Executive's Guide to Cyber Risk: Securing the Future Today

Description

A solid, non-technical foundation to help executives and board members understand cyber risk In the Executive's Guide to Cyber Risk: Securing the Future Today, distinguished information security and data privacy expert Siegfried Moyo delivers an incisive and foundational guidance for executives tasked with making sound decisions regarding cyber risk management. The book offers non-technical, business-side executives with the key information they need to understand the nature of cyber risk and its impact on organizations and their growth. In the book, readers will find: Strategies for leading with foresight (as opposed to hindsight) while maintaining the company’s vision and objectivesFocused, jargon-free explanations of cyber risk that liken it to any other business riskComprehensive discussions of the fundamentals of cyber risk that enable executive leadership to make well-informed choices Perfect for chief executives in any functional area, the Executive’s Guide to Cyber Risk also belongs in the libraries of board members, directors, managers, and other business leaders seeking to mitigate the risks posed by malicious actors or from the failure of its information systems. Cover Title Page Copyright Page Contents Foreword Preface Acknowledgments About the Author Chapter 1 Cyber Strategy The Strategy-Centric Approach Introduction Cybersecurity Strategy The Value Proposition of a Cybersecurity Strategy The Executive’s Role in Cybersecurity Strategy Potential Loss Due to Cyber Risks Executive’s Guide to Cybersecurity Strategy Cybersecurity and Information Security Cybersecurity and Trust Cyber Risk Management Next Steps/Reflection A Cybersecurity Strategy Aligned to the Business Objectives An Agile Cybersecurity Strategy That Can React to Changes A Cybersecurity Strategy Supported from the Top Down Start-Ups, Small- and Medium-Sized Enterprises (SMEs) Summary notes Chapter 2 Cyber Value The Value-Centric Approach Introduction Understanding Cyber Value The Value Proposition of Cyber VaR Case Study: The Colonial Pipeline Cyber-Attack Executive’s Guide to Cyber Risk Management Executive’s Guide to FAIR Cyber Value-at-Risk Next Steps Where to Start to with Quantitative Risk Management? How Do You Measure the Efficiency of Cyber Risk Mitigation Controls? Start-Ups and Small- and Medium-Sized Businesses (SMBs) Summary notes Chapter 3 Cyber Compliance The Compliance-Centric Approach Introduction Cyber Compliance The Value Proposition of Cyber Compliance Case Study Executive’s Guide to Cyber Compliance Cyber Compliance Classifications Next Steps and Reflection Summary notes Chapter 4 Cyber Culture The Human-Centric Approach Introduction What Is Culture Anyway? Building a Human-Centric Approach to Risk Management The Value Proposition of a Cyber Culture Case Studies: Human Error Incidents Executive’s Guide to Creating a Risk-Aware Culture Next Steps Start-ups, Small and Medium-Sized Businesses (SMBs) Summary notes Chapter 5 Cyber Resilience The Technology-Centric Approach Introduction Cyber Resilience? The Value Proposition of Cyber Resilience Case Studies The Sony Pictures Data Breach The Equifax Data Breach The Capital One Data Breach The Colonial Pipeline Data Breach Threat Actors? Executive’s Guide to Cyber Resilience How Do Cybersecurity and Cyber Resilience Differ? Resilience Includes Responding to Changing Conditions Next Steps/Reflection How to Get Started Building Resilience into Your Organization Start-ups, Small- and Medium-sized Businesses (SMBs) Summary notes Appendix A: Framework for Improving Critical Infrastructure Cybersecurity Executive Summary 1.0 Framework Introduction 1.1 Overview of the Framework 1.2 Risk Management and the Cybersecurity Framework 2.0 Framework Basics 2.1 1 Framework Core 2.2 2 Framework Implementation Tiers Tier 1: Partial Tier 2: Risk Informed Tier 3: Repeatable Tier 4: Adaptive 2.3 3 Framework Profile 2.4 Coordination of Framework Implementation 3.0 How to Use the Framework 3.1 Basic Review of Cybersecurity Practices 3.2 Establishing or Improving a Cybersecurity Program Notes Appendix B: Risk Management: ISO 31000* Who Is ISO 31000 For? What Are the Benefits for My Business? Why Was It Revised? What Are the Main Differences? Who Was ISO 31000 Developed by? What about Certification? How Do I Get Started? About ISO Appendix C: Privacy by Design The 7 Foundational Principles Implementation and Mapping of Fair Information Practices* Purpose: Scope: Context: 1. Proactive not Reactive; Preventative not Remedial 2. Privacy as the Default 3. Privacy Embedded into Design 4. Full Functionality – Positive-Sum, not Zero-Sum 5. End-to-End Security – Lifecycle Protection 6. Visibility and Transparency 7. Respect for User Privacy Appendix D: KnowBe4 – Free IT Security Tools KnowBe4—Free IT Security Tools Phishing Tools Security Awareness Training Tools Password Tools Email Security Tools Malware Tools Compliance Tools Appendix E: Cyber Resilience Framework by NIST Chapter Two The Fundamentals 2.1 Cyber Resiliency Engineering Framework 2.1.1 Cyber Resiliency Goals 2.1.2 Cyber Resiliency Objectives 2.1.3 Cyber Resiliency Techniques and Approaches 2.1.4 Cyber Resiliency Design Principles 2.1.5 Relationship Among Cyber Resiliency Constructs 2.2 Cyber Resiliency in the System Life Cycle 2.3 Risk Management and Cyber Resiliency Generalized Cyber Resiliency Constructs Cyber Resiliency in the System Life Cycle Chapter Three Cyber Resiliency in Practice 3.1 Selecting and Prioritizing Cyber Resiliency Constructs 3.1.1 Achievement of Goals and Objectives 3.1.2 Cyber Risk Management Strategy 3.1.3 System Type 3.1.4 Cyber Resiliency Conflicts and Synergies 3.1.5 Other Disciplines and Existing Investments 3.1.6 Architectural Locations 3.1.7 Effects on Adversaries, Threats, and Risks 3.1.8 Maturity and Potential Adoption 3.2 Analytic Practices and Processes 3.2.1 Understand the Context 3.2.2 Develop the Cyber Resiliency Baseline 3.2.3 Analyze the System 3.2.4 Define and Analyze Specific Alternatives 3.2.5 Develop Recommendations References Index EULA