book

Cybersecurity Threats, Malware Trends, and Strategies - Second Edition

Name: Cybersecurity Threats, Malware Trends, and Strategies - Second Edition
Author: Tim Rains
ISBN: 9781804613672

by Tim Rains

January 2023

Intermediate to advanced

584 pages

17h 24m

English

Packt Publishing

Read now

Unlock full access

Preface
Who this book is forWhat this book coversTo get the most out of this bookGet in touchShare your thoughts
Introduction
Different types of CISOs: “The CISO Spectrum”How organizations get initially compromised and the cybersecurity fundamentalsUnpatched vulnerabilitiesSecurity misconfigurationsWeak, leaked, and stolen credentialsSocial engineeringInsider threatsFocus on the cybersecurity fundamentalsUnderstanding the difference between attackers’ motivations and tacticsSummaryReferences
What to Know about Threat Intelligence
What is threat intelligence?Where does CTI data come from?Using threat intelligenceThe key to using threat intelligenceThreat intelligence sharingCTI sharing protocolsTraffic Light ProtocolSTIX and TAXIIReasons not to share CTIHow to identify credible cyber threat intelligenceData sourcesTime periodsRecognizing hypePredictions about the futureVendors’ motivesSummaryReferences
Using Vulnerability Trends to Reduce Risk and Costs
IntroductionVulnerability Management PrimerVulnerability Disclosure Data SourcesIndustry Vulnerability Disclosure TrendsVendor and Product Vulnerability TrendsReducing Risk and Costs – Measuring Vendor and Product ImprovementMicrosoft Vulnerability TrendsOracle Vulnerability TrendsGoogle Vulnerability TrendsDebian Vulnerability TrendsApple Vulnerability TrendsVendor Vulnerability Trend SummaryOperating System Vulnerability TrendsGoogle Android Vulnerability TrendsApple iOS Vulnerability TrendsMobile Operating System SummaryMicrosoft Windows 10 Vulnerability TrendsApple macOS Vulnerability TrendsDesktop Operating System SummaryUbuntu Linux Vulnerability TrendsLinux Kernel Vulnerability TrendsMicrosoft Windows Server 2016 Vulnerability TrendsServer Operating System SummaryWeb Browser Vulnerability TrendsApple Safari Vulnerability TrendsGoogle Chrome Vulnerability TrendsWeb Browser SummaryVulnerability Improvement Framework SummaryVulnerability Management GuidanceSummaryReferences
The Evolution of Malware
IntroductionWhy is there so much malware on Windows compared to other platforms?Data sourcesThe Malicious Software Removal ToolReal-time anti-malware toolsNon-security data sourcesAbout malwareHow malware infections spreadTrojansPotentially unwanted softwareExploits and exploit kitsWormsRansomwareVirusesBrowser modifiersMeasuring malware prevalenceGlobal Windows malware infection analysisRegional Windows malware infection analysisThe threat landscape in the Middle East and Northern Africa10-year regional report card for the Middle East and Northern Africa The threat landscape in the European Union and Eastern Europe10-year regional report card for the European Union10-year regional report card for select Eastern European locationsThe threat landscape in select locations in Asia and Oceania10-year regional report card for Asia and OceaniaThe threat landscape in select locations in the Americas10-year regional report card for the AmericasRegional Windows malware infection analysis conclusionsWhat does this all mean for CISOs and enterprise security teams?Global malware evolutionGlobal malware evolution conclusionsThe evolution of ransomwareDelivery mechanismsExecution mechanismsRansom payment methodsRansom demands and communicationsBusiness modelThe great debate – are anti-malware solutions really worthwhile?SummaryReferences
Internet-Based Threats
IntroductionA typical attackPhishing attacksMitigating phishingDrive-by download attacksMitigating drive-by download attacksMalware-hosting sitesMitigating malware distributionPost compromise – botnets and DDoS attacksSummaryReferences
The Roles Governments Play in Cybersecurity
The pursuit of happinessGovernments as cybersecurity market participantsGovernments as standards bodiesGovernments as enforcersRegulatorsLaw enforcementGovernments as defendersPublic safetyNational securityMilitarySummaryReferences
Government Access to Data
Understanding government access to dataThe signals intelligence scenarioThe unlawful government access to data scenarioThe lawful government access to data scenarioLawful government access to dataThe CLOUD Act and the PATRIOT ActManaging the risk of government access to dataThe volume of law enforcement requestsThe probability of US law enforcement accessing data in the cloudThe GDPR, FISA Section 702, and Schrems IIThe Probability of US Intelligence Accessing Data in the CloudMitigating government access to dataSetting and understanding the scopeSetting realistic objectivesPlanning data protection controlsConclusionSummaryReferences
Ingredients for a Successful Cybersecurity Strategy
What is a cybersecurity strategy?Other ingredients for a successful strategy Business objective alignmentCybersecurity vision, mission, and imperativesSenior executive and board supportUnderstand the risk appetiteRealistic view of current cybersecurity capabilities and technical talentCompliance program and control framework alignmentAn effective relationship between cybersecurity and ITSecurity cultureSummaryReferences
Cybersecurity Strategies
IntroductionMeasuring the efficacy of cybersecurity strategiesCybersecurity strategiesProtect and Recover StrategyCFSS score Protect and Recover Strategy summaryEndpoint Protection StrategyCFSS scoreEndpoint Protection Strategy summaryPhysical control and security clearances as a security strategyCFSS scorePhysical Control and Security Clearances Strategy summaryCompliance as a Security StrategyCFSS scoreCompliance as a Security Strategy summaryApplication-Centric StrategyCFSS scoreApplication-Centric Strategy summaryIdentity-Centric StrategyCFSS scoreIdentity-Centric Strategy summaryData-Centric StrategyCFSS scoreData-Centric Strategy summaryAttack-Centric StrategyCFSS scoreAttack-Centric Strategy summaryZero TrustCFSS scoreCybersecurity strategies summaryDevOps and DevSecOpsSummaryReferences

Strategy Implementation
IntroductionWhat is an Intrusion Kill Chain?Modernizing the Kill ChainMapping the Cybersecurity Usual SuspectsUpdating the matrixIntrusion Kill Chain or ATT&CK?Getting startedMaturity of current cybersecurity capabilitiesPervasiveness of current cybersecurity capabilitiesWho consumes the data?Cybersecurity license renewalsImplementing this strategyRationalizing the matrix – gaps, under-investments, and over-investmentsIdentifying gapsIdentifying areas of under-investmentIdentifying areas of over-investmentPlanning your implementationDesigning control setsAttack phase – Reconnaissance IExample controls for Reconnaissance IInsights from ATT&CKAttack phase – DeliveryExample controls for DeliveryInsights from ATT&CKAttack phase – ExploitationExample controls for ExploitationInsights from ATT&CKAttack phase – InstallationExample controls for InstallationInsights from ATT&CKAttack phase – Command and Control (C2)Example controls for C2Insights from ATT&CKAttack phase – Reconnaissance IIExample controls for Reconnaissance IIInsights from ATT&CKAttack phase – Actions on ObjectivesExample controls for Actions on ObjectivesInsights from ATT&CKConclusionSummaryReferences
Measuring Performance and Effectiveness
IntroductionUsing vulnerability management dataAssets under management versus total assetsKnown unpatched vulnerabilitiesUnpatched vulnerabilities by severityVulnerabilities by product typeMeasuring the performance and efficacy of an Attack-Centric StrategyPerforming intrusion reconstructionsUsing intrusion reconstruction resultsIdentifying lame controlsLearning from failureIdentifying helpful vendorsInforming internal assessmentsAdversary emulations leveraging ATT&CKSummaryReferences
Modern Approaches to Security and Compliance
IntroductionHow is cloud computing different?Cloud Service Providers versus Managed Service ProvidersMigrating to the cloudCybersecurity assessment questionnairesSecurity and compliance game changersThe power of APIsThe advantages of automationMitigating insider threat and social engineeringMitigating unpatched vulnerabilities Mitigating security misconfigurations Mitigating weak, leaked and stolen credentialsSecurity and compliance game changers – summaryUsing cybersecurity strategies in the cloudUsing the Protect and Recover Strategy in the cloudCompliance as a Cybersecurity Strategy in the cloudUsing the Attack-Centric Strategy in the cloud DevOps – A modern approach to security in the cloud Disaster Recovery in the cloudEncryption and key managementConclusionSummaryReferences
Other Books You May Enjoy
Index

Content preview from Cybersecurity Threats, Malware Trends, and Strategies - Second Edition

10 Strategy Implementation

In the previous chapter, I discussed numerous cybersecurity strategies. In this chapter, I’ll take one of those strategies and illustrate how it can be implemented in a real IT environment. The objective is to take the theoretical and make it a little more real for you. I’ll provide some tips and tricks I’ve learned in my career along the way.

In this chapter we will cover the following:

What is the Intrusion Kill Chain?
Some ways that the traditional Kill Chain model can be modernized
Factors to consider when planning and implementing this model
Designing security control sets to support this model

Since the MITRE ATT&CK® framework is also popular, very useful, and complementary to the Intrusion Kill Chain, I’ll ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Cybersecurity Threats, Malware Trends, and Strategies

Publisher Resources

ISBN: 9781804613672

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Cybersecurity Threats, Malware Trends, and Strategies - Second Edition

by Tim Rains

10

Strategy Implementation

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.