2.1: We discussed the CIA triad in IT and OT systems. We would like to examine critical infrastructure. Identify a sector of your choice (a good starting point is CISA’s definition of critical infrastructure sectors1). Research on the following points:
a. Why is said sector considered “critical infrastructure”?
💡 Consider what would happen to a nation's economy, health, or safety if this sector suddenly went dark for (i) a few hours, (ii) a day, (iii) a week. This also provides some insight as to what criticality entails.
b. What are the data/processes that make said sector critical?
💡 Go beyond data. Look at processes such as physical actions being controlled. For instance, what is the consequence of a nuclear power plant not being able to generate electricity due to a cyber-attack?
c. What are some sector-specific regulations that could complement and/or conflict with cybersecurity requirements?
💡 Think about strict safety or privacy mandates that might clash with standard security practices. For example, how does a requirement for immediate physical access in an emergency conflict with strict digital authentication? (This example highlights the fail-open versus fail-closed question.)
d. How has the sector responded to such complementary/conflicting points?
💡 This might need some closed-door discussions and insights with industry leaders. These can be sector-specific, and especially when it involves legislation, often involve multiple rounds of consultation.
e. Is the response in (d) a “universal” response in other critical infrastructure sectors as well?
💡 Compare a highly regulated space like healthcare with the energy sector. Do different operational realities and risk appetites prevent a universal solution?
1 CISA. (2022). Critical Infrastructure Sectors. Cybersecurity and Infrastructure Security Agency. Link
2.2: Threat modeling allowed us to identify how systems can be compromised, so that we can adequately defend them as part of the design process.
a. Research on the cost and ease of implementation of security measures at different stages of a project.
💡 The "shift left" philosophy suggests fixing a bug in design is exponentially cheaper than fixing it in production. How does retroactive security patching disrupt budgets and timelines compared to secure-by-design?
b. Threat modeling is a cybersecurity discipline that traverses across many different departments in an organization. Because different departments can have motivations different from that of the cybersecurity department, buy-in is necessary. Identify all the possible relevant stakeholders, and discuss how you would obtain their buy-in.
💡 Why did we say we can use different threat modeling frameworks in the book? Think about this scenario: a developer cares about deployment speed, while a CFO cares about the bottom line. How can you translate technical threats into business risks that resonate with each specific department?
c. From your answer in (b), we can generalize thinking about cybersecurity as a horizontal discipline rather than a vertical discipline. Horizontal disciplines traverse different business verticals. What are essential skills for cybersecurity practitioners beyond mastering the cybersecurity domain?
💡 Think of skills beyond hard technical skills. Good practitioners in roles that straddle multiple disciplines are effective “translators” of their expertise across different domains. What does this entail?.
d. How should cybersecurity professionals pick up appropriate communication skills to communicate with others in different disciplines to obtain buy-in?
💡 Think of techniques like the Feynman Method to explain complex cybersecurity concepts in simpler ways.2.
2 Farnam Street. The Feynman Technique: The Best Way to Learn Anything. In Farnam Street. Link
2.3: We introduced V2X systems as a means to complexify the contrasting emphases of different types of systems, amalgamated onto a single platform. V2X systems are difficult to adequately secure.
a. Draw a logical diagram that distinguishes between different parts of a V2X system. What are the crown jewels of a V2X system?
💡 What is existential to a V2X system? Think about the critical central parts of the V2X system.
b. What are some factors that require trade-offs with cybersecurity? How would you manage these trade-offs with stakeholders enumerated in Discussion 2.2 (b)?
💡 One example of a trade-off: Adding heavy encryption might introduce latency that a speeding car cannot afford (an extra second could mean extra 15 metres required to bring the car to an emergency stop). Are there other such trade-offs?
2.4: We examined NIST CSF 2.0 and looked into the six sections briefly: Govern (as an overarching theme), and then IPDRR.
a. Using the CSF’s Current and Target Profiles, what evidence and metrics would show progress toward the organization’s selected cybersecurity outcomes? How would a separately defined capability-assessment rubric support that work?
💡 One of the difficulties in security metrics: a good job done by the security team is a day when the organization is not breached. But measuring this is difficult, thus we require proxy measures. The choice of measure influences how stakeholders will perceive them. For instance, a measure on the number of vulnerabilities in an organization will prioritize actions to decrease them (either through internal risk analysis/deviation papers) or adopt simpler design practices to reduce the amount of trouble with vulnerability management of such systems. In fact, this is a very hard question for most readers, even those in security teams where members are not exposed to broader topics such as cyber strategy!
b. Which pillars are the most important to get right? What are some foundational challenges with said pillars?
💡 How do you protet what you do not know?
2.5: We have covered two extortion steps in a multi-extortion attack: encryption and data exfiltration. However, this can extend beyond encryption and exfiltration. Other extortion tactics include a threat of service disruption to cause service downtime, or contacting third-party associates. Examples of such families of ransomware groups include Revil, Clop and Conti.
a. Research on the types of extortion that are deemed possible.
💡 Think from an attacker how you will extort more times based on likely contractual service legel agreements with other counterparties, both within the enterprise and third parties.
b. How might multiple extortion means complexify IR? (Bear this in mind when we discuss IR in detail in Chapter 7.)
💡 Use the example from warfare: dealing with a multi-front war. Given what you have found in the previous part, how do the fronts compound on one another and force IR teams to make trade-offs?
2.6: After reading Chapter 2, you may find my approach towards cybersecurity fundamentals to be about principles and not about the latest technology.
a. Why are principles more important3?
💡 Think about what changes in cybersecurity with respect to the target that needs to be secured, and what stays invariant. The invariant aspects in a cybersecurity program are where principles emerge.
b. What does understanding cybersecurity mean to you? And how do the examples and models in Chapter 2 help you understand the principles in cybersecurity? (Chapters 4, 5 and 6 will expand on the cybersecurity principles and expose you to different areas in cybersecurity.)
💡 Do not worry if you do not have answers to this question yet. I ask this question only to remind you to engage the subsequent chapters more intentionally.
3 I am happy to have a chat on this topic, especially if you disagree with me on this point!