Book Image

Cybersecurity Threats, Malware Trends, and Strategies - Second Edition

By : Tim Rains
3 (2)
Book Image

Cybersecurity Threats, Malware Trends, and Strategies - Second Edition

3 (2)
By: Tim Rains

Overview of this book

Tim Rains is Microsoft's former Global Chief Security Advisor and Amazon Web Services’ former Global Security Leader for Worldwide Public Sector. He has spent the last two decades advising private and public sector organizations all over the world on cybersecurity strategies. Cybersecurity Threats, Malware Trends, and Strategies, Second Edition builds upon the success of the first edition that has helped so many aspiring CISOs, and cybersecurity professionals understand and develop effective data-driven cybersecurity strategies for their organizations. In this edition, you’ll examine long-term trends in vulnerability disclosures and exploitation, regional differences in malware infections and the socio-economic factors that underpin them, and how ransomware evolved from an obscure threat to the most feared threat in cybersecurity. You’ll also gain valuable insights into the roles that governments play in cybersecurity, including their role as threat actors, and how to mitigate government access to data. The book concludes with a deep dive into modern approaches to cybersecurity using the cloud. By the end of this book, you will have a better understanding of the threat landscape, how to recognize good Cyber Threat Intelligence, and how to measure the effectiveness of your organization's cybersecurity strategy.

Related Content you might be interested in

Current Title:

Small book image
Cybersecurity Threats, Malware Trends, and Strategies - Second Edition
Tim Rains
Jan, 2023 | 584 pages
Small book image
Aligning Security Operations with the MITRE ATT&CK Framework
Rebecca Blair
May, 2023 | 192 pages
Small book image
The Cybersecurity Playbook for Modern Enterprises
Jeremy Wittkop
Mar, 2022 | 280 pages
Small book image
Cybersecurity and Privacy Law Handbook.
Walter Rocchi
Dec, 2022 | 230 pages
Table of Contents (15 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Get in touch
Share your thoughts
1
Introduction
Introduction
Different types of CISOs: “The CISO Spectrum”
How organizations get initially compromised and the cybersecurity fundamentals
Focus on the cybersecurity fundamentals
Understanding the difference between attackers’ motivations and tactics
Summary
References
Free Chapter
2
What to Know about Threat Intelligence
What to Know about Threat Intelligence
What is threat intelligence?
Where does CTI data come from?
Using threat intelligence
Threat intelligence sharing
How to identify credible cyber threat intelligence
Summary
References
3
Using Vulnerability Trends to Reduce Risk and Costs
Using Vulnerability Trends to Reduce Risk and Costs
Introduction
Vulnerability Management Primer
Vulnerability Disclosure Data Sources
Industry Vulnerability Disclosure Trends
Vulnerability Management Guidance
Summary
References
4
The Evolution of Malware
The Evolution of Malware
Introduction
Why is there so much malware on Windows compared to other platforms?
Data sources
About malware
Global Windows malware infection analysis
Regional Windows malware infection analysis
Global malware evolution
The evolution of ransomware
The great debate – are anti-malware solutions really worthwhile?
Summary
References
5
Internet-Based Threats
Internet-Based Threats
Introduction
A typical attack
Phishing attacks
Drive-by download attacks
Malware-hosting sites
Post compromise – botnets and DDoS attacks
Summary
References
6
The Roles Governments Play in Cybersecurity
The Roles Governments Play in Cybersecurity
The pursuit of happiness
Governments as cybersecurity market participants
Governments as standards bodies
Governments as enforcers
Governments as defenders
Summary
References
7
Government Access to Data
Government Access to Data
Understanding government access to data
Lawful government access to data
Mitigating government access to data
Conclusion
Summary
References
8
Ingredients for a Successful Cybersecurity Strategy
Ingredients for a Successful Cybersecurity Strategy
What is a cybersecurity strategy?
Other ingredients for a successful strategy
Summary
References
9
Cybersecurity Strategies
Cybersecurity Strategies
Introduction
Measuring the efficacy of cybersecurity strategies
Cybersecurity strategies
Protect and Recover Strategy
Endpoint Protection Strategy
Physical control and security clearances as a security strategy
Compliance as a Security Strategy
Application-Centric Strategy
Identity-Centric Strategy
Data-Centric Strategy
Attack-Centric Strategy
Zero Trust
Cybersecurity strategies summary
DevOps and DevSecOps
Summary
References
10
Strategy Implementation
Strategy Implementation
Introduction
What is an Intrusion Kill Chain?
Modernizing the Kill Chain
Getting started
Implementing this strategy
Designing control sets
Conclusion
Summary
References
11
Measuring Performance and Effectiveness
Measuring Performance and Effectiveness
Introduction
Using vulnerability management data
Measuring the performance and efficacy of an Attack-Centric Strategy
Summary
References
12
Modern Approaches to Security and Compliance
Modern Approaches to Security and Compliance
Introduction
How is cloud computing different?
Security and compliance game changers
Using cybersecurity strategies in the cloud
Encryption and key management
Conclusion
Summary
References
13
Other Books You May Enjoy
Other Books You May Enjoy
14
Index
Index

Summary

Cyber Threat Intelligence (CTI) provides organizations with data and information on potential cyber threats. Those threats can include various categories of malware, exploitation of vulnerabilities, web-based attacks, Distributed Denial of Service (DDoS) attacks, social engineering attacks, and others. Open Source Threat Intelligence (OSINT) leverages publicly available data sources such as social media, news feeds, court filings and arrest records, attackers’ disclosed information on their victims, activity in illicit forums, and many others.

Cybersecurity programs can make use of CTI in several ways including in Security Operations Centers (SOCs), to inform Cybersecurity Incident Response Teams’ (CIRT) investigations, to inform threat hunting, Red, Blue, and Purple teams’ efforts, and many others. Understanding the tactics, techniques, and procedures (TTPs) that attackers employ can provide some concrete ideas on how they can be mitigated. A tactic is the reason the attacker performs a particular action. Many security teams also use Indicators of Compromise (IOCs) to help determine if their enterprise IT environments have been compromised. Where TTPs can help protect, detect, and respond to attacks, IOCs can help post-compromise to try to determine when and how the initial compromise happened, and what the attackers did with their illicit access afterward.

The Traffic Light Protocol (TLP) has become a popular protocol for sharing CTI and other types of information. The “traffic light” analogy in this case has four colors: red, amber, green, and clear. The colors are used to communicate different information-sharing boundaries, as specified by the sender.

This chapter provided some context to help you understand the analysis of various threats in the next three chapters: Chapter 3, Using Vulnerability Trends to Reduce Risk and Costs, Chapter 4, The Evolution of Malware, and Chapter 5, Internet-Based Threats.

Previous Section
End of Section 7
Next Section