Index

Note: Page numbers followed by “f”, “t” and “b” indicates figures, tables and boxes respectively.
A
Access control, 187, 217–218
access control systems, 189
benefits, 188
LANs, 188
systems, 189
Access violations analyses, 217
Accountabilities, 116–117
Advanced persistent threat (APT), 304
Advanced Research Project Agency (ARPA), 75–76
Advisory services, 299
Africa, 55
“Aggressive defensive” operations, 90
Agricultural Age, 11
Air Force’s 53rd Wing, 97
Alleged monopoly actions, 97
Amazon. com, 91
American Electronics Association (AEA), 70
Annual reevaluation
cyber security officer, 223–224
cyber security program strategic, tactical, and annual plans, 228
linking cyber security program, 228–230
metrics analysis, 230–231
one-year review, 224
LOE activities, 225–226
projects, 226–227
planning for next year, 231–233
Asia, 53–54
Assessment services, 298
Augmentation, 299
Awareness
briefings, 186–187
program, 185–186, 217
B
BlackBerry, 96
Blue-light cameras, 96
Business
information, 181
practices, 278–279
Business managers
See also Global business and management environment
and cyber security, 42
company managers, 43
corporate management’s knowledge, 42
cyber security program, 42
principles, 44
responsibilities, 43
cyber security officer as, 40–41
C
Canada, 55
Cellular phones, 105b
Changing criminal justice systems, 21–24
Chief executive officer (CEO), 135, 138, 144
Chinese hacking group, 99
Classified networks security, 60
Codes of ethics, 277–278
Coherent knowledge-based operations (CKO), 270
Cold calling potential customers, 296
Command and control warfare (C2W), 263
Commercial off-the-shelf software (COTS software), 258–259
Communications technology, 12
Company managers, 44–45
Comprehensive National Cybersecurity Initiative (CNCI), 55–57
initiative, 55–57
Computer forensics, 238–240
Contingency and emergency planning and disaster recovery (CEP-DR), 194
adverse events, 195
contingency planning, 194–195
needs, 195
planning system, 195–198
testing plan, 198
Contingency planning, 217
Corporate cyber security program, 132–152
See also Cyber security officer
cyber security procedures, 150–152
cyber security program policy, 149–150
information assets protection policies, 139–150
physical security, 149–150
policy directive, 148–149
requirements; also Cyber security officer, 139, 148–149
Corporate ethics, 278–279
Corporate executive officer (CEO), 237
Corporate format, 124–125
Corporate information, determining value, 179–180
Corporate information officer (CIO), 107, 137–139, 144, 155, 219, 229, 236
Corporate leader, 110
Corporate management, 241–242
knowledge, 42
Corporate strategic business plan, 123, 127
Corporate values, 278–279
Corporation, customers, and competition (three C’s), 32
Corporation overall policy document, 142
Cost-effective cyber security program, 9
Cost-effective method, 120
Counterintelligence (CI), 60
Critical infrastructure and key resources (CIKR), 61–62
Cumbersome processes, 153
Cyber Command, 98–99
Cyber education expansion, 60
Cyber operations connection, 59
Cyber security, 52, 123, 305
Africa, 55
Asia, 53–54
Canada, 55
CNCI initiative, 57–62
European Union, 53
evolution of laws, standards, policies, and procedures, 50–51
global via UN, 51–53
policy document, 144
principles, 114
procedures, 150–152
professionals, 45
program, 7, 31
policy, 149–150
strategic, tactical, and annual plans, 228
program level of effort drivers, 207
charting level of effort through number of system users, 208–209
granting users access to systems, 210–211
significance of system users chart, 209–210
program metrics, 202–203
cyber security officer, 204, 207
examples, 205
management, 203
metrics management, 206
security-associated risks, 35
South America, 54
strategic plan, 121–124
mapping to corporate strategic business plan, 123
objective, 122
planning considerations, 123
strategic business plan, 121
team concepts, communication, and coordination, 122
writing plan, 124
tactical plan, 124–125
techie, 145
writing plan, 125
United States, 55–57
Cyber security function, 29, 176
See also Access control
annual plan, 125–127
mapping to corporate annual business plan, 127
projects, 126–127
writing plan, 127
CEP-DR, 194–198
consultant, 292
business plan, 296
consulting plan, 294
cyber security managers and technicians, 293
guiding principles, 295
cyber security officer, 185
awareness briefings, 186–187
awareness program, 185–186
continuing awareness material, 187
firmware evaluation, 189–191
job
descriptions, 160–161
family functional descriptions, 161–168
NCIs, 194
process development, 184
requirements identification function, 184–185
processes, 177–179
risk management program, 191–193
software evaluation, 189–191
ST&E program, 193
valuing information, 179
corporate information value, 179–180
information categories, 181–182
information value, 180–184
questions, 184
valued information types; also Access control, 182
Cyber security officer, 6–8, 28–29, 34, 104, 125, 152–171, 185, 202, 235–236
See also Corporate cyber security program
awareness
briefings, 186–187
program, 185–186
as business manager, 40–41
career development program, 284–286
continuing awareness material, 187
corporate culture, 284
cyber security job descriptions, 160–161
cyber security job family functional descriptions, 161–168
duties and responsibilities, 109, 236–237
Director and, 238
HTCPP, 237
violations of laws, 238
evolution and revolution, 104–106
in global corporation, 106
CIO, 107
corporate culture, 107–108
management blank check, 108
goals and objectives, 109–110
leadership position, 110–112
mission statements, 112–113
need for cyber security subordinate organizations, 154–156
organization structure development, 156
and organizational responsibilities, 115
formal duties and responsibilities, 116–117
professional, 283
project management, 114–115
quality statements, 112–114
recruiting cyber security professionals, 168–171
in-house cyber security candidates identification, 170
outside cyber security candidates identification, 171
risk management, 115
subordinate organizations development, 156–160
cyber security program access control and compliance, 157–158
cyber security program policy and risk management, 158–159
off-site cyber security program organizations, 159–160
vision statements, 112–113
Cyber security program and organization establishment, 132
corporate cyber security program, 132–152
cyber security procedures, 150–152
cyber security program policy, 149–150
information assets protection policies, 139–150
physical security, 149–150
policy directive, 148–149
requirements, 139, 148–149
cyber security officer thought process, 152–171
cyber security job descriptions, 160–161
cyber security job family functional descriptions, 161–168
need for cyber security subordinate organizations, 154–156
organization structure development, 156
recruiting cyber security professionals, 168–171
subordinate organizations development, 156–160
Cyber Security Specialist, 141–142
Cyber wars, 82
Cyber-information world environment, 4
changing criminal justice systems, 21–24
GII, 10
human factor, 24–26
information, 5–6
information-driven environment, 6
computer systems, 7
computers, 8
cyber security and mitigating risks, 6
cyber security officer, 6–8, 10
cyber security program, 7
microprocessors, 7–8
protection of information systems, 8–9
NII, 11
Cyberspace, 14–15, 77
Cyberspace Policy Review, 57
D
Defense Advanced Research Project Agency leaders, 95
“Defensive attacks”, 255–256
Defensive IO, 266
Department of Homeland Security (DHS), 50b, 57, 59, 61–62
National Cybersecurity Center, 59–60
Detekt tool, 92
Deterrence strategies and programs, 61
Digital battlefield attacks, 90
alleged monopoly actions, 97
America’s military secrets, 98
Australian defense officials, 93
BlackBerry, 96
blue-light cameras, 96
Chinese hacking group, 99
CIA, 96
company Web site, 92
crimes, 94
Cyber Command, 98–99
Defense Advanced Research Project Agency leaders, 95
Detekt tool, 92
disk or flash drive, 90
FBI’s Cyber’s Most Wanted, 93
federal government, 97
flood of hacks and data breaches, 94
General Zhu’s comments, 95
GIW attacks, 91
hackers, 92, 99
healthcare. gov, 94
information warfare, 95
Israeli’s secret service, 97
IW, 91
malware and spyware, 92
mission data packages, 97
NSA, 97
snooping firestorm, 98
offenses, 93
PLA, 93
PLCs, 90
“Regin” malware, 91
Samsung Electronics, 97
Secret Service, 97
security attacks/breaches, 100
social engineering, 91
spy agency, 98
spyware, 94
Syrian Twitter, 92
Taiwanese government, 92
Turing Test, 96
U.K. Cyber Security Strategy, 98
U.S. Department of Homeland Security, 95
U.S. officials, 99
voting machines, 93
Director, 237–238
Director of Security, 235–237, 240
Disaster recovery, 195
Distributed denial-of-service (DDoS), 252
E
E-mail, 76
PI, 94
Easter eggs, 81
Education, 286
advisory services, 299
assessment services, 298
augmentation, 299
cyber security consultant, 292–296
engagement
process, 297–298
setup, 296–297
international aspects, 299–300
interviewing for cyber security officer position, 288–292
legal issues, 299
market yourself as cyber security officer, 287–288
security implementation, 299
Education Awareness and Training Program (EATP), 185–186, 213–214
EINSTEIN 2 approach, 57–58
EINSTEIN 3 approach, 58–59
Electronic commerce, 77
Electronic mail, 76
Engagement
process, 297–298
setup, 296–297
Environment, changing, 305
“Errors and omissions”, 293
Ethics issues, 274–275
businessperson, 275–276
committing crimes, 275
standards of behavior, 276
unethical behavior, 277
European Union (EU), 53
F
Federal Enterprise Network management, 57
Federal role in extending cyber security, 61–62
Firmware evaluation, 189–191
First-generation warfare, 250
Formal project management techniques, 136
Framework Core, 25–26
Future Shock, 15–16
G
Global business and management environment, 28
business managers and cyber security, 42
company managers, 43
corporate management’s knowledge, 42
cyber security program, 42
principles, 44
responsibilities, 43
case study, 33, 33b
changes, 28
company
managers, 44–45
team, 29
business, 31
competitive advantage through cyber security program, 39
cyber security officer as business manager, 40–41
examples, 39
cyber security
function, 29
officer, 28–29, 32
professionals, 45
program, 31
growing networks, 28
Internet, 30
ISPs, 29–30
management responsibilities and communicating with management, 33–34
additional choices, 36
business meetings, 38
company’s culture and policies, 34
consequences, 35
cyber security officer, 34, 37–39
cyber security-associated risks, 35
decisions, 34, 36–37
document, 38
excellent gesture, 35
InfoSec, 36
problem and decision to management, 35
risks, 34
“touchy-feely don’t-hold-me-responsible” management, 39
“oldies but goodies” programs, 30
OODA loop, 32
service, support, and business orientation, 41–42
telecommunications businesses, 29
World Wide Web, 30
Global corporation, cyber security officer in, 106
CIO, 107
corporate culture, 107–108
management blank check, 108
Global information infrastructure (GII), 10, 28, 72, 77
Global information warfare (GIW), 89, 251
See also Information warfare (IW)
free market economy, 253
Internet, 252
Global nervous system, 13, 75
Global trends, 306
impact of globalization, 307
new challenges to governance, 308
pervasive insecurity, 309
policy implications, 309–310
transmuting international terrorism, 309
Globalization impact, 307
Gopher, 76
Government-wide cyber CI plan, 60
H
Hackers, 92, 99
tools, 80
Handgun, 78
Hardware evaluation, 189–191
healthcare.gov, 94
High technology, 66
See also Technology
AEA, 70
BLS, 71
electronic inventions, 68, 68t
factors, 69
industry classifications, 70
industry-based definitions, 69
inventions, 67
Microprocessor, 71–72
Moore’s law, 72–73
One Source, 71
revolutions and evolutions in, 65–66
RFA, 70
sharing of information, 66
technologically driven inventions, 67–68
technology-driven transition, 67
tools in cyber security, 82–84
transition period, 66–67
twentieth century high-technology developments and events, 74–75
twentieth-century technological developments and events, 68–69
High-technology crime prevention program (HTCPP), 237
High-technology crimes
See also Cyber security functions
CIO, 236
computer forensics, 238–240
cyber security officer, 235–236
Director and, 238
duties and responsibilities, 236–237
HTCPP, 237
violations of laws, 238
law enforcement, 240–242
NCIs, 236
High-technology-driven communications, 79–80
High-technology-driven phenomenon, 78–79
Human factor, 24–26
Human Resources (HR), 141
I
Industrial Age, 12
Info-warriors, 89
Information
assurance, 263
categories, 181–182
Information Age, 12
information-based processes, 263
superiority, 267
value, 180, 182
business information types and examples, 183–184
time factor, 183
Information Assets Protection Policy Document 500–1 (IAPPD 500–1), 142, 145–146
Information environment (IE), 132, 151, 251, 263
breakdowns in, 261
components, 260
Information operations (IO), 266
Information security (InfoSec), 36, 106, 263–264
Information system (IS), 264, 268
Information technology (IT), 104, 136–137, 202, 254
Information warfare (IW), 91, 95, 247, 252, 264
for attaining and maintaining competitive advantage, 268–269
business, 256–257
CKO, 270
COTS software, 258–259
goals and objectives, 269–270
government organization, 257–258
information, 259–260
levels and functions, 257
NCB, 271
in pocketbook, 254
defensive attacks, 255–256
high-profile events, 255
possibilities, 248
aircraft pilots, 249
local power companies, 249
“Locust Swarm” program, 248
water pumping stations, 250
TOR, 261
C2W, 263
cyber, 262
decision-maker act, 264–265
defensive IW, 266
information superiority, 267
IW-related environment, 263
KM, 264
military psychological operations, 265
NSTISSC 4009, 268
warfare, 250
generations, 250–251
Instant messages (IMs), 79
Intel’s Pentium III, 83
Internal use only information types, 183
International Security in Cyberspace, 53
Internet, 17, 30, 52, 75
annihilation of time and space, 77–78
ARPA, 75–76
communication technologies, 76
cyberspace and GII, 77
electronic commerce, 77
future, 311
global nervous system, 75
handgun, 78
impact, 17–19
Internet-enabled communications, 15
organizational impacts, 19–20
protocols, 76
to share information, 20–21
society’s struggles, 78
World Wide Web, 77
Internet, Birth of, 13–15
Internet Governance Developments, 53
Internet service providers (ISPs), 29, 78
Interviewing for cyber security officer position, 288
cyber security
officer portfolio, 290
plan, 290
interview process, 292
interviewees, 289
Intrusion detection system deployment, 57–58
Intrusion prevention systems deployment, 58–59
K
“Keep it simple, stupid” principle (“KISS” principle), 147, 206
Knowledge Age, 8–9
Knowledge management (KM), 264, 271–272
L
Laws, 24–26
enforcement, 240–242
Leadership
need for enlightened and dedicated, 305–306
position, 110
providing cyber security service and support, 110–111
using team concepts, 111–112
“Leap-ahead” technology, 60–61
Legal issues, 24–26
Level-of-effort (LOE), 202–203, 225–226
Liability issues, 279–280
Link-analysis methodology, 228
Linking cyber security program, 228–230
Litmus test, 252
Local area networks (LANs), 188
“Locust Swarm” program, 248
Locusts program, 250
Logic bombs, 82
M
Management blank check, 108
Message, 83
Metric(s), 202
analysis, 230–231
cyber security program level of effort drivers, 207
charting level of effort through number of system users, 208–209
granting users access to systems, 210–211
significance of system users chart, 209–210
project management, 218–221
Metrics charts, 211
cost-avoidance metrics, 215
cyber security program
EATP, 213–215
tests and evaluations, 212–213
management and downsizing, 215
foregoing, 218
information and information systems, 217
subchart, 216
Microdot, 83
Microprocessors, 7–8, 71–72
Mission
data packages, 97
statements, 112–113
Moore’s law, 72–73
Multipronged approach, 61
N
National Cybersecurity Center, 59–60
National information infrastructure (NII), 11, 28
National Information Systems Security (INFOSEC), 267
National Security Agency (NSA), 58–59, 97
National Security Presidential Directive 54/Homeland Security Presidential Directive 23 (NSPD-54/HSPD-23), 56
Netspionage agents, 84
Network-centric business (NCB), 270–271
Noncompliance inquiries (NCIs), 194, 217, 236
O
Observe–orient–decide–act loop (OODA loop), 32
Octopus Conference, 54
Off-ramp, 16
Off-site cyber security program organizations, 159–160
Offensive IO, 266
Offensive–defensive cyber attacks, 310
On-ramps, 16
One Source, 71
One-year review, 224
LOE activities, 225–226
projects, 226–227
Operations security (OPSEC), 267–268
Organizational responsibilities, 115
cyber security officer’s formal duties and responsibilities, 116
accountabilities, 116–117
cyber security officer position, 116
cyber security program, 115
P
People’s Liberation Army (PLA), 93
People’s Republic of China (PRC), 93
Personal digital assistants (PDAs), 132
Personal information, 181
Personal leader, 110
Pervasive insecurity, 309
Plan X, 95
Plans, processes, policies, and procedures (P4), 133
Policy implications, 309–310
Preemptive strikes, 255–256
Privacy issues, 273–274
Private information, 181
Private information types, 184
Processor serial number (PSN), 83
Programmable logic controllers (PLCs), 90
Project(s), 226–227
chart, 219–221
management, 114–115, 218
CIO, 219
cyber security officer, 221
project chart, 219–221
Q
Quality statements, 112–114
R
Radio frequency spectrum (RF spectrum), 256–257
Recruiting cyber security professionals, 168–171
in-house cyber security candidates identification, 170
outside cyber security candidates identification, 171
“Regin” malware, 91
Regional Financial Associates (RFA), 70
Regular employees, 43
Regulations, 24–26
Requirements identification function, 184–185
Research and development (R&D), 59
Return on investment (ROI), 269
Risk management, 115, 191
process, 190
process, 191–192
program, 191
recommendations to management, 192
reports, 192–193
Road Map for Internet, 16–17
S
Samsung Electronics, 97
Second-generation warfare, 251
Secret Service, 97
Security implementation, 299
Security tests and evaluations (ST&E), 193, 212–213
Security—defensive approach, 304–305
Senior corporate and government leadership, 303
Senior leadership, 303
Sensitive information, 132, 184
Software evaluation, 189–191
South America, 54
Spy agency, 98
Spyware, 94
Stand-alone microcomputers, 208
Standards, 24–26
of conduct, 278–279
Steganography, 83
software, 84
Strategic business plan (SBP), 135, 151
Stuxnet, 90
Subordinate organizations development, 156–160
cyber security program
access control and compliance, 157–158
policy and risk management, 158–159
off-site cyber security program organizations, 159–160
Syrian Twitter, 92
T
Tactical business plan (TBP), 135, 151
Team leader, 110
Technology, 63–64
See also High technology
from cave man to cyber security professional and information warrior, 64–65
revolution in, 63
Telecommunications, 196–197
businesses, 29
Terms of reference (TOR), 261
information warfare, 261
C2W, 263
cyber, 262
decision-maker act, 264–265
defensive IW, 266
information superiority, 267
IW-related environment, 263
KM, 264
military psychological operations, 265
NSTISSC 4009, 268
Time factor, 183
Tofflers’ model of technological evolution, 11
Topic-oriented information assets protection policy documents, 147
“Touchy-feely don’t-hold-me-responsible” management, 39
Traf-O-Data, 74
Transmuting international terrorism, 309
Trojan horses, 81–82
Trusted Internet Connections initiative (TIC initiative), 57
Turf battles, 43
Turing Test, 96
Twenty-first century technology, 84–86
U
U.K. Cyber Security Strategy, 98
U.S. Bureau of Labor Statistics (BLS), 70–71
U.S. Department of Defense (DoD), 251
U.S. Department of Homeland Security, 95
U.S. federal government computer security standards, 302
U.S. National Intelligence Council (NIC), 306
U.S. National Security Telecommunications and Information Systems Security Committee (NSTISSC), 267
U.S. Standard Industrial Classifications (SIC), 69
U.S.–EU Cyber Security-Related Cooperation, 53
United States, 55–57
US-CERT, 57–58
Usenet newsgroup, 76
V
Valuing information, 179, 182
corporate information value determination, 179–180
importance of determination, 180–181
information value, 180
categories, 181–182
determination, 182–184
questions, 184
types, 182
Viruses, 80–81
Vision statements, 112–113
Vulnerability, 267
W
Water pumping stations, 250
Webster’s Dictionary, 239
Whistleblower, 277
Work, 287b
World Wide Web (Web), 14, 76–77
Worms, 81
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.119.158.4