Kim Crawley - 8 Steps to Better Security

1 Cover

2 Title Page

3 Foreword

4 Introduction

5 Chapter 1: Step 1: Foster a Strong Security Culture Kevin Mitnick, Human Hacker Extraordinaire The Importance of a Strong Security Culture Hackers Are the Bad Guys, Right? What Is Security Culture? How to Foster a Strong Security Culture Security Leaders on Security Culture What Makes a Good CISO? The Biggest Mistakes Businesses Make When It Comes to Cybersecurity The Psychological Phases of a Cybersecurity Professional

6 Chapter 2: Step 2: Build a Security Team Why Step 2 Is Controversial How to Hire the Right Security Team…the Right Way Security Team Tips from Security Leaders The “Culture Fit”—Yuck! Cybersecurity Budgets Design Your Perfect Security Team

7 Chapter 3: Step 3: Regulatory Compliance What Are Data Breaches, and Why Are They Bad? The Scary Truth Found in Data Breach Research An Introduction to Common Data Privacy Regulations Payment Card Industry Data Security Standard Governance, Risk Management, and Compliance More About Risk Management Threat Modeling

8 Chapter 4: Step 4: Frequent Security Testing What Is Security Testing? Security Testing Types What's Security Maturity? The Basics of Security Audits and Vulnerability Assessments A Concise Guide to Penetration Testing Security Leaders on Security Maturity Security Testing Is Crucial

9 Chapter 5: Step 5: Security Framework Application What Is Incident Response? Your Computer Security Incident Response Team Cybersecurity Frameworks

10 Chapter 6: Step 6: Control Your Data Assets The CIA Triad Access Control Patch Management Physical Security and Your Data Malware Cryptography Basics Bring Your Own Device and Working from Home Data Loss Prevention Managed Service Providers The Dark Web and Your Data Security Leaders on Cyber Defense Control Your Data

11 Chapter 7: Step 7: Understand the Human Factor Social Engineering Phishing What Can NFTs and ABA Teach Us About Social Engineering? How to Prevent Social Engineering Attacks on Your Business UI and UX Design Internal Threats Hacktivism Note

12 Chapter 8: Step 8: Build Redundancy and Resilience Understanding Data and Networks Building Capacity and Scalability with the Power of the Cloud Back It Up, Back It Up, Back It Up RAID What Ransomware Taught Business About Backups Business Continuity Disaster Recovery

13 Chapter 9: Afterword Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Keeping Your Business Cyber Secure

14 Index

15 Copyright

16 Dedication

17 About the Author

18 Acknowledgments

19 End User License Agreement

1 Cover

2 Title Page

3 Copyright

4 Dedication

5 About the Author

6 Acknowledgments

7 Foreword

8 Introduction

9 Table of Contents

10 Begin Reading

11 Index

12 End User License Agreement

1 i

2 xi

3 xii

4 xiii

5 xiv

6 xv

7 xvi

8 xvii

9 xviii

10 xix

11 xx

12 1

13 2

14 3

15 4

16 5

17 6

18 7

19 8

20 9

21 10

22 11

23 12

24 13

25 14

26 15

27 16

28 17

29 18

30 19

31 20

32 21

33 22

34 23

35 24

36 25

37 26

38 27

39 28

40 29

41 30

42 31

43 32

44 33

45 34

46 35

47 36

48 37

49 39

50 40

51 41

52 42

53 43

54 44

55 45

56 46

57 47

58 48

59 49

60 50

61 51

62 52

63 53

64 54

65 55

66 56

67 57

68 58

69 59

70 60

71 61

72 62

73 63

74 64

75 65

76 66

77 67

78 68

79 69

80 70

81 71

82 72

83 73

84 74

85 75

86 76

87 77

88 78

89 79

90 80

91 81

92 82

93 83

94 84

95 85

96 86

97 87

98 88

99 89

100 90

101 91

102 92

103 93

104 94

105 95

106 96

107 97

108 98

109 99

110 100

111 101

112 102

113 103

114 104

115 105

116 106

117 107

118 109

119 110

120 111

121 112

122 113

123 114

124 115

125 116

126 117

127 118

128 119

129 120

130 121

131 122

132 123

133 124

134 125

135 126

136 127

137 128

138 129

139 130

140 131

141 132

142 133

143 134

144 135

145 136

146 137

147 138

148 139

149 140

150 141

151 142

152 143

153 144

154 145

155 146

156 147

157 148

158 149

159 150

160 151

161 152

162 153

163 155

164 156

165 157

166 158

167 159

168 160

169 161

170 162

171 163

172 164

173 165

174 166

175 167

176 168

177 169

178 170

179 171

180 172

181 173

182 174

183 175

184 176

185 177

186 178

187 179

188 180

189 181

190 182

191 183

192 184

193 185

194 186

195 187

196 188

197 189

198 190

199 191

200 192

201 193

202 194

203 195

204 196

205 197

206 198

207 199

208 200

209 201

210 202

211 203

212 204

213 ii

214 iii

215 iv

216 v

217 205

Kim Crawley

I first met Kim Crawley in person in October 2019, in Toronto at SecTor, Canada's version of DEFCON. We'd been acquainted for a long time via Twitter, and she was the one who originally turned me onto SecTor and inspired me to submit a talk, citing the merits of her hometown and the conference. She was right about both. In between the superb sessions there, amidst the fantastic energy of that conference and the international vibe of the city, we walked around and talked about information security, cyber resilience, and neurodiversity, topics woven deeply into the fabric of both our lives. Over lunch one afternoon, our conversation came around to how our industry can do a better job of helping small and midsize organizations better prepare for strategic response to cybercrime. We agreed that by helping smaller and more vulnerable organizations, the larger organizations and the collective industry as a whole would also benefit. We compared notes on tactics and strategies that don't have to cost a lot of time or money.

Shortly after our time and discussions at SecTor, Covid-19 hit. Kim didn't slow down. She founded DisInfoSec, a pop-up infosec conference showcasing infosec professionals who identify as neurodivergent (including ADD, AHDH, autism, Asperger's, dyslexia, and more). Inspired by Lesley Carhart's PancakesCon and other events, DisInfoSec was a first-of-its-kind event and took place on July 11, 2020. The con included a lot of great talks and raised funds for the Autistic Self Advocacy Network, the Autistic Women and Nonbinary Network, and the Council of Canadians with Disabilities. Kim's commitment to improving inclusion and nudging the world to a better place is showcased in her actions, and this new book is merely an extension of her productive mindset.