Developing Cybersecurity Programs and Policies in an AI-Driven World

Omar Santos is a Distinguished Engineer at Cisco, focusing on artificial intelligence (AI) security, cybersecurity research, incident response, and vulnerability disclosure. He is a board member of the OASIS Open standards organization and the founder of OpenEoX. Omar’s collaborative efforts extend to numerous organizations, including the Forum of Incident Response and Security Teams (FIRST) and the Industry Consortium for Advancement of Security on the Internet (ICASI). Omar is the co-chair of the FIRST PSIRT Special Interest Group (SIG). Omar is the co-founder of the DEF CON Red Team Village and the chair of the Common Security Advisory Framework (CSAF) technical committee.  Omar is the author of more than 25 books, 21 video courses, and more than 50 academic research papers. He is a renowned expert in ethical hacking, vulnerability research, incident response, and AI security. He employs his deep understanding of these disciplines to help organizations stay ahead of emerging threats. His dedication to cybersecurity has made a significant impact on technology standards, businesses, academic institutions, government agencies, and other entities striving to improve their cybersecurity programs. Prior to working for Cisco, Omar served in the U.S. Marines, focusing on the deployment, testing, and maintenance of Command, Control, Communications, Computer and Intelligence (C4I) systems. You can find Omar at:  X: @santosomarLinkedIn: https://www.linkedin.com/in/santosomar

• Introduction xviiiChapter 1: Understanding Cybersecurity Policy and Governance 2Information Security vs. Cybersecurity Policies.. . . . . . . . . . . . . . . . 6Looking at Policy Through the Ages.. . . . . . . . . . . . . . . . . . . . 6Cybersecurity Policy.. . . . . . . . . . . . . . . . . . . . . . . . . . 10Cybersecurity Policy Life Cycle.. . . . . . . . . . . . . . . . . . . . . . 28Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34Chapter 2: Cybersecurity Policy Organization, Format, and Styles 46Policy Hierarchy.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 47Writing Style and Technique.. . . . . . . . . . . . . . . . . . . . . . . 51Plain Language Techniques for Policy Writing.. . . . . . . . . . 53Policy Format.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69Chapter 3: Cybersecurity Frameworks 80Confidentiality, Integrity, and Availability (CIA). . . . . . . . . . . . . . . . 81What Is a Cybersecurity Framework?.. . . . . . . . . . . . . . . . . . . 94NIST Cybersecurity Framework.. . . . . . . . . . . . . . . . . . . . . 110Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118Chapter 4: Cloud Security 132Why Cloud Computing?.. . . . . . . . . . . . . . . . . . . . . . . . 133Cloud Computing Models.. . . . . . . . . . . . . . . . . . . . . . . . 139Cloud Governance. . . . . . . . . . . . . . . . . . . . . . . . . . . 141Multitenancy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150Core Components of the Cloud Computing Reference Architecture.. . . . . . 151Key Concepts and Functional Layers of Cloud Computing. . . . . . . . . . 152Understanding Top Cybersecurity Risks in Cloud Computing. . . . . . . . . 153AI and the Cloud: Revolutionizing the Future of Computing.. . . . . . . . . . 166Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168Chapter 5: Governance and Risk Management 176Understanding Cybersecurity Policies. . . . . . . . . . . . . . . . . . . 177Cybersecurity Risk. . . . . . . . . . . . . . . . . . . . . . . . . . . 197Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207Chapter 6: Asset Management and Data Loss Prevention 220Information Assets and Systems.. . . . . . . . . . . . . . . . . . . . . 221Information Classification.. . . . . . . . . . . . . . . . . . . . . . . . 224Labeling and Handling Standards.. . . . . . . . . . . . . . . . . . . . 233Information Systems Inventory.. . . . . . . . . . . . . . . . . . . . . . 236Understanding Data Loss Prevention Technologies.. . . . . . . . . . . . . 242Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245Chapter 7: Human Resources Security and Education 256The Employee Life Cycle. . . . . . . . . . . . . . . . . . . . . . . . 257The Importance of Employee Agreements.. . . . . . . . . . . . . . . . . 269The Importance of Security Education and Training. . . . . . . . . . . . . 272Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278Chapter 8: Physical and Environmental Security 290Understanding the Secure Facility Layered Defense Model.. . . . . . . . . . 292Protecting Equipment.. . . . . . . . . . . . . . . . . . . . . . . . . 299Environmental Sustainability. . . . . . . . . . . . . . . . . . . . . . . 308Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310Chapter 9: Cybersecurity Operations (CyberOps), Incident Response, Digital Forensics, and Threat Hunting 320Incident Response.. . . . . . . . . . . . . . . . . . . . . . . . . . . 321What Happened? Investigation and Evidence Handling.. . . . . . . . . . . 349Understanding Threat Hunting.. . . . . . . . . . . . . . . . . . . . . . 351Understanding Digital Forensic Analysis.. . . . . . . . . . . . . . . . . . 357Data Breach Notification Requirements. . . . . . . . . . . . . . . . . . 360Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 368Chapter 10: Access Control Management 384Access Control Fundamentals.. . . . . . . . . . . . . . . . . . . . . . 385Infrastructure Access Controls.. . . . . . . . . . . . . . . . . . . . . . 399User Access Controls.. . . . . . . . . . . . . . . . . . . . . . . . . 416Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422Chapter 11: Supply Chain Security, Information Systems Acquisition, Development, and Maintenance 434Strengthening the Links: A Deep Dive into Supply Chain Security.. . . . . . . 435System Security Requirements.. . . . . . . . . . . . . . . . . . . . . 441Secure Code.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448Cryptography.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462Chapter 12: Business Continuity Management 474Emergency Preparedness.. . . . . . . . . . . . . . . . . . . . . . . . 475Business Continuity Risk Management.. . . . . . . . . . . . . . . . . . 479The Business Continuity Plan.. . . . . . . . . . . . . . . . . . . . . . 485Business Continuity and Disaster Recovery in Cloud Services.. . . . . . . . . 493Plan Testing and Maintenance.. . . . . . . . . . . . . . . . . . . . . . 500Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504Chapter 13: Regulatory Compliance for Financial Institutions 514The Gramm-Leach-Bliley Act.. . . . . . . . . . . . . . . . . . . . . . 515New York’s Department of Financial Services Cybersecurity Regulation.. . . . . 533What Is a Regulatory Examination?.. . . . . . . . . . . . . . . . . . . . 535Personal and Corporate Identity Theft. . . . . . . . . . . . . . . . . . . 537Regulation of Fintech, Digital Assets, and Cryptocurrencies. . . . . . . . . . 540Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 542Chapter 14: Regulatory Compliance for the Health-care Sector 556The HIPAA Security Rule. . . . . . . . . . . . . . . . . . . . . . . . 558The HITECH Act and the Omnibus Rule.. . . . . . . . . . . . . . . . . . 581Understanding the HIPAA Compliance Enforcement Process. . . . . . . . . 586Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 588Chapter 15: PCI Compliance for Merchants 600Protecting Cardholder Data.. . . . . . . . . . . . . . . . . . . . . . . 601PCI Compliance.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 616Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 623Chapter 16: Privacy in an AI-Driven Landscape 634Defining Privacy in the Digital Context. . . . . . . . . . . . . . . . . . . 635The Interplay Between AI and Privacy.. . . . . . . . . . . . . . . . . . . 636General Data Protection Regulation (GDPR).. . . . . . . . . . . . . . . . 637California Consumer Privacy Act (CCPA). . . . . . . . . . . . . . . . . . 640Personal Information Protection and Electronic Documents Act (PIPEDA).. . . . 641Data Protection Act 2018 in the United Kingdom.. . . . . . . . . . . . . . 643Leveraging AI to Enhance Privacy Protections.. . . . . . . . . . . . . . . 645Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 647Chapter 17: Artificial Intelligence Governance and Regulations 652The AI Double-Edged Sword.. . . . . . . . . . . . . . . . . . . . . . 653Generative AI, LLMs, and Traditional Machine Learning Implementations. . . . 653Introduction to AI Governance.. . . . . . . . . . . . . . . . . . . . . . 654The U.S. Executive Order on the Safe, Secure, and TrustworthyDevelopment and Use of Artificial Intelligence.. . . . . . . . . . . . . . . 655The Importance of High Accuracy and Precision in AI Systems.. . . . . . . . 661Explainable AI (XAI): Building Trust and Understanding.. . . . . . . . . . . . 663Government and Society-wide Approaches to AI Governance.. . . . . . . . . 665The EU AI Act. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667Guidelines for Secure AI System Development.. . . . . . . . . . . . . . . 670OWASP Top 10 Risks for LLM.. . . . . . . . . . . . . . . . . . . . . . 674MITRE ATLAS Framework. . . . . . . . . . . . . . . . . . . . . . . . 683Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 684Appendix A: Answers to the Multiple Choice Questions 696  978138074104, TOC, 6/18/2024

Select Guide Rating