Preface
Ransomware attacks can cause significant harm to an organization. They can result in the loss of sensitive or confidential data, downtime, financial losses from ransom payments, damage to an organization’s reputation, and potential legal liabilities. We have also seen cases in which companies have gone bankrupt after getting attacked by ransomware.
In this book, Windows Ransomware Detection and Protection, we will explore the growing threat of ransomware attacks and how to best protect yourself and your organization from them. You will learn about the different types of ransomware, the tactics and techniques used by attackers, and the best practices for detecting and preventing these attacks on your Windows devices. By the end of this book, you will have the knowledge and skills to safeguard your businesses against ransomware and protect your valuable data.
The book is written in a way that is easy to understand for readers with all levels of technical expertise, from beginners to experienced IT professionals.
Who this book is for
IT administrators, security administrators, CISOs, or other security-related roles can gain practical insight from this book into how ransomware works and how to best protect their organizations from these types of attacks.
What this book covers
Chapter 1, Ransomware Attack Vectors and the Threat Landscape, explains the basics of how ransomware attacks work, the attack chain, and the different attack vectors that are commonly used. The chapter also covers some known ransomware groups and what kind of attack methods they used.
Chapter 2, Building a Secure Foundation, provides a high-level overview of the different countermeasures across all the different attack surfaces, such as networking, infrastructure, endpoints, identity, and SaaS services. It also goes into how to build a secure network foundation and Windows environment.
Chapter 3, Security Monitoring Using Microsoft Sentinel and Defender, teaches you how to configure and set up security monitoring for Windows-based environments using services such as Microsoft Sentinel and Microsoft Defender for Cloud. It also covers architecture design, implementation, and best practices in terms of the key events to monitor.
Chapter 4, Ransomware Countermeasures – Windows Endpoints, Identity, and SaaS, takes you through the different countermeasures to secure Windows-based endpoints, using functionality such as Azure AD and Microsoft Endpoint Manager. In addition, it covers the different ways to secure the identities of end users with password policies and monitor end user activity across devices and SaaS services, before exploring the methods used to reduce the risk of phishing attacks via email.
Chapter 5, Ransomware Countermeasures – Microsoft Azure Workloads, covers different countermeasures and security mechanisms within Windows Server and other parts of the virtual infrastructure. It also covers some best practices regarding network segmentation for virtual infrastructure and includes guidelines for best practices within Microsoft Azure.
Chapter 6, Ransomware Countermeasures – Networking and Zero-Trust Access, covers the best practices regarding network segmentation for end user connectivity and security for Windows-based endpoints and how we can secure our external web services against DDoS attacks. It also covers SASE service models and how they can help reduce the risk for the mobile workforce.
Chapter 7, Protecting Information Using Azure Information Protection and Data Protection, details the
different ways to encrypt data to reduce the risk of sensitive information falling into the hands of an
attacker. It also covers services such as Azure Information Protection and other best practices related
to data protection and backup.
Chapter 8, Ransomware Forensics, explains how to do forensics on impacted systems and how to organize the work when your business has been impacted by an attack. It also covers some different ways to look for evidence of how attackers have compromised a system.
Chapter 9, Monitoring the Threat Landscape, focuses on different tips and tools for monitoring the
threat landscape and the use of different tools to monitor your own security exposure using tools such
as Microsoft Defender External Attack Surface Management and GreyNoise.
Chapter 10, Best Practices for Protecting Windows from Ransomware Attacks, includes best practices
and security settings in Windows, such as LAPS, Windows Firewall, and Tamper Protection, and how
to protect your machines from credential harvesting tools such as Mimikatz. Finally, it goes into how
to keep your infrastructure up to date using Update Management tools.
To get the most out of this book
Much of the content in this book uses cloud services from Microsoft, such as the Microsoft 365 security
services and cloud services from Microsoft Azure. To get the most out of the book, you should either
have access to a test environment or set up your own environment using a trial account.
For instance, you can get access to the Microsoft 365 services using a trial. You can sign up for an
Azure trial here: https://azure.microsoft.com/en-gb/free/active-directory/.
After you have signed up for a free Azure trial account, you can also sign up for Microsoft E3 or E5
licenses as a 30-day trial.
In addition, you should also have access to a virtual machine that can be used as an example for
management, which can also be run in Microsoft Azure.
It should be noted that during the writing of this book, Microsoft is changing the process so that trial
accounts are converted into paid accounts automatically after a trial expires, so please make sure that
you then either delete your licenses or your tenant.
