Announcement

After countless evenings and weekends in coffee shops, and multiple vacations with the laptop, I’m excited to announce that my first book has been published. It took 18 months from writing the first words (at Victrola Coffee Roasters on Capitol Hill by the way) to finishing this project just a few days ago.

Looking back its amazing how this all came together. The first intial draft had 100 pages, and in the end it ended up being 524 pages.

It is available here: Cybersecurity Attacks - Red Team Strategies

The challenges in front of the security community, industry and society are tremendous. The amount of information that needs protection, the amount of data stored in the cloud, the privacy concerns, the threats artificial intelligence holds, and the easy manipulation of the masses via social media are a reflection of how much work is ahead of us.

Having had the chance to interact, work with, and learn from so many security professionals, however, I’m confident that if we work together to share our understanding of the threats, mitigations, and risks, we will continue to rise and meet these challenges.

My biggest hope is that this work is useful for many readers and that it provides value.

The book is split into two larger parts:

1. Embracing The Red:

The first part focuses on program management aspects of building, managing and measuring an offensive security engineering program. Many examples and ideas are provided on how to build and grow a program, manage people, and how to communicate and measure risks.

It also discusses the homefield advantage that an internal security program has compared to an adversary, and how to leverage that advantage. The first part conclues with ideas for less typical red teaming operations such as testing for privacy violations or performing crypto-currency mining.

2. Tactics, Tools & Techniques:

The second part dives into technical aspects. It is however not focused on discussing pentest tools per se, rather the focus is on understanding foundational tactics, techniques as well as security research across Windows, macOS and Linux. This includes building out knowledge-graphs, hunting for credentials, automating Microsoft Office, and remote controlling browsers and so forth. The technical content is not for complete beginners, as some debugging and troubleshooting will be necessary. There is also a dedicated chapter on how to protect pentesters, and last but not least a basic introduction to blue team tooling for red teamers.

It can be ordered through various channels, easiest is probably Amazon: Cybersecurity Attacks - Red Team Strategies

Reviews

I’d appreciate feedback and reviews on Amazon as well (in case you happen to like it). :)

Thanks!

Many thanks go individuals who help make this book a reality - this includes the many people I was able to learn from over the years. This book is for all those curious hackers, testers and breakers out there. I also want to thank the publisher Packt and all the amazing people there who helped refine the content and structure of the book.

– Johann Rehberger

Twitter: @wunderwuzzi23

Back Cover

“Cybersecurity Attacks - Red Team Strategies: A practical guide to building a penetration testing program having homefield advantage”