Cybersecurity Books: Defense and response

Part six of nine. Blue team: monitoring, detection, incident investigation, and building systems that survive a compromise.

The offensive books teach you to find one hole. These teach you to work in a situation where the hole has already been found by somebody else.

The foundational book on network monitoring. Its central claim: prevention will eventually fail, so build visibility.

Topics: sensor placement and traffic collection, full packet capture versus metadata, Security Onion, analysing suspicious activity, the process from detection to escalation.

Wireshark and reading traffic at the packet level. A skill you need both in security and in debugging production.

Topics: capturing traffic in different topologies, filters, dissecting TCP, DNS, and HTTP, diagnosing a slow network, recognising scanning, ARP attacks, and malicious traffic.

A continuation of Bejtlich's theme, with the emphasis on the analyst's workflow and tooling.

Topics: collection, detection, and analysis as three separate functions, Snort and Bro rules, indicators of compromise, threat intelligence, metrics for a monitoring centre.

A response methodology from the team that investigated the biggest breaches of the 2000s.

Topics: preparing for an incident, collecting evidence without spoiling it, Windows and Linux forensics, timeline analysis, removing the attacker's presence, reporting and legal aspects.

How to tie threat intelligence to response so that the former does not turn into a subscription to lists of indicators.

Topics: the intelligence cycle, the Kill Chain and Diamond models, attribution and its limits, collecting and processing threat data, distributing the results inside the organisation.

A pocket reference for the analyst on shift: commands, checklists, sequences of actions.

Topics: the first steps in an incident, capturing artefacts, Windows and Linux commands for a quick check, log analysis, documentation templates.

Google's experience of building systems where security and reliability are designed together. The publisher has made the book freely available.

Topics: designing for failure and compromise, least privilege and change control, securing the code supply chain, response in a large infrastructure, culture and the organisation of processes.

Next part: the human attack vector.

The whole series:

1. Foundations
2. Offensive security
3. Reverse engineering and malware
4. Cryptography
5. Application security
6. Defense and response
7. The human attack vector
8. Nonfiction investigations
9. Fiction