8 Steps to Better Security

KIM CRAWLEY focuses on researching and writing about cybersecurity issues. Her career has included work with Sophos, AT&T Cybersecurity, BlackBerry Cylance, Tripwire, and Venafi. She specializes in all matters red team, blue team, and purple team and is especially fascinated by malware, social engineering, and advanced persistent threats. She runs an online cybersecurity event called DisInfoSec.

Foreword xi

Introduction xiii

Chapter 1: Step 1: Foster a Strong Security Culture 1

Kevin Mitnick, Human Hacker Extraordinaire 3

The Importance of a Strong Security Culture 5

Hackers Are the Bad Guys, Right? 6

What is Security Culture? 7

How to Foster a Strong Security Culture 9

Security Leaders on Security Culture 12

What Makes a Good CISO? 13

The Biggest Mistakes Businesses Make When It Comes to Cybersecurity 14

The Psychological Phases of a Cybersecurity Professional 15

Chapter 2: Step 2: Build a Security Team 19

Why Step 2 is Controversial 20

How to Hire the Right Security Team. . .the Right Way 28

Security Team Tips from Security Leaders 29

The “Culture Fit”—Yuck! 30

Cybersecurity Budgets 34

Design Your Perfect Security Team 35

Chapter 3: Step 3: Regulatory Compliance 39

What Are Data Breaches, and Why Are They Bad? 40

The Scary Truth Found in Data Breach Research 45

An Introduction to Common Data Privacy Regulations 49

The General Data Protection Regulation 49

The California Consumer Privacy Act 50

The Health Insurance Portability and Accountability Act 52

The Gramm-Leach-Bliley Act 52

Payment Card Industry Data Security Standard 53

Governance, Risk Management, and Compliance 53

More About Risk Management 54

Threat Modeling 55

Chapter 4: Step 4: Frequent Security Testing 57

What is Security Testing? 58

Security Testing Types 58

Security Audits 58

Vulnerability Assessments Versus Penetration Testing 59

Red Team Testing 61

Bug Bounty Programs 61

What’s Security Maturity? 63

The Basics of Security Audits and Vulnerability Assessments 64

Log Early, Log Often 66

Prepare for Vulnerability Assessments and Security Audits 67

A Concise Guide to Penetration Testing 69

Penetration Testing Based on Network Knowledge 70

Penetration Testing Based on Network Aspects 73

Security Leaders on Security Maturity 76

Security Testing is Crucial 78

Chapter 5: Step 5: Security Framework Application 79

What is Incident Response? 80

Preparation 80

Identification or Analysis 82

Containment, Mitigation, or Eradication 83

Recovery 84

Post-incident 86

Your Computer Security Incident Response Team 86

Cybersecurity Frameworks 89

NIST Cybersecurity Framework 89

Identify 90

Protect 92

Detect 95

Respond 97

Recover 99

ISO 27000 Cybersecurity Frameworks 101

CIS Controls 102

COBIT Cybersecurity Framework 105

Security Frameworks and Cloud Security 106

Chapter 6: Step 6: Control Your Data Assets 109

The CIA Triad 110

Access Control 112

Patch Management 113

Physical Security and Your Data 115

Malware 116

Cryptography Basics 119

Bring Your Own Device and Working from Home 123

Data Loss Prevention 124

Managed Service Providers 126

The Dark Web and Your Data 128

Security Leaders on Cyber Defense 130

Control Your Data 132

Chapter 7: Step 7: Understand the Human Factor 133

Social Engineering 134

Phishing 139

What Can NFTs and ABA Teach Us About Social Engineering? 141

How to Prevent Social Engineering Attacks on Your Business 146

UI and UX Design 147

Internal Threats 148

Hacktivism 152

Chapter 8: Step 8: Build Redundancy and Resilience 155

Understanding Data and Networks 156

Building Capacity and Scalability with the Power of the Cloud 158

Back It Up, Back It Up, Back It Up 161

RAID 162

What Ransomware Taught Business About Backups 164

Business Continuity 167

Disaster Recovery 168

Chapter 9: Afterword 173

Step 1 173

The Most Notorious Cyberattacker Was Actually a Con Man 174

A Strong Security Culture Requires All Hands on Deck 174

Hackers Are the Good Guys, Actually 174

What Is Security Culture? 175

What Makes a Good CISO? 175

The Psychological Phases of a Cybersecurity Professional 176

Recommended Readings 177

Step 2 178

Tackling the Cybersecurity Skills Gap Myth 178

Take “Culture Fit” Out of Your Vocabulary 179

Your Cybersecurity Budget 180

Recommended Readings 180

Step 3 181

Data Breaches 181

Data Privacy Regulations 182

Risk Management 183

Recommended Readings 183

Step 4 184

Security Audits 184

Vulnerability Assessments 185

Penetration Testing 185

Bug Bounty Programs 185

Recommended Reading 186

Step 5 187

Incident Response 187

Cybersecurity Frameworks 187

Recommended Reading 188

Step 6 188

The CIA Triad 188

Access Control 189

Patch Management 189

Physical Security 189

Malware 189

Cryptography 190

BYOD and Working from Home 190

Data Loss Prevention 191

Managed Service Providers 191

Recommended Reading 191

Step 7 192

Social Engineering 192

UI and UX Design 193

Internal Threats 193

Recommended Readings 194

Step 8 194

Cloud Networks 195

Data Backups 195

Business Continuity and Disaster Recovery 196

Recommended Readings 196

Keeping Your Business Cyber Secure 197

Index 199