Resilient Cybersecurity E-Book

Mark Dunkerley

• Herausgeber: Packt Publishing
• Kategorie: Fachliteratur
• Sprache: Englisch

Seitenzahl: 1133

Veröffentlichungsjahr: 2024

Beschreibung

Building a Comprehensive Cybersecurity Program addresses the current challenges and knowledge gaps in cybersecurity, empowering individuals and organizations to navigate the digital landscape securely and effectively. Readers will gain insights into the current state of the cybersecurity landscape, understanding the evolving threats and the challenges posed today.
This book emphasizes the importance of prioritizing well-being within the cybersecurity profession, addressing a concern often overlooked in the industry. You will construct a cybersecurity program that encompasses cybersecurity architecture, identity and access management, cybersecurity operations, vulnerability management, cybersecurity awareness, training, and testing, vendor risk management, and proactive services. It dives deep into managing Operational Technology (OT) & the Internet of Things (IoT), equipping readers with the knowledge and strategies to secure these critical areas.
You will also explore the critical components of governance, risk, and compliance (GRC) within cybersecurity, focusing on the oversight and management of these functions. This book provides practical insights, strategies, and knowledge to help organizations build and enhance their cybersecurity programs, ultimately safeguarding against evolving threats in today's digital landscape.

Leseprobe

Resilient Cybersecurity

Reconstruct your defense strategy in an evolving cyber world

Mark Dunkerley

Resilient Cybersecurity

Copyright © 2024 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing or its dealers and distributors, will be held liable for any damages caused or alleged to have been caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

Senior Publishing Product Manager: Reshma Raman

Acquisition Editor – Peer Reviews: Gaurav Gavas

Project Editor: Meenakshi Vijay

Content Development Editor: Soham Amburle

Copy Editor: Safis Editing

Technical Editor: Kushal Sharma

Proofreader: Safis Editing

Indexer: Pratik Shirodkar

Presentation Designer: Rajesh Shirsath

Developer Relations Marketing Executive: Meghal Patel

First published: September 2024

Production reference: 1170924

Published by Packt Publishing Ltd.

Grosvenor House

11 St Paul’s Square

Birmingham

B3 1RB, UK.

ISBN 978-1-83546-251-5

www.packt.com

To my loving family.

– Mark Dunkerley

Contributors

About the author

Mark Dunkerley is a cybersecurity and technology leader with over 20 years of experience working in higher education, healthcare, and Fortune 100 companies. Mark has extensive knowledge in IT architecture and cybersecurity through delivering secure technology solutions and services. He has experience in cloud technologies, vulnerability management, vendor risk management, identity and access management, security operations, security testing, awareness and training, application and data security, incident and response management, regulatory and compliance, and more. Mark holds a master’s degree in business administration and has received multiple industry-recognized certifications, has been a keynote speaker, has spoken at multiple events, is a published author, and sits on customer advisory boards.

Thank you to my wife, Robin, and children, Tyne, Isley, and Cambridge, for all your continued support. To my parents for shaping me into the person I am today. To my brother for his ongoing service in the British Army. To anyone I missed, thank you! Without you all, this book would not have been possible.

About the reviewers

Vito Rallo is a cybersecurity expert leading an offensive security research lab with purple team, SecOps, and threat hunting experts. He has worked in cybersecurity and ethical hacking for over 25 years, developing security solutions in the fields of red teaming, OT and IoT, threat-informed and regulated security, incident response, and threat hunting.

As a product security specialist within the IBM X-Force Red global team, Vito delivered pentesting and advanced security services across the EMEA region.

He has also worked in the incident response field as an offensive security and OT expert and director at PwC. He also started Kroll as a managing director.

Vito loves working with the cyber community, and often presents at conferences or roadshows. He is on a mission to innovate the cyber business with integrated solutions across AI, security as code (detection and attack as code), and threat-informed security.

Chintan Gurjar is an cybersecurity expert with over 13 years of experience in the field, specializing in vulnerability management, threat intelligence, penetration testing, and attack surface management. He has a proven track record of working with a diverse range of clients across various industries and countries, showcasing his adaptability and proficiency in managing complex security challenges.

Currently, he serves as the threat and vulnerability manager at M&S in the UK, where he has spearheaded the development and maintenance of comprehensive risk-based threat and vulnerability management strategies. His previous roles include global senior vulnerability management analyst at TikTok and security engineering manager at Tesco, where he designed and implemented robust vulnerability management programs across multiple countries.

His experience includes notable positions such as cybersecurity manager at KPMG in New Zealand, where he planned and delivered comprehensive penetration testing and threat intelligence services, and a security consultant for various SMEs in India. This global exposure has provided Chintan with a unique understanding of international cybersecurity landscapes and practices.

Chintan is a strategic advisor for the CyberPeace Foundation and has authored a course on applied attack surface analysis and reduction for EC-Council. He also holds multiple certifications, including SANS MGT516, OSCP, CEH, CTIA, CCFH, and CCFA.

I’ve just completed my first stint as a technical reviewer for a book, and I’d like to extend my heartfelt thanks to the author, Mark Dunkerley, and the team at Packt Publishing for this remarkable opportunity. Their support and confidence in my abilities allowed me to lend my expertise to the enriching process of developing this publication.

Additionally, I must express my deep gratitude to my wife, Ankita Kacha, for her immense patience and understanding during the long weekends and evenings I dedicated to this project. Her unwavering support and willingness to listen to endless technical discussions have been invaluable. I truly appreciate her for cheerfully enduring my absorbed state and sharing in my enthusiasm for cybersecurity.

Join our community on Discord!

Read this book alongside other users, Cybersecurity experts, and the author himself.

Ask questions, provide solutions to other readers, chat with the author via Ask Me Anything sessions, and much more. Scan the QR code or visit the link to join the community.

https://packt.link/SecNet

Contents

Preface

Who this book is for

What this book covers

To get the most out of this book

Get in touch

Current State

An Evolving Digital World

Increasing Reliance on Technology

Digital Transformation

The Evolving Landscape of Cybersecurity

The Current Threat Landscape

Common Cyber Threat Actors

Types of Cyberattacks

Ransomware in More Detail

Other Types of Attacks

Supply Chain Challenges

Impact on Organizations

Special Considerations for OT and IoT

Emerging Threats – AI and Beyond

The Importance of Statistics

Key Reports and Findings

IBM’s Cost of a Data Breach Report

Verizon Data Breach Investigation Report (DBIR)

CISO Perspectives and Challenges

Federal Bureau of Investigation Internet Crime Report

Additional Resources and Staying Updated

Breaches Continue to Rise

Identity Theft Resource Center (ITRC)

Wikipedia’s List of Data Breaches

Consumer Impact and Awareness

Assumption of Compromise and Defensive Measures

Skillset Challenges

Common Cybersecurity Roles

Obsolete, Persistent, and Emerging Roles in Cybersecurity

High-Level Cybersecurity Organization Structure

Shortage of Cybersecurity Expertise

ICS2 2023 Cybersecurity Workforce Study

National Cyber Workforce and Education Strategy (NCWES)

Addressing the Talent Gap with Outsourcing

Retaining Top Performers

Methods of Staying Current

Challenges in the Hiring Process

Innovative Hiring Practices

Changing the Negative Perception of Cybersecurity

Encouraging Collaboration and Mentorship

Prioritizing Well-Being

Data on Well-Being and Burnout

Statistics on Mental Health in Cybersecurity

Strategies for Promoting Well-Being

Strategies for Individuals and Leaders

Summary

Join our community on Discord!

Setting the Foundations

Learn the Business

Understanding the Business Environment

Embracing Organizational Principles and Culture

Business Relationships

Navigating the Business

Everything Is About Risk

What about Finances?

Building Blocks for Your Cybersecurity Program

Cybersecurity Architecture

Identity and Access Management

Cybersecurity Operations

Vulnerability Management

Cybersecurity Awareness, Training, and Testing

Vendor Risk Management

Proactive Services

Operations Technology (OT) and the Internet of Things (IoT)

Governance, Risk, and Compliance (GRC)

The Cyber Mindmap

Defining the Cybersecurity Organization

Roles and Responsibilities

Outsourcing

Change Management

Communications

Summary

Building Your Roadmap

The Importance of a Roadmap

Program and Project Management

Assessing the Current State

Learning the Business

Non-Technical Assessment

Technical Assessment

Bringing It Together

Immediate Short-Term Impact (2–4 Months)

Continue To Learn The Business And Assess The Current Risk

Define the Strategy

Build your desired Organizational Structure

Select a Framework and Architecture

Identity and Access Management Fundamentals

Penetration Testing

Look to implement 24/7/365 Security Monitoring

Visibility of Assets

Vulnerability Scanning

User Awareness, Training, and Testing

Cybersecurity Insurance

Risk Register

Email Security Review and Hardening

Patching Cadence Review and Improvements

Is there any Operational Technology (OT) or Internet of Things (IoT) to be reviewed?

Short-Term Impact (5–12 Months)

Rolled-over Items from the 2–4 Months Roadmap

Assessments, Audits and Certifications

Policy Reviews and User Acceptance

Data Loss Prevention and Information Protection

Business Continuity Planning, Disaster Recovery Panning and the Cybersecurity Incident Response Plan

Tabletop Exercises

Current Cybersecurity Portfolio Review

Cybersecurity Program and Modernization

Vendor Risk Management Review

Application and Web Testing, including a SecDevOps Review

Integrate with the Architecture Review Process

Reporting Out

Long-Term Impact (1–3+ Years)

Rolled-over Items from the 5–12 Months Roadmap

Formalize and Mature the GRC Program

Mature User Awareness, Training, and Testing

Identity and Access Management (IAM) Enhancement

Mature Vulnerability Management

Mature Vendor Risk Management

Mature Security Operations

Ongoing Assessments, Audits, and Certificates

Focus on Proactive Services

Ongoing Cybersecurity Portfolio Review and Modernization

OT and IoT Program Maturity

Continuous Improvement

Summary

Join our community on Discord!

Solidifying Your Strategy

The Importance of a Strategy

What is your Architecture Strategy?

Architecture Roles

Alignment with Broader Architecture Strategies

A Comprehensive View

The Need to Modernize

Core Components

Cloud First

On-Premises Data Center

Cloud Data Center

Hybrid Data Center

Why a Cybersecurity Framework?

National Institute of Standards and Technology (NIST)

International Organization for Standardization (ISO)

Managing your Product and Vendor Portfolio

Resource Management (In-House versus Outsourcing)

Summary

Join our community on Discord!

Cybersecurity Architecture

Cybersecurity within Architecture

Understanding IT Architecture

Understanding Security Architecture

Importance of Embedding Cybersecurity within Architecture

Benefits of Embedding Cybersecurity within Architecture

Detailed Architecture Review Process

Required Architecture Diagrams

Cloud Services Architecture

Cybersecurity Architecture Documentation

Architecture Review Process

The Strategy, Scope, And Goals

Committees and Teams

Process Logistics

Foundation Setup

Meeting Schedules

Change Management

Project Management

Lifecycle Process

Intake Process

A complete Checklist

Architecture documentation

Vendor specific documentation

Your Cybersecurity Architecture Foundation

Zero-Trust Architecture (ZTA)

ZTA Models

CISA Zero Trust Model

Microsoft Zero Trust Model

ZTA Pillars

ZTA Maturity Model

Technical Architecture

Following a Baseline

Building Baseline Controls

Identity Architecture

Endpoint architecture

Endpoint Management and Advanced Protection

Data architecture

Data Inventory and Classification

Data Protection

Data Governance and Monitoring

Regulatory and Legal Considerations

Application Architecture

Authentication and Access Control

Update Management

Infrastructure and Business Continuity

Advanced Components and Integration

Application Security and Protection

Governance of Applications

Infrastructure architecture

Infrastructure Protection

Infrastructure Management

Infrastructure Security

Advanced Security Requirements

Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP)

Network architecture

Challenges with Network Management

Network Vulnerabilities

Network Baselines

Key Technologies for Network Security

Network Management

Collaboration Architecture

Summary

Join our community on Discord!

Identity and Access Management

Identity and Access Management Overview

Identification

Authentication

Authorization

Accountability

Modernizing Your Identity Architecture

Identity and Access Management Statistics

Legacy Identity and Access Management

The Need to Modernize

Identity and Access Management Modernization Strategy

Identity and Access Management Modernization Roadmap

Account and Access Management

Identity Life Cycle Process

HR and Identity Management

Directory Services

Hybrid Identities

Cloud Identities

Group Management and RBAC

Service Accounts

External Access

Privileged Access

Governance, Reporting, and Auditing

Securing Your Identities

Directory Services Protection

Privileged Access Strategy

Password Management

Password Vaulting

MFA

Non-User Accounts

SSO

Privileged Accounts

Local Administrative Access

PAM, PIM, and JIT

PoLP and JEA

SoD

Insider Threats

Physical Security

Enhanced Identity Security

Biometrics

Phishing-Resistant MFA

Passwordless

Conditional-Based Policies

Risk-Based Protection

SIEM Integration

Summary

Join our community on Discord!

Cybersecurity Operations

An Overview of Cybersecurity Operations

Security Operations Center (SOC)

Threat Detection

Incident Management and Response

Artificial Intelligence (AI)

Security Operations Center (SOC)

Cybersecurity Operations Model

Traditional Security Operations Center (SOC)

Security Operations Center as a Service (SOCaaS)

Managed Detection and Response (MDR)

Managed Security Services Provider (MSSP)

Hybrid Model

SOC Organization Structure

Log Collection, Analysis, and Automation

Security Information and Event Management (SIEM)

Security Orchestration, Automation, and Response (SOAR)

Extended Detection and Response (XDR)

Processes and SOPs

SLAs and Key Metrics

Governance

Threat Detection

Asset Management and Visibility

Digital Asset Monitoring

Extended Detection and Response (XDR)

Cloud Access Security Broker (CASB)

Threat Intelligence

MITRE ATT&CK

Threat Hunting

Incident Management and Response

Incident Handling and Severity

Incident Reporting Methods

Incident Categorization

Severity Assessment

Incident Investigation

Root Cause Analysis (RCA)

Digital Forensics Incident Response (DFIR)

SOC Analyst Tools

Business Continuity Planning (BCP)

Disaster Recovery Planning (DRP)

Cybersecurity Incident Response Plan (CIRP)

Summary

Join our community on Discord!

Vulnerability Management

Managing Your Vulnerability Program

Building Blocks for Your Program

Program Management and Governance

Asset Management

Vulnerability Discovery and Alerting

Vulnerability Overview

Vulnerability Scanning

External Attack Surface Monitoring

Vulnerability Alerting

Vulnerability Management System

SOC

Threat Intel

External Sources

Vendors

Other

Vulnerability Tracking and Remediation

Tracking Your Vulnerabilities

Scoring

Vulnerability Remediation

Prioritization

Modernizing Your Program

Update Management and Email Protection

Update Deployment

Windows

Other OSes

Browsers

Applications

Email Vulnerability Management

Other Vulnerability Management Considerations

Hardware Vulnerabilities

Virtualization Infrastructure

Network Infrastructure

Cybersecurity Testing

Auditing and Assessments

OT & IoT

Other Activities

Summary

Join our community on Discord!

User Awareness, Training, and Testing

Why the Human Element is the Most Important

Building a User Awareness, Training, and Testing Program

Security Culture and Maturity

Defining Your Program

Ongoing Program Management

Program Management and Governance

User Awareness

Awareness Channels

Portals

Email

Newsletters

User Awareness, Training, and Testing Platform

Other Awareness Channels

Cybersecurity Awareness Month

Policy Awareness

User Awareness Content

Current Trends

User Training and Testing

User Training

Training Schedule

Training Assignment Groups

Training Content

New Hires

Compromised User

Role-Based

User Testing

Testing Schedule

Testing Assignment Groups

Testing Types

Expanding beyond the Traditional Channels of Awareness

Personal Awareness

Real-Life Examples

Consumer Statistics

Personal Protection

External Speakers

Rewards and Recognition

Gamification

Quarterly Cybersecurity Town Halls

Cybersecurity Awareness Week

Cybersecurity Champions

Branding

Mentoring and Development

Summary

Join our community on Discord!

Vendor Risk Management

Understanding Vendor Risk Management

Types of Risk

Vendor Lifecycle Management

Current Landscape

Cybersecurity Risk

Supply Chain Risk

Hardware Compatibility and Certification

Developing a Cybersecurity Vendor Risk Management Program

Policy and Procedures

Roles and Responsibilities

Vendor Management

Cybersecurity Vendor Risk Scoring

Questionnaires

Tiering Vendors

Requirements

Information Collection

Cybersecurity Questionnaire

Third-Party Audit Report

Third-Party Testing Results

Information Security Management Program Documents

Business Continuity Planning (BCP), Cybersecurity Incident Response Plan (CIRP), & Disaster Recovery (DR) Plans

Other Supporting Audit, Risk, and Security Documentation

Cybersecurity Vendor Risk Rating Platform Detailed Report

Risk Management

Governance and Reporting

Integrating a Process Across the Business

Review Process

Escalation Process

Cybersecurity Incident Process

Training

Contract Management

Managing Your Contracts

Types of Contracts

Insurance Requirements

Managing Your Vendors and Ongoing Monitoring

Continuous Monitoring

Annual Reviews

Business Continuity Planning (BCP)

Summary

Join our community on Discord!

Proactive Services

Why Proactive Services?

Cybersecurity Testing

Types of Testing

Penetration Testing

Executing a Penetration Test

Rules of Engagement

Reviewing the Findings

Application Testing

Physical Security Testing

Other Testing Activities

Incident Response Planning

Building an Incident Response Plan

Introduction

Purpose and Scope

Roles and Responsibilities

Communications

Incident Response and Recovery Process

Lessons Learned

Appendix

Playbooks

Tabletop Exercises

What Is a Tabletop Exercise?

Planning a Tabletop Exercise

Executing a Tabletop Exercise

Final Report and Remediation

Other Proactive Services

Threat Briefs

Threat Hunts

Incident Response Training

Disclosure Programs

Ransomware Best Practices

Other

Summary

Join our community on Discord!

Operational Technology and the Internet of Things

What Are OT and IoT?

OT

IoT

Why Securing This Technology Is So Important

OT Statistics

IoT Statistics

A Dedicated Program

Governance, Risk, and Compliance

Cybersecurity Architecture

Identity and Access Management

Cybersecurity Operations

Cybersecurity Awareness, Training, and Testing

Vendor Risk Management

Vulnerability Management

Proactive Services

Protecting OT and IoT Environments

OT Malware

MITRE ATT&CK

ICS Advisories

Best Practices

Responding to OT and IoT Cybersecurity Incidents

BCP and DRP

Incident Response Plan

Tabletop Exercises

Summary

Join our community on Discord!

Governance Oversight

The Importance of Program Governance

Program Structure and Governance

Vendors

Applications

Risk Register

RACM

Audits

Inventory Management (Assets)

Issue Tracker

Policy Management

Business Continuity

Reporting

Policies, Standards, and Processes/Procedures

Defining Policies

Setting Standards

Creating Processes and Building Procedures

Recommending Guidelines

Leadership Management and Communications

Communication Channels

Cybersecurity Committee

Executive Leadership

Board of Directors

Building Reports

Metrics

Dashboards

Other Governance Considerations

Information Protection and Data Loss Prevention

Insider Threat

Data Retention and Information Lifecycle

Contract Management

Resource Management

Summary

Join our community on Discord!

Managing Risk

Everything Is about Risk

Risk Translation

Risk Ownership

Understanding Risk Types

Risk Calculation

Qualitative

Quantitative

Risk Mitigation

Avoid

Transfer

Mitigate

Accept

Risk Frameworks

Tracking Risk

Implementing a Risk Register

Digitizing the Risk Register

The Insurance Landscape

Estimating the Cost of a Breach

Breach Cost Calculator

Understanding Policy Exclusions

Requirements for Cybersecurity Insurance

Coverage Types

Summary

Join our community on Discord!

Regulatory and Compliance

The Evolving Landscape of Regulatory and Compliance

Your Legal Team Is Your Best Friend

The Legal Team’s Responsibilities

Data Breach Notification

Directors and Officers (D&O) Liability Insurance

The Importance of Data Protection

Data Tracking

Data Classification

Data Loss Prevention

The Need for Frameworks and Audits

Validating Controls with Audits

Audit Types

Cybersecurity Frameworks

Privacy Frameworks

Other Regulatory and Compliance Considerations

Privacy

Data Retention

Data Disposal

Legal Hold

E-Discovery

Summary

Join our community on Discord!

Some Final Thoughts

Bringing It All Together

Defining the Program

The Core

Bringing It Together

Your Program Is a Journey

Assess the Current State

Immediate Short-Term

Short-Term

Long-Term

Cybersecurity Roadmap

The Top 10 Considerations

CISO Top 3 Priorities for the Year 2024

User Awareness, Training, and Testing

Governance, Risk, and Compliance

Vendor Risk Management

The Remaining 7 Priorities

Cybersecurity Framework

Zero-Trust Architecture

Implementing Identity Protection and Privileged Access

Update Update Update

SOC Modernization

Incident Preparedness and Response

Cybersecurity Testing

Notable Mentions

Artificial Intelligence (AI)

OT and IoT

Program Strategy

Stay Educated

Some Observations and The Future

Capabilities for anyone

Everyone Needs a Cybersecurity Program

Data Protection

Cloud First

A Passwordless World

Digital Identity

IoT

OT

AI and Deepfakes

Autonomous Vehicles

Microchips

Robotics

Other

Summary

Join our community on Discord!

Other Books You May Enjoy

Index

Landmarks

Cover

Index

Preface

I’m excited to bring to you Resilient Cybersecurity: Reconstruct your defense strategy in an evolving cyber world, which addresses the need for a more robust cybersecurity program for every organization. Every organization should be assessing the current state of their cybersecurity program to ensure that it continues to evolve to meet the needs of today’s ongoing cybersecurity threats. We are in a place where organizations still do not have a dedicated cybersecurity program in place. Unfortunately, this is no longer acceptable, and the risk of a major cybersecurity incident or breach increases significantly. Having a mature cybersecurity program in place doesn’t guarantee that you will not suffer a major cybersecurity incident or breach, but having a mature program in place will reduce the risk and potential impact of a major cybersecurity incident or breach. More importantly, it will best prepare your organization on how to efficiently respond when a major cybersecurity incident occurs. The reality is, it is only matter of ‘when’ and not ‘if’ a major cybersecurity incident or breach occurs.

The idea behind this book is to provide a foundation for your organization’s cybersecurity program that is all-inclusive and can serve as a reference for any organization. The hope with this book is that you can take something meaningful away, even if it is just one piece of information that can be applied to support your cybersecurity program whether you are just getting started, or if you already have one in place. The principles in this book may not necessarily be the same as the ones you have in place today, but I am sharing the knowledge I have gained over the years from building a cybersecurity program from the ground up. The end goal is to share as much knowledge as possible with the optimism that we continue to work together and collaborate as one unified front to better protect the confidentiality, integrity, and availability (also known as the CIA triad) of the data and information being stored and accessed within our organizations.

One area we address in more detail is how critical the CISO role has become within the organization, quickly becoming a figure of significance in a very short period of time, and a role that every organization needs to have in place.

The CISO role continues to evolve at a very fast pace from one that traditionally focused more on the technical controls to protect an organization to a much broader risk-based role that needs to interact with every part of the business. With this evolution, we are entering a new generation and era for the CISO with new and expanded responsibilities and expectations, that of the CISO v2.0. As part of this evolving role, the CISO is not only expected to be technical in nature, but more of a business acumen who is integrated into every part of the business and is able to translate technical risk into more quantifiable and business terms for the leadership teams including the Board of Directors (BoD).

It is also important for today’s CISO to effectively ensure that accountability for cybersecurity is appropriately distributed across the organization, rather than being solely the responsibility of the CISO. Accountability sits at the top of an organization, more specifically with the executive leadership team and the BoD.

It is important to acknowledge that we have come to a critical point with cybersecurity, and it does not look like it is going to get any easier anytime soon. Threat actors are making substantial profits from cybercrime and businesses have been formed to support these ongoing efforts. With the world we live in becoming more interconnected with the advancement of technology and the internet, preventing these crimes has become extremely complex because of cross-border challenges with differing laws and conflicts. Because of this, we all need to focus on the theme of cybersecurity culture for our users, not just within the organization but for everyone’s everyday lives. Cybersecurity should not be an afterthought proceeding forward, but a concept that is engrained in everyone’s mindset with everything they do, including their personal lives. With a cybersecurity culture comes a shared responsibility that we all must hold ourselves accountable for. Everyone MUST take responsibility for the protection of the information they are responsible for within an organization in addition to the information they must protect for their personal lives.

Who this book is for

This book focuses on cybersecurity from a program level in which the following roles who build the strategy and execute the program will primarily benefit from reading:

CISO/CSOOther C-Level or executive leaders who overlook cybersecurityDirectors overlooking cybersecurityProgram Managers

With this book providing insight into all functions of a cybersecurity program, those who work within cybersecurity and help run the program will benefit from understanding what a comprehensive cybersecurity program involves. This will help provide a better understanding of each of the functions they have to interact with and will enable more productive collaboration across functions:

Managers overlooking cybersecurityArchitects involved with cybersecurityEngineers involved with cybersecurityAdministrators involved with cybersecurityAnalysts involved with cybersecurityProject Managers involved with cybersecurityOther roles that are part of the cybersecurity program

In addition, those who are new to cybersecurity or still determining what they would like to do within cybersecurity can also benefit from this book. As you look to enter cybersecurity, it is important you understand everything that is involved and what it takes to run a comprehensive program.

In addition, you will learn what is involved with each of the functions to help with any career decisions you are making.

What this book covers

Chapter 1, Current State, begins the book with insights into the current digital world we live in today. It then goes into detail about the current threat landscape, covering different types of attacks, threat actors, and emerging threats. There is also a focus on the use of statistics for your cybersecurity program and the importance of them. Next, we will take a look at some of the skillset challenges we are currently observing within cybersecurity before finishing the chapter with a look into the need to prioritize well-being, a very important topic.

Chapter 2, Setting the Foundations, focuses on the building blocks for your cybersecurity program. As a cybersecurity leader, it will be critical that you understand the business you are working in and are familiar with how to navigate the business. Next, we review finances and where you can expect costs to be incurred within the program. This transitions into the structure overview for the cybersecurity program with an emphasis on the core functions that should be included.

Next, we cover the need to document the cybersecurity organization structure and roles and responsibilities before finishing off the chapter with a review of change management and communication and their importance.

Chapter 3, Building Your Roadmap, provides an in-depth review of the need to build a roadmap for the cybersecurity organization. This includes the need for good program and project management to provide structure around the program. To build efficient roadmaps, you are going to need to better understand the current state of your organization. Once you understand the current state, you can build roadmaps for the immediate short-term (2-4 months), short-term (9-12 months), and long-term (1-3+ years).

Chapter 4, Solidifying Your Strategy, takes us into more details around the importance of a strategy for your cybersecurity program. Within the chapter, a focus on four key strategic areas is covered. The first is around the architecture strategy for your organization, covering multiple different areas, such as modernization, the need to use cloud-based technologies, zero-trust architecture, and more. The next strategy covered the need for a cybersecurity framework and the importance of needing to implement one. We then look at the need to have a strategy around your vendors and product portfolio with an emphasis on reducing this portfolio as much as possible. Finally, we review resource management and the need for a strategy around in-house vs. outsourced resources.

Chapter 5, Cybersecurity Architecture, covers everything architecture for your cybersecurity program. This begins with an overview of the architecture and the importance of embedding the cybersecurity program as part of the broader architecture process. Following this is an in-depth review of the architecture review process and what should be considered within the process from a cybersecurity perspective. Next, we touch upon the foundation of cybersecurity architecture before going into detail on zero-trust architecture, what is involved, and the importance of it. We then finish off the chapter with a detailed review of the technical architecture components, such as network, infrastructure, data, etc.

Chapter 6, Identity and Access Management, focuses on an in-depth review of everything identity and access management. First is an overview of identity and access management with more details about identity, authentication, authorization, and accountability. We then shift our focus to the need to modernize your identity architecture before diving deeper into account and access management, which includes stepping through the identity lifecycle process. We then look at what you need to consider with securing your identities before finishing the chapter with a look into enhanced identity security and protection methods.

Chapter 7, Cybersecurity Operations, takes us through everything involved with cybersecurity operations for your cybersecurity program. To begin the chapter, an overview of cybersecurity operations is provided with the different components involved within this program. Next is a detailed review of the Security Operations Center (SOC) with insight into the different operating models. We then go into detail about threat detection and what needs to be considered for this component before reviewing incident management and response, which is not to be overlooked. We then finish off the chapter with a look into the importance of Business Continuity Planning (BCP), Disaster Recovery Planning (DRP), and the Cybersecurity Incident Response Plan (CIRP).

Chapter 8, Vulnerability Management, provides a lot of important information on what needs to be considered as part of your vulnerability program. First, we look at why there is a need for a dedicated vulnerability program and the building blocks required for this program. In the section that follows, there is an emphasis on vulnerability discovery and alerting and what should be considered for this component. Next focuses on the importance of tracking your vulnerabilities and the need to ensure remediation is taking place on time. This leads to update management and email protection considerations as part of your vulnerability management activities. The chapter finishes off with a look into other vulnerability management considerations such as hardware, virtualization, network, and more.

Chapter 9, User Awareness, Training, and Testing, covers everything related to the human element. We begin the chapter with an overview of why this component is so important for the organization. Next, we go into detail on building the foundations for your user awareness, training, and testing program with an emphasis on security culture and maturity. This transitions into user awareness and everything that should be considered with awareness for your users. We then go into detail on what is involved with both user training and testing to ensure a comprehensive approach with your users. We finish the chapter with a look into some other areas that should be considered for your user awareness, training, and testing program, such as gamification, bringing in external speakers, cybersecurity town halls, and more.

Chapter 10, Vendor Risk Management, focuses on everything you need to consider for managing cybersecurity risk with your vendors. We begin with a review of vendor risk management and the different types of risk involved with your vendors, in addition to looking at the current landscape and some statistics. Next, we focus on building your cybersecurity vendor risk management foundation and what should be considered for your program. We then review the need to ensure cybersecurity vendor risk management is integrated across the broader business before covering contract management in more detail, which is an important part of the cybersecurity leadership role.

We finish the chapter with insight into managing your vendors in addition to ongoing and continuous monitoring of your vendors.

Chapter 11, Proactive Services, provides insights into everything you should be considering from a proactive perspective to help reduce risk as much as possible. We begin the chapter with an overview of why we need to implement a proactive services program and the importance of executing these types of services. Next, we take a deeper look into cybersecurity testing and the different types of services that should be considered for your program. This transitions into incident response planning, something that should be in place for every organization. We then move on to reviewing tabletop exercises by providing a detailed overview of what they are and how to execute them. To finish the chapter, we cover other proactive services that can be executed with your proactive services program.

Chapter 12, Operational Technology (OT) and the Internet of Things (IoT), begins with an insight into what exactly OT and IoT are, including what Industrial Control Systems (ICS) are and how it fits within OT. We then review why securing both OT and IoT has become so important and the criticality of this technology. We then look at the need for building a dedicated program and what is involved in your OT and IoT programs. Next, we take a deeper look into protecting these environments and what you should consider as part of protecting these environments. We finish off the chapter with a focus on responding to OT and IoT incidents as it will differ from your standard incident response plan. This includes the need to execute tabletop exercises with a theme built around OT and IoT technology.

Chapter 13, Governance Oversight, leads us into the concluding section of the book with an emphasis on Governance, Risk, and Compliance (GRC). In this chapter, we look at the importance of governance for the cybersecurity program. This transitions into the program structure for your GRC program including roles and responsibilities for this program. We then shift our focus over to the need for a GRC application for your organization and what should be included with the GRC application. Next, we go into detail with policies, standards, and processes/procedures for your organization as it relates to cybersecurity. This shifts into ensuring the cybersecurity program is made visible to your leadership team through various communication channels with the need for good and clear reporting. We finish off the chapter with a look into other governance considerations for your governance program.

Chapter 14, Managing Risk, focuses on the importance of risk and everything we need to consider with risk within the cybersecurity program. We begin the chapter with an overview of why risk is so important and how everything we manage within cybersecurity translates back to risk.

This transitions into understanding the different risk types by looking into more detail about how to calculate risk and the different mitigation options for risk. We then transition into a review of risk frameworks and the different frameworks for you to consider for risk management. Next, we look at the importance of tracking risk and the need for a risk register. To finish the chapter, we take a deeper look into the insurance landscape and what is involved with managing cybersecurity insurance.

Chapter 15, Regulatory and Compliance,gives us deeper insight into the evolving complex world of regulatory and compliance within cybersecurity. First, we look into the current landscape of regulatory and compliance and how complicated it can be to navigate, especially at a global level. We then cover the importance of building positive relationships with your legal team and the importance of legal expertise within cybersecurity. This transitions into the importance of data protection for your cybersecurity program before going into detail on the need for frameworks and audits for your cybersecurity program. To finish off the chapter, we look into other regulatory and compliance considerations like privacy, data retention, legal hold capabilities, and more.

Chapter 16, Some Final Thoughts, brings us to the concluding chapter of the book where we take a closer look at bringing everything together and how the overall program has come together. This transitions into discussing the importance of managing your cybersecurity program as a journey as there will be no destination with this program, it continues to evolve. Next, we look at the top ten considerations you should consider for your cybersecurity program including what I consider the current three top priorities for a cybersecurity program at this time. This takes us into the final section of the chapter where we review observations of what the future may hold with cybersecurity.

To get the most out of this book

Ideally, having knowledge of cybersecurity and its concepts will help as you read the book. This book provides a high-level view of a cybersecurity program, and you will be presented with many different topics within cybersecurity. With this, the focus of each topic will be broad versus a deep technical view. In addition, read this book with an open mind on how a cybersecurity program should look. Every organization is different, and every industry comes with its own set of challenges and uniqueness. This book is meant to serve as a foundation for the core functions that you should be considering for your cybersecurity program based on the current threat landscape. Although this will change over time and as cybersecurity leaders, we need to be dynamic and lead with an open mind.

Download the color images

We also provide a PDF file that has color images of the screenshots/diagrams used in this book. You can download it here: https://packt.link/gbp/9781835462515.

Conventions used

There is one text convention used throughout this book.

Bold: Indicates a new term, an important word, or words that you see on the screen. For instance, words in menus or dialog boxes appear in the text like this. For example: “Select System info from the Administration panel.”

Warnings or important notes appear like this.

Tips and tricks appear like this.

Get in touch

Feedback from our readers is always welcome.

General feedback: Email [email protected] and mention the book’s title in the subject of your message. If you have questions about any aspect of this book, please email us at [email protected].

Errata: Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you have found a mistake in this book, we would be grateful if you reported this to us. Please visit http://www.packtpub.com/submit-errata, click Submit Errata, and fill in the form.

Piracy: If you come across any illegal copies of our works in any form on the internet, we would be grateful if you would provide us with the location address or website name. Please contact us at [email protected] with a link to the material.

If you are interested in becoming an author: If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, please visit http://authors.packtpub.com.

Share your thoughts

Once you’ve read Resilient Cybersecurity, First Edition we’d love to hear your thoughts! Please click here to go straight to the Amazon review page for this book and share your feedback.

Your review is important to us and the tech community and will help us make sure we’re delivering excellent quality content.

Download a free PDF copy of this book

Thanks for purchasing this book!

Do you like to read on the go but are unable to carry your print books everywhere?

Is your eBook purchase not compatible with the device of your choice?

Don’t worry, now with every Packt book you get a DRM-free PDF version of that book at no cost.

Read anywhere, any place, on any device. Search, copy, and paste code from your favorite technical books directly into your application.

The perks don’t stop there, you can get exclusive access to discounts, newsletters, and great free content in your inbox daily.

Follow these simple steps to get the benefits:

Scan the QR code or visit the link below:

https://packt.link/free-ebook/9781835462515

Submit your proof of purchase.That’s it! We’ll send your free PDF and other benefits to your email directly.

1

Current State

There doesn’t seem to be a day that goes by that there isn’t a new notice of a cybersecurity breach or some form of cybercrime. Cybersecurity incidents have become so prevalent that they are hitting mainstream media on a regular basis because of their impact. Cyber events are not just causing a small inconvenience to organizations, they are causing substantial financial loss (millions), crippling manufacturing operations, damaging reputations, leaking enormous amounts of Personal Identifiable Information (PII), and in some instances, causing organizations to permanently close their doors.

The discussion around cybersecurity and risk has become a critical agenda item on executive leadership teams, board rooms, and within the highest level of governments. And, the unfortunate reality is, it continues to get more challenging as threat actors continue to become more sophisticated. The question from leadership and board members continues to be asked: Are we secure? The simple answer is no. No one is 100% secure in today’s digital world and we never will be. There will always be risk. As leaders, it is our responsibility to manage and reduce risk as much as possible. We will never eliminate risk entirely, and it is important that those we work for and report to understand this. As cybersecurity leaders, we must create an environment that balances cybersecurity with business enablement and builds a culture around cybersecurity. This includes the need for full transparency, effective collaboration throughout the organization, and most importantly, trust.

As we hear more news of security breaches like the multiple T-Mobile breaches over the years, the Marriott International breach, the Equifax breach, and the Yahoo breach of 3 billion records, the severity of what we are dealing with is evident and requires our utmost attention. The reality is, we all need to do better.

We not only need to hold ourselves accountable, but also those around us and especially those who are trusted to manage, process, and store our data. This is far from an easy task, especially with the emerging complexity of technologies, an attack surface that continues to widen, and the progression of organized cyber and state-sponsored crime groups with budgets and expertise far exceeding that of most organizations.

Because of this, we need to continue to evolve our cybersecurity programs and strategies to meet the demand of modern-day threats such as AI-driven and supply chain-based attacks. As cybersecurity leaders, this in turn means being innovative, creative, dynamic, and agile. We cannot become complacent with the current state because technology and the world we live in are evolving at a faster pace than we’ve ever seen. The hope is that this book can help provide the higher-level strategy and insight into a more modern cybersecurity program, whether you already have a program in place or you are looking to build one from the ground up.

As you read through this chapter, you will learn more details about the current state of cybersecurity and the challenges we face as cybersecurity leaders. Specifically, you will learn about the following:

An evolving digital worldThe current threat landscapeThe importance of statisticsSkillset challengesPrioritizing well-being

An Evolving Digital World

As a cybersecurity leader, it is important to remain current and have a foundational understanding of technology. It is your responsibility to reduce risk within the organization you work for. To do this effectively, you need to understand the technology being used to help make informed decisions on securing that technology. As the digital world continues to evolve at such a fast pace, keeping up with technology isn’t the easiest of tasks. But this is a requirement to be more efficient in your role and you must keep yourself up to date. You may be asking yourself how this is possible. This can be accomplished through many channels such as conferences, communities, research and analyst companies like Gartner and Forester, meeting with your strategic suppliers regularly, user groups/forums, business social media channels like LinkedIn, and so on.

Increasing Reliance on Technology

Whether you believe it’s fortunate or unfortunate, we are living in a connected world where we have never been so reliant on technology that organizations would not be able to survive without. As our younger generations continue to grow, there is an increased demand for the use of technology in everything that we do in life. It’s a scary thought, but look how fast the world has grown within the previous 100 years compared to the overall history of humanity. Technology continues to push the boundaries of innovation, and a significant portion of that change must include the securing of this technology. This has been more evident over the previous 10 years and especially since the world has become a more connected place with the advancement of the internet.

According to the United States Census Bureau, as of the 18th of May, 2024, there is an approximate world population of over 8 billion. Yes, the world population is now over 8 billion:

Figure 1.1: World population clock counter from the United States Census Bureau

Source: https://www.census.gov/popclock/

Let’s put things into perspective with the challenges of the increased digital footprint that we face as cybersecurity leaders in today’s world. A report published in January 2023, on the We Are Social Inc. website, The Digital 2023, shows the following statistics:

There are an estimated 5.44 billion unique mobile phone users and 8.46 billion cellular mobile connections (not including IoT).There are an estimated 5.16 billion internet users.There are an estimated 4.76 billion active social media users.

Source: https://wearesocial.com/us/blog/2023/01/digital-2023/

To provide a clearer picture of how fast both information technology and cybersecurity have grown within the previous 20 years, the following chart shows the rapid growth of internet usage since the early 1990s. Although the need for technology and cybersecurity professionals was present before this time, you can clearly see from the chart below the impact and demand we are dealing with for increased resources in such a short amount of time.

Figure 1.2: Number of people using the internet

Source: The chart above is cited from an article by Hannah Ritchie, Edouard Mathieu, Max Roser, and Esteban Ortiz-Ospina (2023), titled Internet. Published online at OurWorldInData.org. Retrieved from https://ourworldindata.org/internet

As we have become more connected throughout the world, traditional borders that separate countries no longer apply when it comes to technology and cybercrime. The laws of one country will not necessarily be applicable when cybercrime occurs from overseas across these different boundaries. This creates a very complex system for holding accountable those who engage in cybercrime and break the law within other countries.

As technology continues to evolve, transform, and innovate at a pace faster than ever before, it has never been more important to ensure that security is considered a core fundamental of this technology. We are not there yet, and we need to continue to push our vendors, technology companies, and ourselves to ensure that a security-first mindset is applied to everything we do with technology moving forward.

Digital Transformation

In recent years, there has been a lot of hype around digital transformation. This has many meanings depending on your organization and the functions within it. In short, at a broader level, digital transformation is the ability to digitally improve your business and/or processes through modern technology with the replacement of legacy systems and antiquated processes.

An example of this includes the shift from a legacy on-premises infrastructure to a modernized cloud-first strategy to support the evolving needs of big data, Machine Learning (ML), Artificial Intelligence (AI), and more. As we take a look back over the previous couple of years, we tend to see hype rise and fall around certain technologies and innovations. For example, in 2021/22, the metaverse was the latest technology everyone was interested in. Shift forward a year and as of this publication, AI is the center of hype, more specifically generative AI, also known as GenAI. I’m sure you are all aware of generative AI by now, essentially the next generation of AI that can create new content such as text, images, audio, and video using data it has been provided to learn from. A few examples include ChatGPT, Gemini, and Copilot. Chapter 7, Cybersecurity Operations, will cover AI in more detail. We will continue to see these trends and it’s important as cybersecurity leaders that we keep close to these trends and continue to educate ourselves as this change continues to occur.

As we continue to digitize and modernize technology, improved security is needed. A simple example of this is the need for some form of endpoint protection tool. Traditionally, this has been an Anti-Virus (AV) signature-based tool that is capable of blocking already known threats through known signatures. Unfortunately, in today’s world, this type of endpoint protection is no longer appropriate on its own.

Today, the following at minimum needs to be implemented as a replacement for traditional AV signature-based capabilities:

Advanced Threat Protection (ATP) that includes AV and threat protectionEndpoint Detection and Response (EDR)Advanced analytics and behavioral monitoringNetwork protectionExploit protection

This is just a single example of a specific technology within cybersecurity that has become outdated and it’s important you focus on a defense-in-depth strategy using zero-trust principles, which we will cover in more detail in Chapter 5, Cybersecurity Architecture. This includes the need to fully understand the role AI is now playing within cybersecurity and the capabilities available. As cybersecurity leaders, we must keep current with the latest cybersecurity technology.

The Evolving Landscape of Cybersecurity

In addition to the ongoing digital transformation activities, there is also an expectation that we can work and access data from anywhere at any time. With the rapid increase of remote work during 2020 and 2021, this model and expectation have been fast-tracked because of COVID. Although many companies are reversing the remote work model and requiring employees to report back to the office, many are resisting and have an expectation of continuing to work remotely, or at least have the flexibility. With this model comes a much larger responsibility from a cybersecurity perspective. As our infrastructure continues to be modernized and shifted to the cloud, so do the cybersecurity requirements. The focus is no longer primarily the network, protecting our data center and devices within a building, but that of the user’s identity and, more importantly, the data. Financial gain is the primary motivator for threat actors, and data is the underlying driver for that financial gain. Because of this, it is imperative we provide relevant training and awareness for our users as the technologies evolve and the threat vectors change.

As already stated, attacks are becoming more and more sophisticated every day. There is an ever-growing army of threat actors working around the clock trying to exfiltrate any data they can get their hands on because the cost of private data is very expensive. There has also been a shift in the way bad actors are threatening organizations by looking for weakness in the supply chain and holding companies at ransom. With the advancement of cloud technology, supercomputers, and the reality of quantum computing coming to light, hackers and organized groups now have access to much more powerful systems and are easily able to crack passwords and their hashes much easier, making them obsolete as the only factor of authentication.

No one should be using just passwords anymore; however, the reality is, most still are. The same applies to encryption. The advancement of computers is making algorithms insecure with the ongoing need for stronger encryption. These are just some of the ongoing challenges we are faced with in today’s evolving digital world when protecting our assets.

Over the years, cybersecurity has evolved from being a shared role or a role that was non-existent within many companies. Today, well-defined teams and organizational structures exist or are being created to focus solely on cybersecurity. Not only are these teams maturing constantly, but the Chief Information Security Officer (CISO) has become a person of significant importance and in some instances may report directly to a Chief Executive Officer (CEO) instead of the Chief Information Officer (CIO), the Chief Technology Officer (CTO), or another C-level below the CEO. In addition, we are also observing the CISO being invited to the Board of Directors (BoD) quarterly meetings, essentially getting a seat at the table.

Before we move on to the next topic, one additional matter within the digital world that needs mentioning is shadow IT. In short, shadow IT is the setup and use of technology without IT or the security team’s approval or knowledge, for example, in a business function like Human Resources (HR) or finance. This obviously creates a significant security challenge as technology is being deployed with no standards or best practices in place. This can be a challenge to manage, but it will need to be addressed as part of your role, especially as digital transformation continues to occur across the entire business at a very fast pace.

Now that we have covered the evolving digital world, the next section will take us through the current threat landscape and what to expect in terms of current threats.

The Current Threat Landscape

The threat landscape within the cybersecurity world is extremely diverse and is continually becoming more complex. The task of protecting users, data, and systems is becoming more difficult and requires the progression of even more intelligent tools to keep threat actors out.

Common Cyber Threat Actors

Today, cyber criminals are more sophisticated, and large groups have formed with significant financial backing to support the harmful activities of these groups. The following are common threat actors:

National governmentsNation-statesTerroristsAdvanced Persistent Threat (APT) groupsCyber mercenariesCyber arms dealersCyber extortionistsSpiesOrganized crime groupsHacktivistsHackersBusiness competitorsMalicious insiders/internal employeesEssentially anyone who has some malicious intentions with the use of technology

In addition, with the recent rise of GenAI, ChatGPT has transformed the field of cybersecurity in a very short amount of time. Previously, only highly skilled attackers were able to breach organizations. But with ChatGPT, even less skilled hackers can succeed by using AI in their operations. It’s now difficult to judge an attacker’s true level of skill during a sophisticated attack.

Types of Cyberattacks

There are many types of cyberattacks in the world today, and this creates a diverse set of challenges for organizations, especially cybersecurity leaders. One of the most common attack methods used today is that of malware. Malware is software or code designed with malicious intent that exploits vulnerabilities found within the system. The following types of threats are considered malware:

AdwareSpywareVirus (polymorphic, multipartite, macro, or boot sector)WormTrojanRootkitBots/botnetsRansomwareLogic bomb

Ransomware in More Detail

With the prevalence of ransomware and the extreme damage it can inflict on an organization, let’s review this type of cyberattack in more detail. Ransomware has been around for a long time and the first documented incident occurred in 1989, known as PC Cyborg or the AIDS Trojan. In short, a ransomware attack is where an intruder encrypts data belonging to a user or organization, making it inaccessible. For the user or organization to gain access back to their data, they are held to a ransom in exchange for the decryption keys. The intruders will use many tactics to try and force payment, including threats to leak the data, list the data for sale on the dark web, and erase the backups, to name a few.

As the ransomware business continues to evolve, we are hearing that very mature business models have been put in place to support their efforts to hold organizations to ransom. There is even a ransomware-as-a-service model that allows hackers to subscribe and use the service to commit their own attacks. The latest tactic used by ransomware criminals is double extortion – essentially, exfiltrating the data in addition to encrypting it. This provides additional bargaining power for the threat actors and creates a lot more risk for organizations to handle. Unfortunately, there have been countless ransomware attacks to date that have made the news and they continue to occur often.

A couple of the more notable ransomware attacks include that against Colonial Pipeline, one of the largest fuel pipelines in the United States, and MGM Resorts, a global entertainment company. Both companies suffered a major impact: Colonial Pipeline was forced to shut down its fuel distribution operations, causing gas shortages for consumers throughout the East Coast of the United States. MGM Resorts encountered major operational challenges for many days and an estimated loss of approximately $100 million.

Other Types of Attacks

In addition to malware, the following table shows other types of attack techniques that can be used to exploit vulnerabilities and that you should be familiar with:

Main Category

Sub-Categories

Description

Examples

Malware

Virus, Worm, Trojan, Ransomware, Adware, Spyware, Bots/Botnets

Malicious software designed to damage, disrupt, or gain unauthorized access to systems.

ILOVEYOU virus, WannaCry ransomware, Mirai botnet

Social Engineering

Phishing, Spear Phishing, Whaling, Vishing, Smishing, BEC, Pretexting, Tailgating, Baiting

Manipulative techniques to trick individuals into divulging confidential information.

CEO fraud, IRS scam calls, lottery scams, tech support scams

Network Attacks

DoS, DDoS, MITM, DNS Tunneling, ARP Spoofing, IP Spoofing, Session Hijacking, Zero-Day Exploits

Disrupting network operations or exploiting network vulnerabilities for malicious purposes.

SYN flood, Wi-Fi evil twin, rogue DHCP server

Web Application Attacks

SQL Injection, XSS, CSRF, RFI, Command Injection, OWASP Top 10

Exploiting web application vulnerabilities to compromise systems or data.

File upload attacks, broken authentication

Exploitation

Zero-Day, Buffer Overflow, Privilege Escalation, RCE

Utilizing software vulnerabilities for unauthorized actions or data breaches.

Heartbleed, Shellshock, Microsoft Exchange Server vulnerabilities

Password Attacks

Brute Force, Dictionary, Credential Stuffing, Rainbow Table, Keylogger, Password Spraying

Techniques aimed at uncovering or bypassing passwords to gain unauthorized access.

John the Ripper, Hydra, Hashcat

Physical Attacks

Tailgating, Shoulder Surfing, Dumpster Diving, Theft, Device Tampering

Direct physical methods to gain unauthorized access or information.

Unauthorized entry, stolen hardware

IoT Attacks

Mirai Botnet, Connected Device Exploits

Targeting IoT devices for unauthorized access or to create botnets.

Unpatched smart home devices, compromised wearable devices

Cryptocurrency-Related

Cryptojacking, Phishing Scams, Exchange Hacks, 51% Attacks

Attacks aimed at cryptocurrencies, including theft, exchange exploitation, and blockchain attacks.

Fake crypto giveaways, compromised exchanges, malware for mining

Other

APT, Insider Threats, Supply Chain Attacks, Mobile Attacks

Diverse attacks including state-sponsored attacks, malicious insiders, and mobile device targeting.

Stuxnet, data theft by employees, SolarWinds attack, SMS-based malware

Supply Chain Challenges