Cybersecurity Science with Shawn Riley

In the rapid evolution of cybersecurity, professionals constantly adapt to the sophisticated tactics employed by adversaries. One significant transition that underscores this evolution is the shift from relying on Indicators of Compromise (IoCs) to leveraging Indicators of Behavior (IoBs) and employing Attack Flows for a more holistic analysis and response to cyber threats. This shift is not merely a change in terminology but a paradigm shift aimed at proactively identifying, understanding, and mitigating cyber threats in a more effective and efficient manner. This article delves into the differences between IoCs and IoBs, introduces the concept of Attack Flows, and outlines the implications of these transitions on various cybersecurity teams including Detection & Response, Threat Intelligence, Threat Hunting, and Risk Management teams. The Limitations of Indicators of Compromise Traditionally, cybersecurity efforts have revolved around identifying and responding to IoCs, which are...

Introduction: In the constantly changing and developing cybersecurity landscape, the attack surface of modern enterprises has grown complex, leading to fatigue. Gartner, a leading research firm, has identified Continuous Threat Exposure Management (CTEM) as one of the top cybersecurity trends in 2023. As per Gartner, by 2026, organizations that prioritize their security investments based on a CTEM program will experience two-thirds fewer breaches. This article provides an overview of the concept of CTEM, its significance, and how it can be effectively implemented. What is CTEM? Continuous Threat Exposure Management (CTEM) is a proactive approach to cybersecurity. It involves continually monitoring an organization's external surfaces, assessing vulnerabilities, and taking appropriate actions to reduce security risks. The primary goal is safeguarding the organization's digital and physical assets by implementing robust remediation plans aligned with the exposed surface vulnerabil...

In the realm of information security, Asset Management, Risk-Based Vulnerability Management, Continuous Threat Exposure Management, and Risk Management are interconnected concepts that together form a comprehensive approach to securing an organization's information assets. Here's a breakdown of their relationship: Asset Management: Definition : Asset Management involves identifying, classifying, and prioritizing an organization's assets. This includes tangible assets like hardware and intangible assets like software, data, and intellectual property. Relationship : Before you can protect something, you need to know what it is, where it is, and its value to the organization. Asset Management provides the foundation for all other security processes by identifying what needs to be protected. Focus : Assets Risk-Based Vulnerability Management: Definition : This is the process of identifying, evaluating, treating, and reporting on security vulnerabilities in systems in the contex...

In cybersecurity, risk management is a critical process that helps organizations identify, assess, and mitigate potential threats to their digital assets. The National Institute of Standards and Technology (NIST), a non-regulatory federal agency within the U.S. Department of Commerce, has developed two comprehensive frameworks to guide organizations in managing their security and privacy risks: the Risk Management Framework (RMF) and the Cybersecurity Framework (CSF). Both frameworks are centered around the concept of security controls, which are safeguards or countermeasures designed to avoid, counteract, or minimize security risks. NIST Risk Management Framework (RMF) The RMF is a structured, flexible, and risk-based approach that integrates security, privacy, and cyber supply chain risk management activities into the system development life cycle. It provides a disciplined and structured process that integrates information security and risk management activities into the system deve...

In the intricate and ever-evolving landscape of cybersecurity, strategic decision-making and precise action are paramount. One of the critical aspects of this field is the implementation of countermeasures, such as mitigations and security controls, to safeguard systems and data from cyber threats. However, the effectiveness of these countermeasures hinges on a comprehensive understanding of their effects. In a previous article, I introduced " A Standardized Vocabulary for Evaluating the Impact of Cyber Defense Decisions on Adversary Behavior ," based on the Resiliency Effects from NIST 800-160 Vol 2 Rev 1. This vocabulary provides a framework for understanding and communicating these effects, thereby enhancing the effectiveness of cybersecurity programs. In this article, we delve deeper into the potential consequences of implementing countermeasures without a clear understanding of their effects, highlighting the importance of this standardized vocabulary in cybersecurity de...

I. Introduction In the modern digital landscape, cybersecurity has become an essential concern for organizations across all sectors. The increasing sophistication of cyber threats necessitates robust and effective cybersecurity strategies. One such strategy is the Continuous Threat Exposure Management (CTEM) program. CTEM is a proactive, dynamic approach to cybersecurity that emphasizes the continuous identification, assessment, and mitigation of cyber threats. It underscores the need for ongoing vigilance and adaptation to an ever-evolving threat landscape. A critical component of CTEM programs is the understanding and application of a specific effects vocabulary. This vocabulary, as outlined in the NIST 800-160 vol 2 rev 1, provides a standardized language for cybersecurity professionals to articulate and evaluate the impact of their decisions on cyber adversaries. It consists of five high-level, desired effects on the adversary: redirect, preclude, impede, limit, and expose, and 14 ...

I. Introduction In the interconnected world of the 21st century, the importance of cybersecurity cannot be overstated. As digital technologies continue to evolve and permeate every aspect of our lives, they bring with them a host of new vulnerabilities and threats. Cybersecurity, therefore, is not just about protecting information systems and data anymore; it's about safeguarding our way of life in the digital age. From personal privacy to national security, from business operations to critical infrastructure, cybersecurity has a role to play in every facet of modern society. This article will delve into three critical areas of cybersecurity: Cybersecurity Risk Management, Risk-Based Vulnerability Management, and Continuous Threat Exposure Management. Each of these areas represents a different approach to managing and mitigating cybersecurity risks, and together, they form a comprehensive strategy for protecting an organization's digital assets. Cybersecurity Risk Management is...

In the rapidly evolving digital landscape, understanding the interconnected roles of Risk Management, Information Security, Cybersecurity, Business Continuity, and Information Technology (IT) is crucial for any organization. These concepts form the backbone of an organization's defense strategy against potential disruptions and threats, ensuring smooth operations and the protection of valuable data. Risk Management is the overarching concept that involves identifying, assessing, and mitigating any risks that could negatively impact an organization's operations or assets. These risks could be financial, operational, strategic, or related to information security. The goal of risk management is to minimize potential damage and ensure the continuity of business operations. Risk management is the umbrella under which information security, cybersecurity, and business continuity fall. Information Security is a subset of risk management. While risk management covers a wide range of pot...

I. Introduction A. Background on Cybersecurity Threats Cybersecurity threats are an ongoing concern for organizations of all sizes and across all industries. As technology continues to evolve and become more integral to business operations, the threat landscape also becomes more complex and sophisticated. Cyber attackers are constantly seeking new ways to exploit vulnerabilities and gain unauthorized access to sensitive data and systems. The consequences of a successful cyber attack can be severe, including financial losses, reputational damage, and legal consequences. Therefore, it is critical for organizations to have effective cybersecurity strategies in place to identify and mitigate potential threats. B. Definition of Attack Path Scenarios Attack Path Scenarios are a type of threat scenario used in cybersecurity to show the step-by-step sequence of tactics, techniques, and procedures (TTPs) that a cyber attacker may use to penetrate a system, gain access to sensitive data, and ach...