Theoretical Cybersecurity: Principles and Advanced Concepts

Table of Contents
About the Authors
About the Technical Reviewer
Disclaimer
Chapter 1: Introduction
	What Is It?
	What Is It Not?
		Case Study
			Observation
			Theoretical Concept
			Experiment
			Results
			Conclusions
		Case Study Analysis
			Cyber Sniff Test
				Observation and Theory
				Experimentation
				Implications for Implementation
	Summary
Chapter 2: A Cyber Taxonomy
	A Case of Identity Crisis
		Cybersecurity Analyst
		Cybersecurity Engineer
		Comparison
	Taxonomy of the Profession
	Our Taxonomy
		Types of Cybersecurity
			Detect
			Investigate
			Create
			Operate
			Architect
			Audit
			Analyze
			Emulate
		Functional Subsets
			Data Functions
			System Functions
		Framework Functions
		Antagonist Functions
	Actional Subsets
		Reactive
		Proactive
	Analogy
		Detective
		Investigative
		Create
		Operate
		Architects
		Auditors
		Intelligence Creators
		Adversary Emulation
	So, What’s the Point?
	The Tradecraft Concepts
	Summary
Chapter 3: Cost Benefit
	Warning
	Real Motivation
		Examples
			Industry Wide Example: Retention
			Defensive Cybersecurity Example: Metrics
			Offensive Cybersecurity Example: Reporting
	Understanding Cost Benefit Perspectives
		Cost Benefit to the Target
		Cost Benefit to the Attacker
		Summary
	Understanding Cost Benefit Implications
		Risk and Work Are Never Destroyed (ish)
		Poor Evaluation of Cost Benefit Implications
		Good Cost Benefit Implications Evaluation
	A Litmus Test for Cost Benefit
	Summary
Chapter 4: Roles and Responsibilities
	Responsibilities to Shed
		Case Study 1
			What Happened
			Why It Is Inappropriate
			Who Is Responsible
		Case Study 2
			What Happened
			Why It Is Inappropriate
			Who Is Responsible
		Case Study 3
			What Happened
			Why It Is Inappropriate
			Who Is Responsible
	Responsibilities to Embrace
		Example: Be Your Own Enemy
	Learning to Leverage the Non-Cyber
		Example 1
		Example 2
	Building the Right Size Box
		Step 1: Know Thy Cyber-Self
		Step 2: Prevent What Is Known
		Step 3: Know Thy Strategic Self
		Step 4: Leverage Non-Cyber
		Step 5: Calibrate and Implement
		Step 6: Reassessment
	Summary
Chapter 5: Experimentation
	Identifying Requirements for Defensible Evaluation
		Controlled and Realistic Environment
	Defensible Configuration
	Defensible Operation
		Defensible Emulation of a Motivated and Sophisticated Attacker
		Measurable Results and Metrics
	Evaluation Mediums
		Real Network and Operators with Real Attackers
		Real Network and Operators with Simulated Attackers
		Lab Network with Real Attackers
		Lab Network with Simulated Attacker
		Evaluation Mediums Summary
	Experimentation Example
		Experiment Design
		Target Determination to Support Realistic Network
		Experiment Summary
		Lab Design
		Lab Network Operating Systems
		Experiment Metrics
		Personnel Requirements
		Control Network and Related Documentation Created
		Network Audited for Realism and Functionality
		Control Network Cloned
		Red Team Assessment
		Audit of Red Team Recommendations by Red Team Auditor
		Audit of Red Team Recommendations by Systems Administration Auditor
		Audit of CAPTR Team Recommendations by Systems Administration Auditor
		Verification of CAPTR Teamer Recommended Changes
	Addressing Defensibility Requirements
	Summary
Chapter 6: Strategic Cybersecurity
	What It Is Not
		A Move Toward Resiliency
		On Cybersecurity Insurance
	Counter-APT Red Teaming
		Outcome-Oriented Scoping
		Worst-Case Risk Assessment
		Survivability
		CAPTR Team Critical Initialization Perspective
	Reverse Red Teaming
		Reverse Pivot Chaining
			Local Assessment
			Analysis of Local Intelligence
			Reverse Pivoting
		CAPTR Reporting
			Web of Reverse Risk Relationships
			Math Is Hard
			A Discussion on CAPTR Reporting Cost Benefit
	Application of Strategic Cybersecurity
		The Classic Approach
		The Strategic Approach
	Summary
Chapter 7: Strategic Defensive Security
	Architecture
		The Classic Approach
		The Strategic Approach
	Monitor and Detect
		The Classic Approach
		The Strategic Approach
	Investigate
		The Classic Approach
		The Strategic Approach
	Frameworks
	Auditing
	Theoretical Case Studies
		The Architecture of Accountable Sectors
		Military Resiliency
Chapter 8: Infinite Cybersecurity
	The Infinite Game
		The Lesson
	Infinite Cybersecurity
		Weaknesses and a Strength
			Time
			Money
			Information and Access
		Finite Battles in an Infinite War
	Applying the Theory
		Adversary as a Service (AaaS)
		Attacking the Curve
			Cost Benefit Refined
	Summary
Chapter 9: Cybersecurity and Game Theory
	The Infinite Cybersecurity Game
	Players in the Cybersecurity Game
	States in the Cybersecurity Game
	Actions in the Cybersecurity Game
	Payoffs in the Cybersecurity Game
	Knowledge and Beliefs in the Cybersecurity Game
	Modeling the Cybersecurity Game
	Analysis of the Cybersecurity Game
	Subgame Analysis
Chapter 10: Game Theory Case Study: Ransomware
	Introduction
	Payoff and Recovery
	Reputation
	Payoff Negotiation
	Ransom Response, Mitigation, and Retaliation
	Activation and Demand
	Deployment
	Selection
	Capability Development
		Deployment
		Activation, Demand, Mitigation, Retaliation, Recovery
		Response, Negotiation, Payoff
		Attacker Types
		Target Selection
	Summary
Index