Developing Cybersecurity Programs and Policies in an AI-Driven World

AvOmar Santos

Häftad, Engelska, 2024

Del i serien Pearson IT Cybersecurity Curriculum (ITCC)

626 kr

Beställningsvara. Skickas inom 7-10 vardagar. Fri frakt över 249 kr.

Beskrivning

ALL THE KNOWLEDGE YOU NEED TO BUILD CYBERSECURITY PROGRAMS AND POLICIES THAT WORK

Clearly presents best practices, governance frameworks, and key standards

Includes focused coverage of healthcare, finance, and PCI DSS compliance

An essential and invaluable guide for leaders, managers, and technical professionals

Today, cyberattacks can place entire organizations at risk. Cybersecurity can no longer be delegated to specialists: Success requires everyone to work together, from leaders on down. Developing Cybersecurity Programs and Policies in an AI-Driven World offers start-to-finish guidance for establishing effective cybersecurity in any organization. Drawing on more than two decades of real-world experience, Omar Santos presents realistic best practices for defining policy and governance, ensuring compliance, and collaborating to harden the entire organization.

Santos begins by outlining the process of formulating actionable cybersecurity policies and creating a governance framework to support these policies. He then delves into various aspects of risk management, including strategies for asset management and data loss prevention, illustrating how to integrate various organizational functions—from HR to physical security—to enhance overall protection. This book covers many case studies and best practices for safeguarding communications, operations, and access; alongside strategies for the responsible acquisition, development, and maintenance of technology. It also discusses effective responses to security incidents. Santos provides a detailed examination of compliance requirements in different sectors and the NIST Cybersecurity Framework.

LEARN HOW TO

Establish cybersecurity policies and governance that serve your organization’s needs
Integrate cybersecurity program components into a coherent framework for action
Assess, prioritize, and manage security risk throughout the organization
Manage assets and prevent data loss
Work with HR to address human factors in cybersecurity
Harden your facilities and physical environment
Design effective policies for securing communications, operations, and access
Strengthen security throughout AI-driven deployments
Plan for quick, effective incident response and ensure business continuity
Comply with rigorous regulations in finance and healthcare
Learn about the NIST AI Risk Framework and how to protect AI implementations
Explore and apply the guidance provided by the NIST Cybersecurity Framework

Produktinformation

Utgivningsdatum:2024-09-19
Mått:175 x 230 x 35 mm
Vikt:1 247 g
Format:Häftad
Språk:Engelska
Serie:Pearson IT Cybersecurity Curriculum (ITCC)
Antal sidor:768
Upplaga:4
Förlag:Pearson Education
ISBN:9780138074104

Utforska kategorier

Nätverk och kommunikation inom Data och IT

Mer om författaren

Omar Santos is a Distinguished Engineer at Cisco, focusing on artificial intelligence (AI) security, cybersecurity research, incident response, and vulnerability disclosure. He is a board member of the OASIS Open standards organization and the founder of OpenEoX. Omar’s collaborative efforts extend to numerous organizations, including the Forum of Incident Response and Security Teams (FIRST) and the Industry Consortium for Advancement of Security on the Internet (ICASI). Omar is the co-chair of the FIRST PSIRT Special Interest Group (SIG). Omar is the co-founder of the DEF CON Red Team Village and the chair of the Common Security Advisory Framework (CSAF) technical committee. Omar is the author of more than 25 books, 21 video courses, and more than 50 academic research papers. He is a renowned expert in ethical hacking, vulnerability research, incident response, and AI security. He employs his deep understanding of these disciplines to help organizations stay ahead of emerging threats. His dedication to cybersecurity has made a significant impact on technology standards, businesses, academic institutions, government agencies, and other entities striving to improve their cybersecurity programs. Prior to working for Cisco, Omar served in the U.S. Marines, focusing on the deployment, testing, and maintenance of Command, Control, Communications, Computer and Intelligence (C4I) systems. You can find Omar at: X: @santosomarLinkedIn: https://www.linkedin.com/in/santosomar

Innehållsförteckning

Introduction xviiiChapter 1: Understanding Cybersecurity Policy and Governance 2Information Security vs. Cybersecurity Policies.. . . . . . . . . . . . . . . . 6Looking at Policy Through the Ages.. . . . . . . . . . . . . . . . . . . . 6Cybersecurity Policy.. . . . . . . . . . . . . . . . . . . . . . . . . . 10Cybersecurity Policy Life Cycle.. . . . . . . . . . . . . . . . . . . . . . 28Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34Chapter 2: Cybersecurity Policy Organization, Format, and Styles 46Policy Hierarchy.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 47Writing Style and Technique.. . . . . . . . . . . . . . . . . . . . . . . 51Plain Language Techniques for Policy Writing.. . . . . . . . . . 53Policy Format.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69Chapter 3: Cybersecurity Frameworks 80Confidentiality, Integrity, and Availability (CIA). . . . . . . . . . . . . . . . 81What Is a Cybersecurity Framework?.. . . . . . . . . . . . . . . . . . . 94NIST Cybersecurity Framework.. . . . . . . . . . . . . . . . . . . . . 110Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118Chapter 4: Cloud Security 132Why Cloud Computing?.. . . . . . . . . . . . . . . . . . . . . . . . 133Cloud Computing Models.. . . . . . . . . . . . . . . . . . . . . . . . 139Cloud Governance. . . . . . . . . . . . . . . . . . . . . . . . . . . 141Multitenancy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150Core Components of the Cloud Computing Reference Architecture.. . . . . . 151Key Concepts and Functional Layers of Cloud Computing. . . . . . . . . . 152Understanding Top Cybersecurity Risks in Cloud Computing. . . . . . . . . 153AI and the Cloud: Revolutionizing the Future of Computing.. . . . . . . . . . 166Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168Chapter 5: Governance and Risk Management 176Understanding Cybersecurity Policies. . . . . . . . . . . . . . . . . . . 177Cybersecurity Risk. . . . . . . . . . . . . . . . . . . . . . . . . . . 197Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207Chapter 6: Asset Management and Data Loss Prevention 220Information Assets and Systems.. . . . . . . . . . . . . . . . . . . . . 221Information Classification.. . . . . . . . . . . . . . . . . . . . . . . . 224Labeling and Handling Standards.. . . . . . . . . . . . . . . . . . . . 233Information Systems Inventory.. . . . . . . . . . . . . . . . . . . . . . 236Understanding Data Loss Prevention Technologies.. . . . . . . . . . . . . 242Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245Chapter 7: Human Resources Security and Education 256The Employee Life Cycle. . . . . . . . . . . . . . . . . . . . . . . . 257The Importance of Employee Agreements.. . . . . . . . . . . . . . . . . 269The Importance of Security Education and Training. . . . . . . . . . . . . 272Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278Chapter 8: Physical and Environmental Security 290Understanding the Secure Facility Layered Defense Model.. . . . . . . . . . 292Protecting Equipment.. . . . . . . . . . . . . . . . . . . . . . . . . 299Environmental Sustainability. . . . . . . . . . . . . . . . . . . . . . . 308Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310Chapter 9: Cybersecurity Operations (CyberOps), Incident Response, Digital Forensics, and Threat Hunting 320Incident Response.. . . . . . . . . . . . . . . . . . . . . . . . . . . 321What Happened? Investigation and Evidence Handling.. . . . . . . . . . . 349Understanding Threat Hunting.. . . . . . . . . . . . . . . . . . . . . . 351Understanding Digital Forensic Analysis.. . . . . . . . . . . . . . . . . . 357Data Breach Notification Requirements. . . . . . . . . . . . . . . . . . 360Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 368Chapter 10: Access Control Management 384Access Control Fundamentals.. . . . . . . . . . . . . . . . . . . . . . 385Infrastructure Access Controls.. . . . . . . . . . . . . . . . . . . . . . 399User Access Controls.. . . . . . . . . . . . . . . . . . . . . . . . . 416Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422Chapter 11: Supply Chain Security, Information Systems Acquisition, Development, and Maintenance 434Strengthening the Links: A Deep Dive into Supply Chain Security.. . . . . . . 435System Security Requirements.. . . . . . . . . . . . . . . . . . . . . 441Secure Code.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448Cryptography.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462Chapter 12: Business Continuity Management 474Emergency Preparedness.. . . . . . . . . . . . . . . . . . . . . . . . 475Business Continuity Risk Management.. . . . . . . . . . . . . . . . . . 479The Business Continuity Plan.. . . . . . . . . . . . . . . . . . . . . . 485Business Continuity and Disaster Recovery in Cloud Services.. . . . . . . . . 493Plan Testing and Maintenance.. . . . . . . . . . . . . . . . . . . . . . 500Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504Chapter 13: Regulatory Compliance for Financial Institutions 514The Gramm-Leach-Bliley Act.. . . . . . . . . . . . . . . . . . . . . . 515New York’s Department of Financial Services Cybersecurity Regulation.. . . . . 533What Is a Regulatory Examination?.. . . . . . . . . . . . . . . . . . . . 535Personal and Corporate Identity Theft. . . . . . . . . . . . . . . . . . . 537Regulation of Fintech, Digital Assets, and Cryptocurrencies. . . . . . . . . . 540Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 542Chapter 14: Regulatory Compliance for the Health-care Sector 556The HIPAA Security Rule. . . . . . . . . . . . . . . . . . . . . . . . 558The HITECH Act and the Omnibus Rule.. . . . . . . . . . . . . . . . . . 581Understanding the HIPAA Compliance Enforcement Process. . . . . . . . . 586Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 588Chapter 15: PCI Compliance for Merchants 600Protecting Cardholder Data.. . . . . . . . . . . . . . . . . . . . . . . 601PCI Compliance.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 616Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 623Chapter 16: Privacy in an AI-Driven Landscape 634Defining Privacy in the Digital Context. . . . . . . . . . . . . . . . . . . 635The Interplay Between AI and Privacy.. . . . . . . . . . . . . . . . . . . 636General Data Protection Regulation (GDPR).. . . . . . . . . . . . . . . . 637California Consumer Privacy Act (CCPA). . . . . . . . . . . . . . . . . . 640Personal Information Protection and Electronic Documents Act (PIPEDA).. . . . 641Data Protection Act 2018 in the United Kingdom.. . . . . . . . . . . . . . 643Leveraging AI to Enhance Privacy Protections.. . . . . . . . . . . . . . . 645Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 647Chapter 17: Artificial Intelligence Governance and Regulations 652The AI Double-Edged Sword.. . . . . . . . . . . . . . . . . . . . . . 653Generative AI, LLMs, and Traditional Machine Learning Implementations. . . . 653Introduction to AI Governance.. . . . . . . . . . . . . . . . . . . . . . 654The U.S. Executive Order on the Safe, Secure, and TrustworthyDevelopment and Use of Artificial Intelligence.. . . . . . . . . . . . . . . 655The Importance of High Accuracy and Precision in AI Systems.. . . . . . . . 661Explainable AI (XAI): Building Trust and Understanding.. . . . . . . . . . . . 663Government and Society-wide Approaches to AI Governance.. . . . . . . . . 665The EU AI Act. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667Guidelines for Secure AI System Development.. . . . . . . . . . . . . . . 670OWASP Top 10 Risks for LLM.. . . . . . . . . . . . . . . . . . . . . . 674MITRE ATLAS Framework. . . . . . . . . . . . . . . . . . . . . . . . 683Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 684Appendix A: Answers to the Multiple Choice Questions 696 978138074104, TOC, 6/18/2024