Windows Security Internals

Informationen zum Autor James Forshaw is a renowned computer security researcher at Google Project Zero, with over twenty years of experience in researching and developing secure systems on various platforms, but especially Microsoft Windows. This experience earned him the top bug bounty of $100,000. He's reporting 100s of security vulnerabilities to Microsoft which gained him the #1 researcher position on Microsoft Security Response Center's (MSRC) published list. He's been invited to present his novel security research at global security conferences such as Black Hat, CanSecWest and Chaos Computer Congress. He's also the author of Attacking Network Protocols, published by No Starch Press. Klappentext Power up your Windows security skills with expert guidance, in-depth technical insights, and dozens of real-world vulnerability examples from Google Project Zero's most renowned researcher! Learn core components of the system in greater depth than ever before, and gain hands-on experience probing advanced Microsoft security systems with the added benefit of PowerShell scripts. Learn the core components and features of the Microsoft Windows threat-mitigation system from one of the world's foremost Windows security expertsand Microsoft's top bug hunterJames Forshaw. In this hands-on guidebook, Forshaw distills his more than 20 years of knowledge and practical experience working with Windows security, describing the system in greater depth than any ever before. In-depth technical discussions are rounded out with l real-world examples that not only demonstrate how to use PowerShell in security work, but let you explore Windows security features for yourself as you follow along in the text. Early chapters cover the basics, including best practices for setting up a PowerShell environment, understanding the Windows kernel interface, and working within the security reference monitor. As you progress to more advanced topics, Forshaw walks you through highly relevant case studies, as well as the implementation of complex processes like access checking and network authentication. In addition, there are example scripts using the PowerShell scripting language throughout, which can be used to test the behavior of Windows systems and, in turn, enable you to explore their security without needing a compiler or other development tools. Essential for anyone who works with Windows security, this book dives deeper into core components of the system than even Microsoft's own documentation. Zusammenfassung Power up your Windows security skills with expert guidance, in-depth technical insights, and dozens of real-world vulnerability examples from Google Project Zero's most renowned researcher! Learn core components of the system in greater depth than ever before, and gain hands-on experience probing advanced Microsoft security systems with the added benefit of PowerShell scripts. Learn the core components and features of the Microsoft Windows threat-mitigation system from one of the world's foremost Windows security expertsand Microsoft's top bug hunterJames Forshaw. In this hands-on guidebook, Forshaw distills his more than 20 years of knowledge and practical experience working with Windows security, describing the system in greater depth than any ever before. In-depth technical discussions are rounded out with l real-world examples that not only demonstrate how to use PowerShell in security work, but let you explore Windows security features for yourself as you follow along in the text. Early chapters cover the basics, including best practices for setting up a PowerShell environment, understanding the Windows kernel interface, and working within the security reference monitor. As you progress to more advanced topics, Forshaw walks you through highly relevant case studies, as well as the implementation of complex processes like access checki...

Auteur
James Forshaw is a renowned computer security expert on Google’s Project Zero team. In his more than 20 years of experience analyzing and exploiting security issues in Microsoft Windows and other products, he has discovered hundreds of publicly disclosed vulnerabilities in Microsoft platforms. Others frequently cite his research, which he presents in blogs, on the world stage, or through novel tooling, and he has inspired numerous researchers in the industry. When not breaking the security of other products, James works as a defender, advising teams on their security design and improving the Chromium Windows sandbox to secure billions of users worldwide. He’s also the author of Attacking Network Protocols (No Starch Press)

Résumé
**Power up your Windows security skills with expert guidance, in-depth technical insights, and dozens of real-world vulnerability examples from Google Project Zero’s most renowned researcher!

Learn core components of the system in greater depth than ever before, and gain hands-on experience probing advanced Microsoft security systems with the added benefit of PowerShell scripts.

Windows Security Internals is a must-have for anyone needing to understand the Windows operating system’s low-level implementations, whether to discover new vulnerabilities or protect against known ones. Developers, devops, and security researchers will all find unparalleled insight into the operating system’s key elements and weaknesses, surpassing even Microsoft’s official documentation.

Author James Forshaw teaches through meticulously crafted PowerShell examples that can be experimented with and modified, covering everything from basic resource security analysis to advanced techniques like using network authentication. The examples will help you actively test and manipulate system behaviors, learn how Windows secures files and the registry, re-create from scratch how the system grants access to a resource, learn how Windows implements authentication both locally and over a network, and much more.

You’ll also explore a wide range of topics, such as:

• Windows security architecture, including both the kernel and user-mode applications
• The Windows Security Reference Monitor (SRM), including access tokens, querying and setting a resource’s security descriptor, and access checking and auditing
• Interactive Windows authentication and credential storage in the Security Account Manager (SAM) and Active Directory
• Mechanisms of network authentication protocols, including NTLM and Kerberos
  In an era of sophisticated cyberattacks on Windows networks, mastering the operating system’s complex security mechanisms is more crucial than ever. Whether you’re defending against the latest cyber threats or delving into the intricacies of Windows security architecture, you’ll find Windows Security Internals indispensable in your efforts to navigate the complexities of today’s cybersecurity landscape.