Terebrate

Executive Summary The latest candidate for the cyber security canon is Rich Baich’s Winning as a CISO . The roles of the chief information officer (CIO), the chief security officer (CSO), and the chief information security officer (CISO) in the modern enterprise have been constantly changing since we invented the need for such roles in the 1980s and 1990s. By the mid-2000s, the industry had settled on tucking the security function for an organization under the IT function of an organization. In other words, the CISO works for the CIO. But Baich is an innovative thinker. He has looked at how the CISO role has evolved over the years and makes a pretty good case for where it needs to go next. By asking questions about the appropriate supervisor for a CISO, a CISO’s needed skill set, and ways to approach the CISO job function, Baich breaks new ground on how the industry should views these topics. Our industry will be slow to adopt these new ideas, but with the rash of highly publiciz...

Executive Summary In Spam Nation , Brian Krebs covers a key portion of our cyber security and cyber crime history: 2007–2013, that period when we started to learn about the Russian Business Network, bulletproof-hosting providers, fast-flux obfuscation, criminal best business practices, underground cyber crime forums, and strange-sounding botnet names like Conficker, Rustock, Storm, and Waledac. This period just happens to coincide with Krebs’s rise in popularity as one of the leading cyber security journalists in the industry. His relationship with two competitive pharmaceutical spammers—Pavel Vrublevsky and Dimitry Nechvolod—is a big bag of crazy and is the key storyline throughout the book. The competition between Vrublevsky and Nechvolod escalated into something that Krebs calls the Pharma Wars and Krebs gives us a bird’s-eye view into the details of that escalation that eventually destroyed both men and the industry they helped to create. Krebs’s weird symbiotic relationship...

Executive Summary Richard Bejtlich is one of the most respected security practitioners in the community. If he publishes something, we should all take notice. In The Practice of Network Security Monitoring , Bejtlich provides the theory and the hands-on tutorial on how to do network security monitoring the right way. The book is a primer on how to think about network security monitoring and incident response.  For seasoned security practitioners, working through the examples in this book will only increase your understanding of the subject.  For the beginners in the crowd,  Bejtlich  provides step-by-step instructions on how to install, configure, and use some of the best open-source tools available that will help any security program improve its network security monitoring capability. Newbies working through the examples in this book will demonstrate to themselves, once and for all, if they have what it takes to work in this field. This b...

Executive Summary Lexicon is an exciting story that is really about social engineering taken to the nth degree. It is not a cyber security canon candidate, however, because it does not meet the criteria established last year,[3] but it does share some connective tissue with one of my favorite canon candidates, Snow Crash , and offers some practical advice about how modern media consumers can protect themselves from media manipulation. This is not a must-read for the cyber security professional, but it is wonderful beach read if you are looking for something fun to take with you on your next vacation. Introduction Lexicon [1] is not a cyber security canon candidate because it really does not talk about anything specific to cyber security, but it shares its premise about the origination of human language with a candidate-favorite called Snow Crash .[2][3] It is a run-and-gun conspiracy thriller in which the evil cabal, called the Poets, has mastered the art of persuasion ...