Executive's Guide to Cyber Risk: Securing the Future Today

Cover
Title Page
Copyright Page
Contents
Foreword
Preface
Acknowledgments
About the Author
Chapter 1 Cyber Strategy The Strategy-Centric Approach
	Introduction
	Cybersecurity Strategy
	The Value Proposition of a Cybersecurity Strategy
	The Executive’s Role in Cybersecurity Strategy
		Potential Loss Due to Cyber Risks
	Executive’s Guide to Cybersecurity Strategy
		Cybersecurity and Information Security
		Cybersecurity and Trust
		Cyber Risk Management
	Next Steps/Reflection
		A Cybersecurity Strategy Aligned to the Business Objectives
		An Agile Cybersecurity Strategy That Can React to Changes
		A Cybersecurity Strategy Supported from the Top Down
		Start-Ups, Small- and Medium-Sized Enterprises (SMEs)
	Summary
	notes
Chapter 2 Cyber Value The Value-Centric Approach
	Introduction
	Understanding Cyber Value
	The Value Proposition of Cyber VaR
	Case Study: The Colonial Pipeline Cyber-Attack
	Executive’s Guide to Cyber Risk Management
	Executive’s Guide to FAIR Cyber Value-at-Risk
	Next Steps
		Where to Start to with Quantitative Risk Management?
		How Do You Measure the Efficiency of Cyber Risk Mitigation Controls?
		Start-Ups and Small- and Medium-Sized Businesses (SMBs)
	Summary
	notes
Chapter 3 Cyber Compliance The Compliance-Centric Approach
	Introduction
	Cyber Compliance
	The Value Proposition of Cyber Compliance
	Case Study
	Executive’s Guide to Cyber Compliance
	Cyber Compliance Classifications
	Next Steps and Reflection
	Summary
	notes
Chapter 4 Cyber Culture The Human-Centric Approach
	Introduction
	What Is Culture Anyway?
	Building a Human-Centric Approach to Risk Management
		The Value Proposition of a Cyber Culture
	Case Studies: Human Error Incidents
	Executive’s Guide to Creating a Risk-Aware Culture
	Next Steps
		Start-ups, Small and Medium-Sized Businesses (SMBs)
	Summary
	notes
Chapter 5 Cyber Resilience The Technology-Centric Approach
	Introduction
		Cyber Resilience?
	The Value Proposition of Cyber Resilience
	Case Studies
		The Sony Pictures Data Breach
		The Equifax Data Breach
		The Capital One Data Breach
		The Colonial Pipeline Data Breach
	Threat Actors?
	Executive’s Guide to Cyber Resilience
		How Do Cybersecurity and Cyber Resilience Differ?
		Resilience Includes Responding to Changing Conditions
	Next Steps/Reflection
		How to Get Started
		Building Resilience into Your Organization
		Start-ups, Small- and Medium-sized Businesses (SMBs)
	Summary
	notes
Appendix A: Framework for Improving Critical Infrastructure Cybersecurity
	Executive Summary
	1.0 Framework Introduction
	1.1 Overview of the Framework
	1.2 Risk Management and the Cybersecurity Framework
	2.0 Framework Basics
	2.1 1 Framework Core
	2.2 2 Framework Implementation Tiers
		Tier 1: Partial
		Tier 2: Risk Informed
		Tier 3: Repeatable
		Tier 4: Adaptive
	2.3 3 Framework Profile
	2.4 Coordination of Framework Implementation
	3.0 How to Use the Framework
	3.1 Basic Review of Cybersecurity Practices
	3.2 Establishing or Improving a Cybersecurity Program
	Notes
Appendix B: Risk Management: ISO 31000*
	Who Is ISO 31000 For?
	What Are the Benefits for My Business?
	Why Was It Revised?
	What Are the Main Differences?
		Who Was ISO 31000 Developed by?
	What about Certification?
	How Do I Get Started?
	About ISO
Appendix C: Privacy by Design The 7 Foundational Principles Implementation and Mapping of Fair Information Practices*
	Purpose:
	Scope:
	Context:
	1. Proactive not Reactive; Preventative not Remedial
	2. Privacy as the Default
	3. Privacy Embedded into Design
	4. Full Functionality – Positive-Sum, not Zero-Sum
	5. End-to-End Security – Lifecycle Protection
	6. Visibility and Transparency
	7. Respect for User Privacy
Appendix D: KnowBe4 – Free IT Security Tools
	KnowBe4—Free IT Security Tools
	Phishing Tools
	Security Awareness Training Tools
	Password Tools
	Email Security Tools
	Malware Tools
	Compliance Tools
Appendix E: Cyber Resilience Framework by NIST
	Chapter Two
		The Fundamentals
	2.1 Cyber Resiliency Engineering Framework
		2.1.1 Cyber Resiliency Goals
		2.1.2 Cyber Resiliency Objectives
		2.1.3 Cyber Resiliency Techniques and Approaches
		2.1.4 Cyber Resiliency Design Principles
		2.1.5 Relationship Among Cyber Resiliency Constructs
	2.2 Cyber Resiliency in the System Life Cycle
	2.3 Risk Management and Cyber Resiliency
		Generalized Cyber Resiliency Constructs
		Cyber Resiliency in the System Life Cycle
	Chapter Three
		Cyber Resiliency in Practice
	3.1 Selecting and Prioritizing Cyber Resiliency Constructs
		3.1.1 Achievement of Goals and Objectives
		3.1.2 Cyber Risk Management Strategy
		3.1.3 System Type
		3.1.4 Cyber Resiliency Conflicts and Synergies
		3.1.5 Other Disciplines and Existing Investments
		3.1.6 Architectural Locations
		3.1.7 Effects on Adversaries, Threats, and Risks
		3.1.8 Maturity and Potential Adoption
	3.2 Analytic Practices and Processes
		3.2.1 Understand the Context
		3.2.2 Develop the Cyber Resiliency Baseline
		3.2.3 Analyze the System
		3.2.4 Define and Analyze Specific Alternatives
		3.2.5 Develop Recommendations
	References
Index
EULA