Alexander J. Roxon

Choose Your InfoSec Path

An Interactive Cybersecurity Adventure for Beginners

1st ed.
Alexander J. Roxon
London, UK
ISBN 978-1-4842-7035-6e-ISBN 978-1-4842-7036-3
https://doi.org/10.1007/978-1-4842-7036-3
© Alexander J. Roxon 2021
This work is subject to copyright. All rights are solely and exclusively licensed by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed.
The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.
The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, expressed or implied, with respect to the material contained herein or for any errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

This Apress imprint is published by the registered company APress Media, LLC part of Springer Nature.

The registered company address is: 1 New York Plaza, New York, NY 10004, U.S.A.

For Lola.

I promised your memory I’d write this book to make sure one good thing came out of 2020.

No doubt you will be murdering tennis balls in dog heaven.

Rest easy, sweetheart.

Preface

Welcome to my book. I am the author, Alex. I wrote this book with the goal of making information security fun and engaging to learn and interact with. Whether I succeeded or not is up to you.

This book is for people who are interested in learning about information security, either just out of curiosity or because they want to start a career in the industry. Incidentally, please don’t be put off if you don’t have an in-depth technical background: the book has been written with that possibility in mind. This book puts you in the shoes of a Chief Information Security Officer (CISO) at a company; a fast-moving and in many ways unrealistic pair of shoes, I should add. You’ll endure some of the trials and tribulations that come with the role, including responding to a cyberattack. Whether or not the company emerges from the attack unscathed is largely up to you and the choices you make throughout the book.

Note that though the story presented in this book is largely realistic and representative of how things work in the real world, I have taken some creative liberties to keep things interesting. For example, events that could take weeks or months unfurl much more rapidly because I didn’t think you’d want to read page after page of not much happening. Also, at some points the technical realities of the world are bent slightly to enhance entertainment and simplicity. This book is written to help you become enthused about information security and to raise your aptitude, but it’s not intended to be a masterclass by any means.

There are some opinions scattered around, which, needless to say, are subjective. As for the humour, it’s mostly very dry, with a lot of pot shots at some of the mundaneness of corporate employment that we’ve come to know and love accept.

This book takes you through an interactive adventure. Each section leads you through a scene in the story and directs you to the next section. Do not try to read the book in sequential order! Each section may have multiple exits or pathways depending on the choices you make. Some sections will have a decision point in the middle.

If you’re curious as to what this means, go to Section 153 .

Not all decisions have “right” or “wrong” answers, just as in real life things are often much more nuanced and greyer, rather than black and white. I’d recommend you try reading through the book a few times making the kind of choices you’d be likely to make, but also have a few read-throughs where you go against your instincts completely and see how the story deviates and what lessons you can learn.

The book is divided into a number of phases:

  • Phase one—Prologue: Gives you background on your role and employer.

  • Phase two—Preparation: A time period where you know how the attackers typically behave and it’s up to you to find evidence of their activity or reasons for why they are interested in targeting you.

  • Phase three—Attack: The cyberattack well and truly begins.

  • Phase four—Aftermath: A brief period where you can enjoy your success (if you’ve had any).

How you do in phase one will determine where you enter phase two, and so on as the story unfolds. Not all stories will make it all the way through the phases; it depends how you play and what happens as a result. I should warn you, the book will not always be as straightforward as you may wish or hope—just like in real life, there is a random element and luck can play its part.

Remember that this is an individual story with individual circumstances and nuances. In the same way, each real-life incident is going to be unique and reactions/responses/relevant laws and even office politics are going to differ. What I am saying is, this book is a tool to enhance your learning and hopefully to act as a bit of fun, but it is not meant to become your own incident response plan.

As the book is centred around information security and this realm may not be your background, you may want to read the glossary at the back of the book before starting. If you don’t fancy reading the whole glossary, just remember, the first time a glossary term is used it will be in bold . For really key topics I will sometimes throw in a quick description for you.

You may notice this whole preface is in italics, which probably looks weird, but essentially italics means I am talking directly to you, smashing that fourth wall to smithereens. Most of the book is written in the second person (therefore not in italics)—after all, it’s your story. But immediately following a decision, I will chime in to offer some feedback on the decision you just made. So remember, italics means I am talking directly to you. Good luck!

Get started and go to Section 1 .

Acknowledgments

To Isabel, who I am hoping by now is my wife, COVID pandemic allowing, for not questioning me spending large amounts of time working furiously in the bedroom with my laptop. To my editor: Why is this autocorrecting to “working”?

A big thank-you to Andy Compton, the man I told I wanted to be a sponge, octopus and shark rolled into one, and still hired me to my first information security role.

A massive thank-you and apology to Sasha Zivojinovic. Whilst I listened to most of your technical feedback, I ignored some of it, as being succinct sometimes trumped the need for 100% accuracy. Let this section make it clear that anything technically wrong with this book is purely my fault, nobody else’s.

More fool you to Andrew Turner, for taking me back into his sales team after an ill-fated attempt at running my own business.

To Susan, Rita and all the hidden people behind the scenes at Apress, let’s hope your gamble paid off.

And obviously a big thank-you to my parents, Sara and Gordon, for raising me in a manner where I was educated enough to be able to write, but tortured enough to feel the need to.

Contents
Chapter 1:​ Life’s a Breach 1
1 Phase One—Prologue 1
2 Phase One—Prologue 2
3 Phase Two—Preparation 3
4 Phase Two—Preparation 3
5 Phase Four—Aftermath 4
6 Phase Three—Attack 5
7 Phase Four—Aftermath 5
8 Phase Two—Preparation 6
9 Phase Four—Aftermath 7
10 Phase Four—Aftermath 8
11 Phase Four—Aftermath 8
12 Phase Three—Attack 9
13 Phase Three—Attack 10
14 Phase Four—Aftermath 11
15 Phase Four—Aftermath 11
16 Phase Two—Preparation 12
17 Phase Three—Attack 13
18 Phase Three—Attack 14
19 Phase Three—Attack 14
20 Phase Three—Attack 15
21 Phase Four—Aftermath 16
22 Phase Two—Preparation 17
23 Phase Three—Attack 18
24 Phase Four—Aftermath 18
25 Phase Three—Attack 19
26 Phase Three—Attack 20
27 Phase Two—Preparation 20
28 Phase Two—Preparation 21
29 Phase Two—Preparation 22
30 Phase Three—Attack 23
31 Phase Three—Attack 24
32 Phase Two—Preparation 24
33 Phase Three—Attack 25
34 Phase Two—Preparation 26
35 Phase Three—Attack 27
36 Phase Three—Attack 27
37 Phase Three—Attack 28
38 Phase Four—Aftermath 29
39 Phase Two—Preparation 30
40 Phase Two—Preparation 31
41 Phase Four—Aftermath 31
42 Phase Four—Aftermath 32
43 Phase Two—Preparation 33
44 Phase Three—Attack 34
45 Phase Three—Attack 34
46 Phase Three—Attack 35
47 Phase Three—Attack 36
48 Phase Three—Attack 37
49 Phase Three—Attack 37
50 Phase Four—Aftermath 38
51 Phase Three—Attack 39
52 Phase Three—Attack 39
53 Phase Three—Attack 40
54 Phase Three—Attack 41
55 Phase Three—Attack 41
56 Phase Two—Preparation 42
57 Phase Three—Attack 42
58 Phase Three—Attack 43
59 Phase Three—Attack 44
60 Phase Four—Aftermath 45
61 Phase Four—Aftermath 46
62 Phase Four—Aftermath 46
63 Phase Two—Preparation 47
64 Phase Two—Preparation 48
65 Phase Four—Aftermath 49
66 Phase Two—Preparation 49
67 Phase Three—Attack 50
68 Phase Four—Aftermath 51
69 Phase Three—Attack 52
70 Phase Two—Preparation 53
71 Phase Three—Attack 54
72 Phase Three—Attack 54
73 Phase Three—Attack 55
74 Phase Two—Preparation 56
75 Phase Four—Aftermath 56
76 Phase Two—Preparation 57
77 Phase Three—Attack 58
78 Phase Three—Attack 58
79 Phase Two—Preparation 59
80 Phase Two—Preparation 60
81 Phase Two—Preparation 61
82 Phase Four—Aftermath 62
83 Phase Three—Attack 63
84 Phase Two—Preparation 63
85 Phase Three—Attack 64
86 Phase Four—Aftermath 65
87 Phase Two—Preparation 65
88 Phase Three—Attack 66
89 Phase Four—Aftermath 67
90 Phase Two—Preparation 68
91 Phase Four—Aftermath 69
92 Phase Two—Preparation 70
93 Phase Two—Preparation 71
94 Phase Two—Preparation 71
95 Phase Two—Preparation 72
96 Phase Four—Aftermath 73
97 Phase Two—Preparation 74
98 Phase Two—Preparation 74
99 Phase Four—Aftermath 75
100 Phase Two—Preparation 76
101 Phase Four—Aftermath 77
102 Phase Three—Attack 77
103 Phase Three—Attack 78
104 Phase Four—Aftermath 79
105 Phase Two—Preparation 80
106 Phase Four—Aftermath 80
107 Phase Four—Aftermath 81
108 Phase Three—Attack 81
109 Phase Three—Attack 82
110 Phase Four—Aftermath 83
111 Phase Three—Attack 84
112 Phase Four—Aftermath 84
113 Phase Four—Aftermath 85
114 Phase Three—Attack 86
115 Phase Three—Attack 87
116 Phase Two—Preparation 87
117 Phase Two—Preparation 88
118 Phase Four—Aftermath 89
119 Phase Three—Attack 89
120 Phase Three—Attack 90
121 Phase Two—Preparation 90
122 Phase Two—Preparation 91
123 Phase Three—Attack 92
124 Phase Two—Preparation 93
125 Phase Two—Preparation 93
126 Phase Three—Attack 94
127 Phase Four—Aftermath 95
128 Phase Two—Preparation 95
129 Phase Four—Aftermath 96
130 Phase Three—Attack 97
131 Phase Three—Attack 97
132 Phase Two—Preparation 98
133 Phase Three—Attack 99
134 Phase Three—Attack 100
135 Phase Three—Attack 100
136 Phase Four—Aftermath 101
137 Phase Two—Preparation 102
138 Phase Four—Aftermath 103
139 Phase Two—Preparation 104
140 Phase Three—Attack 105
141 Phase One—Prologue 106
142 Phase Three—Attack 106
143 Phase Three—Attack 107
144 Phase Two—Preparation 107
145 Phase Three—Attack 108
146 Phase Three—Attack 109
147 Phase Three—Attack 109
148 Phase Three—Attack 110
149 Phase Three—Attack 111
150 Phase Three—Attack 111
151 Phase Two—Preparation 112
152 Phase Three—Attack 113
153 Phase One—Prologue 114
154 Phase Four—Aftermath 114
155 Phase Two—Preparation 115
156 Phase Three—Attack 116
157 Phase Two—Preparation 116
158 Phase Three—Attack 117
159 Phase Two—Preparation 118
160 Phase Three—Attack 119
161 Phase One—Prologue 119
162 Phase Three—Attack 120
163 Phase Two—Preparation 121
164 Phase Four—Aftermath 122
165 Phase Two—Preparation 123
166 Phase Three—Attack 124
167 Phase Three—Attack 124
168 Phase Three—Attack 125
169 Phase Three—Attack 126
170 Phase Three—Attack 127
171 Phase Three—Attack 127
172 Phase Three—Attack 128
173 Phase Two—Preparation 129
174 Phase Three—Attack 130
175 Phase Three—Attack 131
176 Phase Three—Attack 132
177 Phase Three—Attack 132
178 Phase Four—Aftermath 133
179 Phase Three—Attack 134
180 Phase Three—Attack 135
181 Phase Four—Aftermath 135
182 Phase Three—Attack 136
183 Phase Three—Attack 136
184 Phase Three—Attack 137
185 Phase Three—Attack 137
186 Phase Three—Attack 138
187 Phase Two—Preparation 139
188 Phase Three—Attack 140
189 Phase Two—Preparation 140
190 Phase Three—Attack 141
191 Phase Three—Attack 142
192 Phase Four—Aftermath 142
193 Phase Four—Aftermath 143
194 Phase Three—Attack 144
195 Phase Four—Aftermath 144
196 Phase Two—Preparation 145
197 Phase Three—Attack 145
198 Phase Two—Preparation 146
199 Phase Two—Preparation 147
200 Phase Three—Attack 148
201 Phase Four—Aftermath 149
202 Phase Three—Attack 150
203 Phase Two—Preparation 151
204 Phase Four—Aftermath 151
205 Phase Three—Attack 152
206 Phase Three—Attack 153
207 Phase Two—Preparation 154
208 Phase Two—Preparation 154
209 Phase Three—Attack 155
210 Phase Three—Attack 156
211 Phase Three—Attack 156
212 Phase Three—Attack 157
213 Phase Two—Preparation 158
214 Phase Three—Attack 158
215 Phase Two—Preparation 159
216 Phase Four—Aftermath 160
217 Phase Two—Preparation 161
218 Phase Four—Aftermath 162
219 Phase Two—Preparation 163
220 Phase Three—Attack 163
221 Phase Three—Attack 164
222 Phase Four—Aftermath 165
223 Phase Two—Preparation 166
224 Phase Two—Preparation 166
225 Phase Three—Attack 167
226 Phase Three—Attack 168
227 Phase Four—Aftermath 168
228 Phase Three—Attack 169
229 Phase Two—Preparation 170
230 Phase Three—Attack 170
231 Phase Four—Aftermath 171
232 Phase Three—Attack 172
233 Phase Three—Attack 173
234 Phase Four—Aftermath 174
235 Phase Three—Attack 174
236 Phase Three—Attack 175
237 Phase Two—Preparation 176
238 Phase Four—Aftermath 176
239 Phase One—Prologue 177
240 Phase Three—Attack 178
241 Phase Three—Attack 179
242 Phase Two—Preparation 179
243 Phase Two—Preparation 180
244 Phase Three—Attack 181
245 Phase One—Prologue 182
246 Phase Two—Preparation 183
247 Phase Two—Preparation 184
248 Phase Four—Aftermath 185
249 Phase Four—Aftermath 185
250 Phase One—Prologue 186
251 Phase Two—Preparation 187
252 Phase Three—Attack 187
253 Phase Three—Attack 188
254 Phase Three—Attack 189
255 Phase Four—Aftermath 190
256 Phase Three—Attack 190
257 Phase Two—Preparation 191
258 Phase Three—Attack 192
259 Phase Four—Aftermath 192
260 Phase Four—Aftermath 193
261 Phase Two—Preparation 194
262 Phase Four—Aftermath 195
263 Phase Four—Aftermath?​ 195
264 Phase Two—Preparation 196
265 Phase Three—Attack 196
266 Phase Three—Attack 197
267 Phase Three—Attack 197
268 Phase Four—Aftermath 198
269 Phase Two—Preparation 199
270 Phase Three—Attack 200
271 Phase Three—Attack 201
272 Phase Three—Attack 202
273 Phase Three—Attack 202
274 Phase Two—Preparation 203
275 Phase Two—Preparation 203
276 Phase Three—Attack 204
277 Phase Three—Attack 205
278 Phase Two—Preparation 205
279 Phase Three—Attack 206
280 Phase Three—Attack 207
281 Phase Three—Attack 208
282 Phase Two—Preparation 208
283 Phase Three—Attack 209
284 Phase Three—Attack 210
285 Phase Two—Preparation 211
286 Phase Three—Attack 211
287 Phase Two—Preparation 212
288 Phase Three—Attack 213
289 Phase Two—Preparation 214
290 Phase Three—Attack 215
291 Phase Three—Attack 215
292 Phase Three—Attack 216
293 Phase Two—Preparation 217
294 Phase Three—Attack 218
295 Phase Four—Aftermath 219
296 Phase Three—Attack 219
297 Phase Three—Attack 220
298 Phase Three—Attack 220
299 Phase Three—Attack 221
300 Phase Two—Preparation 222
301 Phase Four—Aftermath 223
302 Phase Two—Preparation 223
303 Phase Two—Preparation 224
304 Phase Two—Preparation 225
305 Phase Three—Attack 226
306 Phase Three—Attack 227
307 Phase Three—Attack 227
308 Phase Two—Preparation 228
309 Phase Three—Attack 229
310 Phase Two—Preparation 230
311 Phase Three—Attack 230
312 Phase Two—Preparation 231
313 Phase Three—Attack 232
314 Phase One—Prologue 233
315 Phase Three—Attack 234
316 Phase Three—Attack 234
317 Phase Two—Preparation 235
318 Phase Three—Attack 236
319 Phase Two—Preparation 236
320 Phase Two—Preparation 237
321 Phase Three—Attack 238
322 Phase Four—Aftermath 238
323 Phase Two—Preparation 239
324 Phase Two—Preparation 240
325 Phase Three—Attack 241
326 Phase Two—Preparation 241
327 Phase Two—Preparation 242
328 Phase Three—Attack 243
329 Phase Three—Attack 244
330 Phase Three—Attack 245
331 Phase Two—Preparation 246
332 Phase Four—Aftermath 247
333 Phase Three—Attack 248
334 Phase Three—Attack 249
335 Phase Three—Attack 249
336 Phase Two—Preparation 250
337 Phase Three—Attack 251
338 Phase Three—Attack 252
339 Phase Three—Attack 252
340 Phase Three—Attack 253
341 Phase Three—Attack 253
342 Phase Four—Aftermath 254
343 Phase Three—Attack 255
344 Phase Two—Preparation 256
345 Phase Four—Aftermath 256
346 Phase Two—Preparation 257
347 Phase Two—Preparation 258
348 Phase Three—Attack 259
349 Phase Two—Preparation 259
350 Phase Four—Aftermath 260
351 Phase Two—Preparation 261
352 Phase Two—Preparation 262
353 Phase Two—Preparation 263
354 Phase Two—Preparation 263
355 Phase Three—Attack 264
356 Phase Two—Preparation 265
357 Phase Three—Attack 266
358 Phase Four—Aftermath 266
359 Phase Three—Attack 267
360 Phase Two—Preparation 268
361 Phase Four—Aftermath 269
362 Phase Three—Attack 270
363 Phase Four—Aftermath 271
364 Phase Four—Aftermath 271
365 Phase Three—Attack 272
366 Phase Three—Attack 273
367 Phase Two—Preparation 274
368 Phase Four—Aftermath 274
Glossary 277
Index 305
About the Author
Alexander J. Roxon
../images/508571_1_En_BookFrontmatter_Figb_HTML.png
likes to take complicated subjects and problems, then make them simpler and less intimidating. Alex works for a cyber security consultancy, helping companies implement appropriate cybersecurity strategies and use technology to prepare for the problems of the future. In his spare time, he likes to contribute to the industry with things like phishing awareness blogs full of fish puns, or a deck of playing cards designed to teach people about cybersecurity (The Infosec Deck). Inspired by the Give Yourself Goosebumps series, he decided to write his own interactive story in an effort to make information security more accessible. He holds the Systems Security Certified Professional (SSCP) accreditation and is Factor Analysis Information Risk (FAIR) accredited.
 
About the Technical Reviewer
Sasha Zivojinovic

is a part-time security geek and full-time Schnauzer wrangler. During his decade-long adventure in information security, his disclosures have caused countless headaches to project teams in some of the most prestigious organisations in the world. This has included disclosures to Google, McAfee, Redis Labs, Ubuntu and AlienVault products, for which he’s received recognition, reprobation and the occasional T-shirt.

When he’s not helping make the world more secure, he’s busy providing quality assurance on any and every bottle of rum that crosses his path and teaching the various German states how to source and brew a decent cup of tea.

Sasha has donated his portion of proceeds from tech reviewing this book to the Caye Caulker Animal Shelter, on the proviso that this is explicitly mentioned in his bio, while also asking that it not be mentioned that he asked for this. I think we can all agree he is a great man.

 
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
52.15.63.145