Cybersecurity Threats, Malware Trends, and Strategies: Discover risk mitigation strategies for modern threats to your organization

Cover
Copyright page
Contributors
Preface
Chapter 1: Introduction
	Different types of CISOs: “The CISO Spectrum”
	How organizations get initially compromised and the cybersecurity fundamentals
		Unpatched vulnerabilities
		Security misconfigurations
		Weak, leaked, and stolen credentials
		Social engineering
		Insider threats
	Focus on the cybersecurity fundamentals
	Understanding the difference between attackers’ motivations and tactics
	Summary
	References
Chapter 2: What to Know about Threat Intelligence
	What is threat intelligence?
	Where does CTI data come from?
	Using threat intelligence
		The key to using threat intelligence
	Threat intelligence sharing
		CTI sharing protocols
			Traffic Light Protocol
			STIX and TAXII
		Reasons not to share CTI
	How to identify credible cyber threat intelligence
		Data sources
		Time periods
		Recognizing hype
		Predictions about the future
		Vendors’ motives
	Summary
	References
Chapter 3: Using Vulnerability Trends to Reduce Risk and Costs
	Introduction
	Vulnerability Management Primer
	Vulnerability Disclosure Data Sources
	Industry Vulnerability Disclosure Trends
		Vendor and Product Vulnerability Trends
		Reducing Risk and Costs – Measuring Vendor and Product Improvement
			Microsoft Vulnerability Trends
			Oracle Vulnerability Trends
			Google Vulnerability Trends
			Debian Vulnerability Trends
			Apple Vulnerability Trends
			Vendor Vulnerability Trend Summary
		Operating System Vulnerability Trends
			Google Android Vulnerability Trends
			Apple iOS Vulnerability Trends
			Mobile Operating System Summary
			Microsoft Windows 10 Vulnerability Trends
			Apple macOS Vulnerability Trends
			Desktop Operating System Summary
			Ubuntu Linux Vulnerability Trends
			Linux Kernel Vulnerability Trends
			Microsoft Windows Server 2016 Vulnerability Trends
			Server Operating System Summary
		Web Browser Vulnerability Trends
			Apple Safari Vulnerability Trends
			Google Chrome Vulnerability Trends
			Web Browser Summary
		Vulnerability Improvement Framework Summary
	Vulnerability Management Guidance
	Summary
	References
Chapter 4: The Evolution of Malware
	Introduction
	Why is there so much malware on Windows compared to other platforms?
	Data sources
		The Malicious Software Removal Tool
		Real-time anti-malware tools
		Non-security data sources
	About malware
		How malware infections spread
		Trojans
		Potentially unwanted software
		Exploits and exploit kits
		Worms
		Ransomware
		Viruses
		Browser modifiers
		Measuring malware prevalence
	Global Windows malware infection analysis
	Regional Windows malware infection analysis
		The threat landscape in the Middle East and Northern Africa
			10-year regional report card for the Middle East and Northern Africa
		The threat landscape in the European Union and Eastern Europe
			10-year regional report card for the European Union
			10-year regional report card for select Eastern European locations
		The threat landscape in select locations in Asia and Oceania
			10-year regional report card for Asia and Oceania
		The threat landscape in select locations in the Americas
			10-year regional report card for the Americas
		Regional Windows malware infection analysis conclusions
		What does this all mean for CISOs and enterprise security teams?
	Global malware evolution
		Global malware evolution conclusions
	The evolution of ransomware
		Delivery mechanisms
		Execution mechanisms
		Ransom payment methods
		Ransom demands and communications
		Business model
	The great debate – are anti-malware solutions really worthwhile?
	Summary
	References
Chapter 5: Internet-Based Threats
	Introduction
	A typical attack
	Phishing attacks
		Mitigating phishing
	Drive-by download attacks
	Mitigating drive-by download attacks
	Malware-hosting sites
		Mitigating malware distribution
	Post compromise – botnets and DDoS attacks
	Summary
	References
Chapter 6: The Roles Governments Play in Cybersecurity
	The pursuit of happiness
	Governments as cybersecurity market participants
	Governments as standards bodies
	Governments as enforcers
		Regulators
		Law enforcement
	Governments as defenders
		Public safety
		National security
		Military
	Summary
	References
Chapter 7: Government Access to Data
	Understanding government access to data
		The signals intelligence scenario
		The unlawful government access to data scenario
		The lawful government access to data scenario
	Lawful government access to data
		The CLOUD Act and the PATRIOT Act
		Managing the risk of government access to data
			The volume of law enforcement requests
			The probability of US law enforcement accessing data in the cloud
			The GDPR, FISA Section 702, and Schrems II
			The Probability of US Intelligence Accessing Data in the Cloud
	Mitigating government access to data
		Setting and understanding the scope
		Setting realistic objectives
		Planning data protection controls
	Conclusion
	Summary
	References
Chapter 8: Ingredients for a Successful Cybersecurity Strategy
	What is a cybersecurity strategy?
	Other ingredients for a successful strategy
		Business objective alignment
		Cybersecurity vision, mission, and imperatives
		Senior executive and board support
		Understand the risk appetite
		Realistic view of current cybersecurity capabilities and technical talent
		Compliance program and control framework alignment
		An effective relationship between cybersecurity and IT
		Security culture
	Summary
	References
Chapter 9: Cybersecurity Strategies
	Introduction
	Measuring the efficacy of cybersecurity strategies
	Cybersecurity strategies
	Protect and Recover Strategy
		CFSS score
		Protect and Recover Strategy summary
	Endpoint Protection Strategy
		CFSS score
		Endpoint Protection Strategy summary
	Physical control and security clearances as a security strategy
		CFSS score
		Physical Control and Security Clearances Strategy summary
	Compliance as a Security Strategy
		CFSS score
		Compliance as a Security Strategy summary
	Application-Centric Strategy
		CFSS score
		Application-Centric Strategy summary
	Identity-Centric Strategy
		CFSS score
		Identity-Centric Strategy summary
	Data-Centric Strategy
		CFSS score
		Data-Centric Strategy summary
	Attack-Centric Strategy
		CFSS score
		Attack-Centric Strategy summary
	Zero Trust
		CFSS score
	Cybersecurity strategies summary
	DevOps and DevSecOps
	Summary
	References
Chapter 10: Strategy Implementation
	Introduction
	What is an Intrusion Kill Chain?
	Modernizing the Kill Chain
		Mapping the Cybersecurity Usual Suspects
		Updating the matrix
		Intrusion Kill Chain or ATT&CK?
	Getting started
		Maturity of current cybersecurity capabilities
		Pervasiveness of current cybersecurity capabilities
		Who consumes the data?
		Cybersecurity license renewals
	Implementing this strategy
		Rationalizing the matrix – gaps, under-investments, and over-investments
			Identifying gaps
			Identifying areas of under-investment
			Identifying areas of over-investment
		Planning your implementation
	Designing control sets
		Attack phase – Reconnaissance I
			Example controls for Reconnaissance I
			Insights from ATT&CK
		Attack phase – Delivery
			Example controls for Delivery
			Insights from ATT&CK
		Attack phase – Exploitation
			Example controls for Exploitation
			Insights from ATT&CK
		Attack phase – Installation
			Example controls for Installation
			Insights from ATT&CK
		Attack phase – Command and Control (C2)
			Example controls for C2
			Insights from ATT&CK
		Attack phase – Reconnaissance II
			Example controls for Reconnaissance II
			Insights from ATT&CK
		Attack phase – Actions on Objectives
			Example controls for Actions on Objectives
			Insights from ATT&CK
	Conclusion
	Summary
	References
Chapter 11: Measuring Performance and Effectiveness
	Introduction
	Using vulnerability management data
		Assets under management versus total assets
		Known unpatched vulnerabilities
		Unpatched vulnerabilities by severity
		Vulnerabilities by product type
	Measuring the performance and efficacy of an Attack-Centric Strategy
		Performing intrusion reconstructions
		Using intrusion reconstruction results
			Identifying lame controls
			Learning from failure
			Identifying helpful vendors
			Informing internal assessments
		Adversary emulations leveraging ATT&CK
	Summary
	References
Chapter 12: Modern Approaches to Security and Compliance
	Introduction
	How is cloud computing different?
		Cloud Service Providers versus Managed Service Providers
		Migrating to the cloud
		Cybersecurity assessment questionnaires
	Security and compliance game changers
		The power of APIs
		The advantages of automation
			Mitigating insider threat and social engineering
			Mitigating unpatched vulnerabilities
			Mitigating security misconfigurations
			Mitigating weak, leaked and stolen credentials
		Security and compliance game changers – summary
	Using cybersecurity strategies in the cloud
		Using the protect and recover strategy in the cloud
		Compliance as a Cybersecurity Strategy in the cloud
		Using the Attack-Centric Strategy in the cloud
		DevOps – A modern approach to security in the cloud
		Disaster Recovery in the cloud
	Encryption and key management
	Conclusion
	Summary
	References
Packt page
Other Books You May Enjoy
Index