دانلود کتاب افسانه ها و باورهای غلط امنیت سایبری

Imagine a hypothetical company, GoodLife Bank. GoodLife is a mid-size regional bank with 12 brick-and-mortar branches, online services, and 325 employees. Terry, the Chief Information Security Officer (CISO), wants to implement user activity monitoring for bank employees. The Chief Executive Officer (CEO), Pat, balks at the proposal. “Our people are fine. They have never stolen money from us before, and we have never had this monitoring. We will be fine. That’s a waste of money,” Pat says. As another hypothetical, imagine a government organization, the Department of Redundant Information Department (DRID), part of the Agency for Propagating Bureaucracy (APB). At a staff meeting, the new Chief Information Officer (CIO) asks the DRID department head, Chris, what they have as security beyond the Federal Information Security Management Act (FISMA) minimums. Chris replies, “We do not need anything else—we do not have anything anyone would want to steal. Plus, no one would want to steal whatever we have.” (You can see why he is a valued employee at DRID.) Both CISOs, Chris and Terry, have fallen for myths about cybersecurity. Throughout this book, we’ll return to these fictitious (but representative) organizations and personnel. They represent common views and approaches that we hope to illustrate. There is a lot to know to be successful in the profession and application of cybersecurity. Knowledge is passed along in many forms, including formal education and experiential learning. Defending a computer from digital threats requires insights into how the hardware and software work, how defenses can block some threats and not others, and how to recognize when something is incorrect. One potentially dangerous pitfall is perpetuating traditional practices or beliefs as truth without evidence. While cybersecurity is an evolving discipline, we still hear the refrain “that’s the way it’s done” when we question an approach. The human brain naturally resists change, so it will take effort to overcome old myths.