results: Single-Tier Architecture
8.5.2 Performance Results: Three-Tier Architecture
8.6 Designing and Implementing Architectures
8.6.1 Single-Tier Architecture
8.6.2 Three-Tier Architecture
8.6.2.1 Application Defense Layer
8.6.2.2 Access Layer
8.7 Chapter Conclusion
8.7.1 Conclusion
8.7.2 Suggestions for Future Work
References
Chapter 9: Classifying Cyberattacks Amid Covid-19 Using Support Vector Machine
9.1 Introduction
9.2 Literature Review
9.3 Proposed Method
9.4 Methods
9.5 Results Discussion
9.5.1 Analyzing Results of Cyberattacks Amid Covid-19
9.6 Conclusion
References
Chapter 10: Cybersecurity Incident Response Against Advanced Persistent Threats (APTs)
10.1 Introduction
10.2 Advanced Persistent Threat Kill Chain
10.3 Literature Survey
10.4 APT Mitigation Taxonomy
10.5 Major APT Use Cases
10.6 Conclusion
References
Chapter 11: IoT Architecture Vulnerabilities and Security Measures
11.1 Introduction
11.2 Analysis of Literature
11.3 IoT Architecture and Its Security Issues
11.4 Solutions and Recommendations
11.5 Real Attack on IOT Devices: A Case Study
11.6 Conclusion
References
Published Proceedings
Web References
Chapter 12: Authentication Attacks
12.1 Introduction
12.2 Authentication Process
12.3 Existing Authentication Methods
12.3.1 Static Authentication by a Password
12.3.2 One-Time Password (OTP)
12.3.3 Biometrics
12.4 Execution Guidelines Solutions to Delicate Information Sensitive Information
References
Correction to: Security Incidents & Response Against Cyber Attacks
Correction to: A. Bhardwaj, V. Sapra (eds.), Security Incidents & Response Against Cyber Attacks, EAI/Springer Innovations in Communication and Computing, https://doi.org/10.1007/978-3-030-69174-5
Index