Table of Contents
About the Authors
About the Technical Reviewers
Acknowledgments
Introduction
Please check our GitHub page
Chapter 1: The Cybersecurity Challenge
Types of Threats
Who Are These People?
How Do Cyberattacks Happen?
What Can We Do?
Summary
Chapter 2: International Security Standards
ISO 27001 and ISO 27002
Information Security Policies (Clause A.5)
Organization of Information Security (Clause A.6)
Human Resource Security (Clause A.7)
Before Hiring
Employees
Termination and reassignment
Asset Management (Clause A.8)
Access Control (Clause A.9)
Cryptography (Clause A.10)
Physical and Environmental Security (Clause A.11)
Operations Security (Clause A.12)
Communications Security (Clause A.13)
System Acquisition, Development, and Maintenance (Clause A.14)
Supplier Relationships (Clause A.15)
Incident Management (Clause A.16)
Business Continuity Management (Clause A.17)
Compliance (Clause A.18)
ISO 27002
PCI DSS
Goal 1: Build and Maintain a Secure Network
Goal 2: Protect Cardholder Data
Goal 3: Maintain a Vulnerability Management Program
Goal 4: Implement Strong Access Control Measures
Goal 5: Regularly Monitor and Test Networks
Goal 6: Maintain a Policy That Addresses Information Security
Prioritization
SWIFT: Customer Security Controls Framework
Summary
Chapter 3: Information Security Frameworks
NIST Frameworks
NIST SP 800-53: Security and Privacy Controls for Federal Information Systems and Organizations
NIST SP 800-37: Guide for Applying the Risk Management Framework to Federal Information Systems
NIST Cybersecurity Framework
COBIT 5 for Information Security
COBIT 5 Process Goals Applied to Information Security
Other Regulatory Frameworks
CIS Controls
Saudi Arabia Monetary Authority (SAMA) Cybersecurity Framework
Reserve Bank of India
FIFA World Cup Qatar 2022
Monetary Authority of Singapore
BDDK
Others
Summary
Chapter 4: IT Security Technical Controls
Off-Premises Unmanaged Devices
MDM: Mobile Device Management
MAM: Mobile Application Management
NAC: Network Access Control
Multi-Factor Authentication
RASP for Mobile Applications
Secure Connections
OSI Model
TCP/IP Model
IPsec, SSH, and TLS
IPsec
SSH
TLS
Clean Pipes
DDoS Mitigation
Managed Devices
Directory Service Integration
Centralized Endpoint Management
TPM: Trusted Platform Module
VPN Client
NAC: Network Access Control
Data Classification
UAM: User Activity Monitoring
Endpoint Protection
Phishing Reporting Tool
Host IPS or EDR
Desktop Firewall
Antivirus
Antispyware
Full-Disk Encryption
Application Control and Application Whitelisting
Perimeter Security
Firewalls
Intrusion Detection and Intrusion Protection Systems
Proxy and Content (URL) Filtering
DLP: Data Loss Prevention
Honeypot
WAF: Web Application Firewall
SSL VPN
DNS
Internal DNS Servers
External DNS Servers
Message Security
Directory Integration for External Applications
Sandbox
File Integrity
Encrypted Email
On-Premises Support Controls
Access Control
Secure VLAN Segmentation
Security Baselines
Redundancy
Load Balancing
Encryption
Multi-tier and Multi-layer
Multi-layering
Multi-tiering
TLS Decryption
Perimeter Static Routing
Heartbeat Interfaces
Disaster Recovery
Time Synchronization
Log Concentrator
Routing and Management Networks
Management Networks
Perimeter Routing Networks
Centralized Management
Physical Network Segmentation
Sinkhole
Public Key Infrastructure
Security Monitoring and Enforcement
Privileged Access Management
Security Information and Event Management
Database Activity Monitoring
Single Sign-on
Risk Register
Chapter 5: Corporate Information Security Processes and Services
Security Governance
Policies and Procedures
Cybersecurity and Risk Assessment
Penetration Testing
Red Teaming
Code Review and Testing
Compliance Scans
Vulnerability Scans
CVSS: Common Vulnerability Scoring System
CVE: Common Vulnerabilities and Exposures
CCE: Common Configuration Enumeration
CPE: Common Platform Enumeration
XCCDF: Extensible Configuration Checklist Description Format
OVAL: Open Vulnerability and Assessment Language
Vulnerability Scanning Procedures
Firewalls and Network Devices Assurance
Security Operations Center
Incident Response and Recovery
Preparation
Detection and Analysis
Containment, Eradication, and Recovery
Post-Incident Activity
Threat Hunting
Threat Intelligence
Security Engineering
Asset Management
Media Sanitation
Configuration and Patch Management
Security Architecture
Chapter 6: People
Security Awareness
Security Training
Chapter 7: Security Metrics
Governance and Oversight
Antivirus and Anti-Malware Metrics
Clean Pipes
Network Security
Internet Access: Proxy and Content Filtering
Security Awareness and Training
Firewall Management
Enterprise Mobility Management
Incident Management and Response
Vulnerability Management
Penetration Testing, Code Review, and Security Assessments
Change Management
Access Control
Other Metrics
Summary
Chapter 8: Case Studies
Target Data Breach
DynDNS Distributed Denial-of-Service Attack
NHS WannaCry Ransomware
Chapter 9: Security Testing and Attack Simulation Tools
Penetration Testing Tools
Information Gathering and Intelligence
Sniffers
Vulnerability Scanning
Web Application Vulnerability Scanning
SQL Injection
Network Tools
Breach and Attack Simulation
System Information Tools
Password Cracking
Session Hijacking
Steganography
Windows Log Tools
Wireless Network Tools
Bluetooth Attacks
Website Mirroring
Intrusion Detection
Mobile Devices
Social Engineering
IoT (Internet of Things)
User Awareness: eLearning
Forensics and Incident Response
HoneyPots
Summary
Appendix 1: IT Security Technical Controls, Processes, and Services Matrix
Appendix 2: Information Security Certifications
Appendix 3: Knowledge, Skills and Abilities (KSAs)
Appendix 4: Resource Library
Index