Cybersecurity Policy Guidebook

Autorentext

JENNIFER L. BAYUK, PhD, is an independent cybersecurity consultant, CEO of Decision Framework Systems, and cybersecurity professor. Previously a Wall Street CISO and Bell Labs security software engineer, she has numerous publications on security architecture, risk management, and cybersecurity forensics. ART EHUAN is Executive Director of Duke University's Master of Engineering in Cybersecurity and CISO Executive Certificate programs. A former FBI Supervisory Special Agent, he served as cyber expert on breaches at Heartland, Sony Pictures, Target, Anthem, Equifax, Capital One, and Marriott. JASON HEALEY is a Senior Research Scholar at Columbia University's School for International and Public Affairs. He founded the Atlantic Council's Cyber Statecraft Initiative and was a founding member of the White House Office of the National Cyber Director. PAUL ROHMEYER, PhD, is an IT management consultant and Information Systems faculty member at Stevens Institute of Technology. He serves on the editorial boards of Computers & Security Journal and Cybersecurity & Cybercrime Journal, with expertise spanning banking, finance, healthcare, and life sciences. MARCUS H. SACHS, PE, is Senior Vice President and Chief Engineer at the Center for Internet Security. A retired U.S. Army officer and former White House appointee, he previously served as CSO of the North American Electric Reliability Corporation and VP for National Security Policy at Verizon. DONALD SAXINGER is a financial sector cyber consultant following a career as an FDIC banking supervisor and Section Chief. In those roles, he managed oversight for data center examinations, chaired the FFIEC Examination Handbook, Cybersecurity, and Critical Infrastructure Working Groups, authored cybersecurity guidance, and led interagency rulemaking. JOSEPH WEISS, PE, is Managing Partner of Applied Control Solutions, LLC, an independent control system cybersecurity consultant. An ISA Life Fellow and member of Control's Process Automation Hall of Fame, he has published over 100 papers and holds patents on instrumentation, control systems, and OT networks.

Klappentext

Sound guidance on design, implementation, and governance of cybersecurity policy Now in its Second Edition, the Cybersecurity Policy Guidebook delivers an issue-focused treatment of public, private, and individual cybersecurity policy alternatives for treatment of systemic cyber risks. Seven practitioners from government, industry, and academia analyze overlapping perspectives of decision-makers, technology professionals, and critical infrastructure engineers within the recently transformed digital landscape. The first edition focused on policy issues related to ubiquitous cybersecurity threats, internet governance policies, and policy debates on cyber risk management. This edition focuses on current cyber policy debates such as AI's impact on cybersecurity, custodial issues for technology platforms, and imminent cyber threats to critical infrastructure, while retaining the first edition's historical context. Cybersecurity Policy Guidebook serves leaders of public and private organizations, as well as technology professionals, industry analysts, scholars, and individuals seeking a structured reference on cybersecurity policy issues. Whatever the starting point of perspective, readers will gain the policy knowledge required to act with precision.

Inhalt

Chapter 1. Building Blocks

1.1 Definitions

1.2 Cybersecurity Policy Domains

1.2.1 Individuals

1.2.2 Organizations

1.2.3 Dependencies

1.2.4 Adversaries

1.2.5 Cyberspace

1.2.6 Public Policy

1.3 Cybersecurity Policy Catalog

Chapter 2 Cybersecurity Evolution

2.1 The Dawn of the internet

2.2 Timeline

1960s

1970s

1980s

1990s

2000s

2010s

2020s

2.3 Ongoing Challenges

Chapter 3 Cybersecurity Policy Objectives

3.1 Cybersecurity Risk Issues

3.2 Governance and Management

3.2.1 Cybersecurity Policy

3.2.2 Procedures

3.2.3 Guidelines

3.3 Metrics

3.4 Risk Management

3.4.1 Financial Services

3.4.1.1 Contagion Mechanisms

3.4.1.2 Illustrative Contagion Scenarios

3.4.1.3 Contagion Accelerators

3.4.1.4 Case Study: The SWIFT Banking Network

3.4.1.5 From Institutional Risk to Systemic Risk

3.4.1.6 Additional Cybersecurity Challenges in Financial Services

3.4.2 Industrial Control Systems (ICS)

3.4.2.1 Control System Functions

3.4.1.4 Case Study: Stuxnet

3.4.2.2 Operational Technology

3.4.2.3 Level 0

3.4.2.4 Ongoing Challenges

3.4.3. Technology Platforms

3.4.3.1 Dispossession

3.4.3.2 Case Study: Cambridge Analytica

3.4.3.3 Technology Platform Industry Standards

3.4.3.5 Ongoing Technology Platform Cybersecurity Challenges

3.4.4 Artificial Intelligence (AI)

3.4.4.1 Cybersecurity Risk Issues Unique to AI

3.4.4.2 AI Case Study

3.4.4.3 AI Cybersecurity Standards

3.4.4.4 AI Anthropomorphism

3.4.4.3 Ongoing Artificial Intelligence Challenges

3.5 Conclusion

Chapter 4 Cybersecurity Communication

4.1 Cybersecurity Frameworks

4.1.1 Governance and Oversight Frameworks

4.1.2 Cybersecurity Program Frameworks

4.1.3 Dependency Frameworks

4.1.4 Assessing Framework Compliance

4.2 Threats and Vulnerabilities

4.2.1 Threats

4.2.1 Cybersecurity Incidents

4.2.2 Vulnerabilities

4.2.3 Vulnerability Marketplaces

4.3 Institutions for Communication and Collaboration

4.3.1 FIRST

4.3.2 The National Incident Management System and Cybersecurity Incident Coordination

4.3.3 National Infrastructure Protection Plan

4.4 Trend Analysis

4.5 Communication Challenges

4.5.1 Organizational Challenges

4.5.2 IT, OT, and ICS

4.5.3 Vulnerability Reporting

4.5.4 Public/Private Conflicts

4.5.5 Crisis Communications Systems

4.6 Conclusion

Chapter 5 Guidance for Decision Makers

5.1 Innovation, Change, and Risk

5.2 Governance

5.4 Strategic Choices

5.5 Focus on Risk and Controls

5.6 Policy Essentials

5.7 Moving from Policy to Implementation

5.7.1 Implementation of the Controls Architecture

5.8 Conclusion

Chapter 6 The Cybersecurity Workforce

6.1 Cybersecurity versus Engineering

6.2 Academic Curriculum on Cybersecurity

6.3 Certification of Cybersecurity Professionals

6.4 Cybersecurity Job Roles

6.5 Conclusion

Chapter 7: One Government's Approach to Cyber Security Policy

7.1 US Federal Cyber Security Strategy

7.2 Infrastructure Awareness and Early Coordination

7.2.1 The Bombing of New York's World Trade Center

7.2.2 Cyber Attacks Against the United States Air

7.2.3 The Citibank Caper

7.2.4 Murrah Federal Building, Oklahoma City

7.2.5 Presidential Decision Directive 39

7.2.6 President's Commission on Critical Infrastructure Protection

7.2.7 Eligible Receiver

7.2.8 Solar Sunrise

7.2.9 Presidential Decision Directive 63

7.2.10 National Infrastructure Protection Center (NIPC) and Information Sharing and Analysis Centers (ISACs)

7.2.12 Joint Task Force - Computer Network Defense (JTF-CND)

7.3 Homeland Security and Federal Consolidation

7.3.1 Terrorist Attacks Against the USA

7.3.2 US Government Response to the September 11, 2001 Terrorist Attacks

7.3.3 Homeland Security Presidential Directives in the Bush Administration

7.3.4 National Strategies in the Bush Administration

7.3.5 First National-Level DDoS Campaign, Estonia

7.3.6 Cyber-Kinetic Coordination, Georgia

7.3.7 Buckshot Yankee (Agent.btz)

7.4 Operationalization of Cyber Power

7.4.1 Early Cyber Warfare, Stuxnet

7.4.2 State Sponsored Espionage

7.4.3 US Cyber Command

7.4.4 Expansion of USCYBERCOM Service Cyber Components

7.4.5 Notable events

7.4.6 Congressional Actions

7.4.7 Federal Cybersecurity and Infrastructure Executive Orders

7.5 Institutional Maturation and Strategic Competition

7.5.1 Integration of Cyber with Joint Operations Doctrine

7.5.2 The Rise of Ransomware as a National Security Threat

7.5.3 C…