About the Authors |
|
xvii | |
About the Technical Reviewer |
|
xix | |
Acknowledgments |
|
xxi | |
Foreword |
|
xxvii | |
Preface |
|
xxxi | |
Introduction |
|
xliii | |
|
|
1 | (192) |
|
Chapter 1 The Root Causes of Data Breaches |
|
|
3 | (32) |
|
|
3 | (1) |
|
"Meta-Level" Root Causes: Prioritization, Investment, and Execution |
|
|
4 | (8) |
|
|
12 | (21) |
|
|
15 | (1) |
|
|
16 | (3) |
|
|
19 | (3) |
|
Third-Party Compromise or Abuse |
|
|
22 | (3) |
|
|
25 | (3) |
|
Inadvertent Employee Mistakes |
|
|
28 | (5) |
|
|
33 | (2) |
|
Chapter 2 The Capital One Breach |
|
|
35 | (20) |
|
|
36 | (3) |
|
Capital One and the "Cloud" |
|
|
39 | (3) |
|
|
42 | (3) |
|
|
45 | (7) |
|
|
45 | (1) |
|
Buckets Private to WAF Role |
|
|
46 | (1) |
|
EC2 Instance Vulnerable to Server-Side Request Forgery (SSRF) |
|
|
47 | (2) |
|
Confused Deputy: Metadata Service |
|
|
49 | (1) |
|
|
49 | (1) |
|
|
50 | (1) |
|
Incident Timeline and Aftermath |
|
|
51 | (1) |
|
|
52 | (3) |
|
Chapter 3 The Marriott Breach |
|
|
55 | (20) |
|
|
56 | (5) |
|
|
60 | (1) |
|
Poor Security at Starwood |
|
|
61 | (7) |
|
|
64 | (1) |
|
|
65 | (3) |
|
The Aftermath and Lessons Learned |
|
|
68 | (6) |
|
|
74 | (1) |
|
Chapter 4 The Equifax Breach |
|
|
75 | (22) |
|
|
78 | (9) |
|
Apache Struts and CVE-2017-5638 |
|
|
78 | (4) |
|
|
82 | (5) |
|
|
87 | (3) |
|
|
90 | (4) |
|
|
94 | (3) |
|
Chapter 5 Facebook Security Issues and the 2016 US Presidential Election |
|
|
97 | (34) |
|
Early Privacy Incidents and FTC Action |
|
|
101 | (6) |
|
|
107 | (1) |
|
Download More Than Just Your Information |
|
|
108 | (1) |
|
From Breaking Things to Fixing Things |
|
|
109 | (1) |
|
|
110 | (8) |
|
Cambridge Analytica Abuse of Facebook |
|
|
118 | (8) |
|
|
126 | (1) |
|
More Mass Profile Exposure |
|
|
127 | (1) |
|
FTC Fines Facebook Five Billion Dollars |
|
|
127 | (1) |
|
Profiles for Sale on the Dark Web |
|
|
128 | (1) |
|
|
129 | (2) |
|
Chapter 6 The OPM Breaches of 2014 and 2015 |
|
|
131 | (24) |
|
State-Sponsored Chinese Attackers |
|
|
133 | (1) |
|
The Breaches: An Overview and Timeline |
|
|
134 | (1) |
|
The US Government Warns OPM |
|
|
135 | (2) |
|
|
137 | (1) |
|
X1: Malware and Keylogging |
|
|
138 | (1) |
|
Kicking Out X1: The Big Bang |
|
|
139 | (1) |
|
X2: A Devastating Blow to US Intelligence |
|
|
140 | (2) |
|
OPM Finds Captain America and Iron Man |
|
|
142 | (2) |
|
Cylance Attempts to Help OPM |
|
|
144 | (3) |
|
|
147 | (4) |
|
|
151 | (4) |
|
Chapter 7 The Yahoo Breaches of 2013 and 2014 |
|
|
155 | (16) |
|
|
157 | (2) |
|
|
159 | (1) |
|
|
160 | (2) |
|
|
162 | (4) |
|
Account Management Tool Compromise |
|
|
165 | (1) |
|
32 Million Cookies Minted |
|
|
165 | (1) |
|
|
166 | (2) |
|
|
168 | (3) |
|
Chapter 8 The Target and JPMorgan Chase Breaches of 2013 and 2014 |
|
|
171 | (22) |
|
Why Target? Why the HVAC Supplier? |
|
|
172 | (2) |
|
The Attack: A Black Friday Nightmare |
|
|
174 | (3) |
|
Target's Real-Time Attack Response |
|
|
177 | (1) |
|
|
177 | (2) |
|
A Timeline and the Stolen Data |
|
|
179 | (1) |
|
Fazio Paid for Not Paying for Anti-virus |
|
|
179 | (1) |
|
|
180 | (3) |
|
|
183 | (3) |
|
|
186 | (1) |
|
JPMorgan Chase: One of the Largest US Bank Breaches |
|
|
186 | (1) |
|
|
187 | (1) |
|
Hold Security Identifies Stolen Credentials |
|
|
187 | (1) |
|
|
188 | (1) |
|
|
189 | (1) |
|
|
189 | (1) |
|
|
190 | (3) |
|
Part II Cybersecurity Lessons for Everyone |
|
|
193 | (224) |
|
Chapter 9 The Seven Habits of Highly Effective Security |
|
|
195 | (38) |
|
Habit 1 Be Proactive, Prepared, and Paranoid |
|
|
197 | (11) |
|
Be Proactive: Act or Be Acted Upon |
|
|
198 | (5) |
|
|
203 | (3) |
|
|
206 | (2) |
|
Habit 2 Be Mission-Centric |
|
|
208 | (5) |
|
|
208 | (1) |
|
Mission-Centric Activities |
|
|
209 | (1) |
|
|
209 | (2) |
|
|
211 | (1) |
|
Security Is Risk Mitigation |
|
|
212 | (1) |
|
Habit 3 Build Security and Privacy In |
|
|
213 | (8) |
|
Keep It Simple ("Economy of Mechanism," "Least Common Mechanism") |
|
|
215 | (1) |
|
Fail-Safe Defaults ("Secure by Default") |
|
|
216 | (1) |
|
Create a Security "Choke Point" ("Complete Mediation") |
|
|
217 | (1) |
|
Principle of Least Privilege |
|
|
217 | (1) |
|
Open Design/No Security by Obscurity |
|
|
218 | (1) |
|
Ease of Use/Psychological Acceptability |
|
|
218 | (1) |
|
Avoid Security Design Flaws |
|
|
219 | (2) |
|
Habit 4 Focus on Security First; Achieve Compliance as a Side Effect |
|
|
221 | (2) |
|
Defend Your Turf Like a Security Rebel! |
|
|
222 | (1) |
|
|
223 | (5) |
|
Measuring Phishing Susceptibility |
|
|
224 | (2) |
|
Measuring Malware Detection |
|
|
226 | (1) |
|
Measuring Software Vulnerabilities |
|
|
227 | (1) |
|
Habit 6 Automate Everything |
|
|
228 | (2) |
|
Habit 7 Embrace Continuous Improvement |
|
|
230 | (1) |
|
|
231 | (2) |
|
Chapter 10 Advice for Boards of Directors |
|
|
233 | (18) |
|
|
234 | (1) |
|
Board-Level Backdrop: Permanent Whitewater |
|
|
235 | (2) |
|
Speed of Digital Transformation and User Adoption |
|
|
236 | (1) |
|
Threats and Data Breaches |
|
|
237 | (1) |
|
Sizing and Prioritizing Risk |
|
|
238 | (1) |
|
Managing Incidents and Public Disclosures |
|
|
239 | (2) |
|
Before and After the Board Meeting |
|
|
241 | (2) |
|
Setting the Tone at the Top |
|
|
241 | (2) |
|
Effective Boards Lead with CARE and Asking the Right Questions |
|
|
243 | (7) |
|
|
245 | (1) |
|
|
246 | (1) |
|
|
247 | (1) |
|
|
248 | (2) |
|
|
250 | (1) |
|
Chapter 11 Advice for Technology and Security Leaders |
|
|
251 | (18) |
|
The Invitation to the Board Meeting |
|
|
252 | (1) |
|
|
253 | (3) |
|
Create Context: What Are We Protecting? |
|
|
256 | (1) |
|
Lead with Your Approach to Fighting Attackers, and Then Follow Up with Metrics! |
|
|
257 | (6) |
|
Connecting the Dots: Business Strategy and Security |
|
|
263 | (2) |
|
Report on Security Events Calmly |
|
|
265 | (1) |
|
|
266 | (3) |
|
Chapter 12 Technology Defenses to Fight the Root Causes of Breach: Part One |
|
|
269 | (34) |
|
|
270 | (2) |
|
|
272 | (23) |
|
Two-Factor Authentication (2FA) |
|
|
273 | (1) |
|
|
274 | (5) |
|
|
279 | (5) |
|
Multi-factor Authentication (MFA) |
|
|
284 | (2) |
|
Phishing-Proof Your Domain(s) with SPF, DKIM, and DMARC |
|
|
286 | (2) |
|
|
288 | (2) |
|
Credential Stuffing and Account Takeover |
|
|
290 | (1) |
|
|
291 | (1) |
|
Additional Phishing Defenses |
|
|
292 | (3) |
|
|
295 | (7) |
|
|
296 | (2) |
|
Endpoint Detection and Response (EDR) |
|
|
298 | (1) |
|
Network Detection and Response (NDR) |
|
|
299 | (1) |
|
Remote Browser Isolation (RBI) |
|
|
300 | (1) |
|
Virtual Desktop Interface (VDI) |
|
|
301 | (1) |
|
|
302 | (1) |
|
Chapter 13 Technology Defenses to Fight the Root Causes of Breach: Part Two |
|
|
303 | (28) |
|
Mitigating Third-Party Risk |
|
|
303 | (8) |
|
|
304 | (4) |
|
|
308 | (2) |
|
Developers, Partners, and Customers |
|
|
310 | (1) |
|
Identifying Software Vulnerabilities |
|
|
311 | (11) |
|
First-Party Vulnerabilities |
|
|
312 | (5) |
|
Third-Party Vulnerabilities |
|
|
317 | (5) |
|
|
322 | (4) |
|
|
323 | (1) |
|
|
324 | (1) |
|
|
325 | (1) |
|
Inadvertent Employee Mistakes |
|
|
326 | (1) |
|
Tactical Approach and Tool Selection |
|
|
327 | (2) |
|
|
329 | (2) |
|
Chapter 14 Advice to Cybersecurity Investors |
|
|
331 | (30) |
|
|
331 | (1) |
|
Security Startup Revolution |
|
|
332 | (2) |
|
|
334 | (22) |
|
|
335 | (2) |
|
|
337 | (8) |
|
|
345 | (11) |
|
|
356 | (2) |
|
|
358 | (3) |
|
Chapter 15 Advice to Consumers |
|
|
361 | (24) |
|
|
362 | (2) |
|
Seatbelts for Our Digital Lives |
|
|
362 | (1) |
|
|
363 | (1) |
|
Consumer Defense Checklist Overview |
|
|
364 | (1) |
|
|
364 | (3) |
|
|
367 | (7) |
|
Enable Two-Factor Authentication |
|
|
369 | (1) |
|
|
370 | (2) |
|
Credit and Identity Protection |
|
|
372 | (2) |
|
Protect the Gateway to "Close the Front Door" |
|
|
374 | (2) |
|
|
376 | (4) |
|
|
376 | (1) |
|
|
377 | (1) |
|
|
378 | (1) |
|
|
379 | (1) |
|
Protect Your Interactions |
|
|
380 | (2) |
|
|
382 | (3) |
|
Chapter 16 Applying Your Skills to Cybersecurity |
|
|
385 | (24) |
|
|
386 | (8) |
|
|
388 | (1) |
|
Governance, Risk, and Compliance |
|
|
389 | (2) |
|
|
391 | (1) |
|
|
391 | (1) |
|
|
392 | (1) |
|
Security Operations Center (SOC) |
|
|
392 | (1) |
|
|
392 | (2) |
|
Getting a Job in Cybersecurity |
|
|
394 | (13) |
|
|
399 | (2) |
|
|
401 | (2) |
|
|
403 | (4) |
|
|
407 | (2) |
|
|
409 | (8) |
Index |
|
417 | |