Name: Cybersecurity Strategy for the Al-Driven Era Proven strategies and data-driven tactics to disrupt attacks and strengthen… (Tim Rains)（Z-Library）
Author: Unknown Author

Page 1

(This page has no text content)

Page 2

Cybersecurity Strategy for the AI-Driven Era Third Edition Proven strategies and data-driven tactics to disrupt attacks and strengthen enterprise defenses Tim Rains

Page 3

Cybersecurity Threats and Strategies Handbook Third Edition Copyright © 2026 Packt Publishing All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews. Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author nor Packt Publishing, or its dealers and distributors, will be held liable for any damages caused or alleged to have been caused directly or indirectly by this book. Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information. Portfolio Director: Vijin Boricha Relationship Lead: Rahul Nair Project Manager: Gandhali Raut Content Engineer: Shubhra Mayuri Technical Editor: Nithik Cheruvakodan Copy Editor: Safis Editing Indexer: Tejal Soni Production Designer: Jyoti Kadam Growth Lead: Ankita Thakur First published: May 2020 Second edition: January 2023 Production reference: 1270326 Published by Packt Publishing Ltd. Grosvenor House 11 St Paul's Square Birmingham B3 1RB, UK ISBN 978-1-80602-857-3 www.packtpub.com

Page 4

I would like to dedicate this book to my wife, Brenda, and my sons, Tristan and Liam, whose support and patience made this book possible. – Tim Rains

Page 5

Foreword I began my career in cybersecurity in 1987, after graduating with a degree in computer engineering, when the field itself was still trying to define what "computer security" really meant. I joined the Computer Security Office at a federally funded research center, working closely with the National Computer Security Center—now part of the National Security Agency—during a period when the industry was being encouraged, sometimes gently and sometimes not, to build operating systems with security designed in from the start rather than bolted on later as an afterthought. In the early 1990s, I joined Trusted Information Systems during a formative period for Internet security. Our team released the TIS Firewall Toolkit and one of the earliest commercial Internet firewalls, and I had the opportunity to conduct security consulting engagements, perform risk assessments, and participate in research projects sponsored by ARPA and DARPA. When TIS was later acquired by Network Associates (McAfee), I eventually served as Vice President of Product Management overseeing firewall, intrusion detection, and encryption product lines. That arc reinforced a lesson that has stayed with me: security is never purely technical. It shows up in operations, in organizations, and in people. In 2002, my former boss, Steve Lipner, convinced me to join Microsoft's Trustworthy Computing initiative. Steve argued—correctly, as it turned out—that there was no better place to drive meaningful security impact than inside a platform used by hundreds of millions of people and organizations worldwide. It was there that I met Tim Rains. Tim and I worked together for roughly a decade during a period when Microsoft was reshaping how large technology companies approached security and trust. We collaborated on best- practice guidance for securing Windows environments and later on efforts focused on secure and trusted cloud operations. We also worked closely with Trustworthy Computing leadership through some of the most challenging moments the industry has faced, including the fallout from the Edward Snowden disclosures, when questions of trust, transparency, and government access to data stopped being abstract policy debates and became day-to-day customer concerns. We also spent many years contributing to the Microsoft Security Intelligence Report. My role focused heavily on industry-wide vulnerability analysis, which means I may claim a small amount of responsibility for inspiring Tim's expanded treatment of vulnerability disclosure trends in this new edition. Fortunately for readers, he takes those ideas much further and

Page 6

grounds them in the kind of operational experience you only get from being responsible for outcomes. Over the past decade, my own career has shifted toward leading crisis communications and issues management, and I would not describe myself today as a modern cybersecurity leader. Tim, however, very much is. He has spent years managing security operations and solving real problems across some of the largest and most complex enterprise environments in the world. That difference shows up in the way he writes, and it shows up in what he emphasizes. Many cybersecurity books do a good job explaining threats. Others focus on frameworks or technologies. Far fewer capture what it actually feels like to be accountable for defending a living organization—one constrained by budgets, legacy systems, competing business priorities, regulatory pressures, and human behavior. Operational security leadership is constant prioritization, imperfect tradeoffs, and decisions made with incomplete information. Success rarely comes from adopting the newest tool; it comes from understanding which risks matter most and then doing the sustained work to reduce them. One of Tim's defining strengths, which I observed repeatedly while working with him, is his ability to simplify complex security problems without turning them into slogans. He identifies the small number of factors that truly drive risk and then focuses teams on practical, achievable steps. That mindset runs throughout this book. This edition builds on the foundation of Tim's earlier work while expanding into areas that now sit at the center of modern security programs. New and updated chapters cover vulnerability disclosure trends, API security, living-off-the-land techniques, and the rapidly evolving intersection of artificial intelligence and cybersecurity—both securing AI systems and using AI to strengthen defense. He doesn't chase buzzwords—he carries the fundamentals forward into environments that keep getting more interconnected and more complex. A second strength of the book is how it stays anchored in data. Tim does not rely on anecdotes or fear-based narratives. Instead, he connects threat intelligence, vulnerability data, operational experience, and measurable outcomes into guidance you can actually use. You'll find descriptions of threats, but you'll also find help with the harder questions: how to evaluate tradeoffs, how to allocate resources, and how to tell whether your security program is getting better in ways that matter. Just as important, the book is honest about where security succeeds or fails in the real world: incentives, leadership decisions, cultural resistance, and the grind of execution over time. These are not side topics in operational security; they are often the main event. Tim addresses them with clarity and practicality. Cybersecurity professionals, executives, and technologists alike will benefit from this perspective. Those new to the field will gain a grounded understanding of how modern

Page 7

organizations are attacked and defended. Experienced practitioners will recognize the constraints and decisions described throughout these chapters and may find language that helps them explain those realities inside their own organizations. Having worked alongside Tim during some of the industry's most consequential security transformations, I have deep respect for his judgment, pragmatism, and commitment to improving how organizations defend themselves. This book reflects decades of experience, but more than that, it reflects a disciplined way of thinking about risk and responsibility that leaders need if they want to make progress without pretending the job is ever "done." Cybersecurity is not a problem that gets solved once and finished. It is ongoing stewardship under uncertainty, where progress is measured not by perfection, but by resilience. Books that help leaders think clearly about that responsibility are rare. This is one of them. Jeff Jones, Sr. Director, Microsoft

Page 8

Contributors About the author Tim Rains is a cybersecurity leader who has spent more than two decades helping organizations and governments understand and defend against modern threats. He has held senior security leadership roles at Microsoft, Amazon Web Services, T-Mobile, and ADT, and has advised enterprises and public-sector institutions around the world on threat intelligence, incident response, cloud security, and risk management. Tim also served on a subcommittee of the National Security Telecommunications Advisory Committee (NSTAC), contributing national-level guidance to the President of the United States on incentivizing and measuring the adoption of cybersecurity best practices. His research on vulnerabilities, malware, and attacker behavior has shaped industry practices, and he brings a practical, data-driven perspective to helping organizations build security strategies that work in the real world. I'd like to thank my family, my wife Brenda and my sons Tristan and Liam, for their support and patience while I wrote this book. Their encouragement during the writing and editing process for this 600+ page technical book kept me going. I'd like to thank all my current and former colleagues for allowing me to learn from you. Thank you to our Technical Reviewer, Karen Kent, for her help improving my last two books – I'm grateful for having the benefit of your considerable technical acumen. And finally, thank you to Packt Publishing and their fantastic staff for their help and support getting me through the publishing process for the third time.

Page 9

About the reviewer Karen Kent of Trusted Cyber Annex has been helping others communicate high-quality cybersecurity information for over 25 years. She was formerly a Senior Computer Scientist at the National Institute of Standards and Technology (NIST) and has co-authored more than 150 technical reports and papers for NIST, including the Cybersecurity Framework (CSF), the Secure Software Development Framework (SSDF), and the Common Vulnerability Scoring System (CVSS). See her full portfolio at https://kkentwrites.com.

Page 10

Table of Contents Preface xxv Free benefits with your book ............................................................................ xxxi Part 1: Introduction to Cybersecurity Strategies and Threat Intelligence 1 Chapter 1: How Enterprises Get Hacked 3 The world CISOs live in ......................................................................................... 4 Tales from the frontlines: Real-world attack scenarios .......................................... 7 Global malware attack: Worms • 10 Mitigating global worm attacks • 17 Traditional network intrusion • 19 Initial access and execution • 20 Privilege escalation • 21 Exfiltration and credential access • 21 Impact • 22 Mitigating traditional network intrusions • 23 Data breaches via insecure APIs • 24 Mitigating data breaches via insecure APIs • 27 Lessons learned: Real-world attack scenarios – conclusions • 28 How organizations get initially compromised ..................................................... 28 Unpatched vulnerabilities • 29 The importance of asset inventories • 30 Security misconfigurations • 33 Weak, leaked, and stolen credentials • 35 Social engineering • 39 Insider threats • 40 Focusing on the cybersecurity fundamentals ....................................................... 42

Page 11

Understanding the differences between attackers' motivations and tactics .......... 43 Why the volume of attacks has increased • 43 The evolving challenge of attribution • 43 Attackers' motivations • 44 Attribution is not a prerequisite to success • 46 Different types of CISOs: "The CISO spectrum" ................................................... 47 Summary ........................................................................................................... 50 References ........................................................................................................... 51 Chapter 2: What to Know About Threat Intelligence 55 What is threat intelligence? ................................................................................ 56 Where does CTI come from? • 57 Using CTI ........................................................................................................... 60 Using TTPs • 61 Using IOCs • 61 The key to using threat intelligence • 65 Threat intelligence sharing ................................................................................. 69 CTI-sharing protocols • 70 Traffic Light Protocol • 70 STIX and TAXII • 72 Reasons not to share CTI • 73 How to identify credible CTI ............................................................................... 74 Data sources • 75 Time periods • 77 Recognizing hype • 78 Predictions about the future • 78 Vendors' motives • 79 Summary ........................................................................................................... 79 References .......................................................................................................... 80 Table of Contents x

Page 12

Part 2: Evolution of the threat landscape 83 Chapter 3: Industry Vulnerability Disclosure Trends 85 From worms to resilience: the evolution of vulnerability management ................. 86 Vulnerability management primer ...................................................................... 87 Common Weakness Enumeration • 89 The CVE Program and NIST • 89 National Vulnerability Database and CVSS • 92 CISA Known Exploited Vulnerabilities catalog • 97 The risk trade-offs of CTI-driven prioritization • 98 Zero-day vulnerabilities • 100 Industry vulnerability disclosure trends ............................................................ 106 Vulnerability disclosures 1999 to now • 107 CVE Numbering Authorities • 110 Analysis of CISA's KEV catalog • 117 Vulnerability remediation SLAs • 121 Internet-facing • 121 Crown jewels • 124 Everything else • 124 Vendor vulnerability trends ............................................................................... 125 Interpreting vendor and product vulnerability data • 128 Microsoft vulnerability trends • 132 Google vulnerability trends • 134 Microsoft versus Google vulnerability disclosures • 136 Oracle vulnerability trends • 138 Vendor vulnerability trend summary • 140 Summary .......................................................................................................... 142 References ......................................................................................................... 143 Get this book's PDF version and more ................................................................ 146 xi Table of Contents

Page 13

Chapter 4: Product Vulnerability Disclosure Trends 147 Product vulnerability trends .............................................................................. 147 Operating system vulnerability trends • 148 Debian Linux vulnerability trends • 149 Linux kernel vulnerability trends • 151 Ubuntu Linux vulnerability trends • 155 Windows Server 2022 vulnerability trends • 157 Server operating system vulnerability summary • 158 Windows 11 • 158 Apple macOS vulnerability trends • 160 Client operating system vulnerability summary • 161 Google Android vulnerability trends • 161 Apple iOS vulnerability trends • 162 Mobile operating system summary • 163 Web browser vulnerability trends • 164 Apple Safari vulnerability trends • 164 Google Chrome vulnerability trends • 165 Mozilla Firefox vulnerability trends • 166 Web browser summary • 167 Vulnerability improvement framework summary • 168 Vulnerability management guidance ................................................................. 170 Asset inventories • 170 Governance, risk, and compliance • 172 Scanning for vulnerabilities • 175 Reporting • 178 More modern approaches • 181 Summary .......................................................................................................... 183 References ......................................................................................................... 183 Get this book's PDF version and more ............................................................... 186 Table of Contents xii

Page 14

Chapter 5: The Evolution of Malware 187 The era of advanced threats begins .................................................................... 188 The scope of the malware problem ..................................................................... 191 Why is there so much malware on Windows? ..................................................... 195 Malware data sources ....................................................................................... 198 The Malicious Software Removal Tool • 198 Real-time anti-malware tools • 200 Non-security data sources • 201 About malware ................................................................................................. 202 How malware infections spread • 204 Trojans • 205 Potentially unwanted software • 206 Viruses • 207 Browser modifiers • 207 Exploits and exploit kits • 208 Worms • 209 Ransomware • 210 Ransomware: the classic malware category • 211 The evolution of ransomware • 215 Measuring malware prevalence ........................................................................ 229 Global Windows malware infection analysis ..................................................... 230 Regional Windows malware infection analysis .................................................. 233 Global malware evolution ................................................................................. 236 Global malware evolution conclusions • 242 Summary ......................................................................................................... 242 References ........................................................................................................ 243 Get this book's PDF version and more ............................................................... 249 Chapter 6: Internet-Based Threats 251 What a typical attack looks like ........................................................................ 252 How many people encounter malicious websites? .............................................. 253 xiii Table of Contents

Page 15

Phishing attacks ................................................................................................ 255 How many phishing websites are there on the internet? • 257 Phishing emails • 259 Top phishing domains • 262 Mitigating phishing • 263 Multi-factor authentication • 264 Phishing training and simulations • 267 Restricting inbound network traffic • 268 Restricting outbound network traffic • 270 Drive-by download attacks ................................................................................ 273 Mitigating drive-by download attacks • 276 Botnets and DDoS attacks .................................................................................. 277 Types of DDoS attacks • 279 Summary ......................................................................................................... 282 References ........................................................................................................ 283 Get this book's PDF version and more ............................................................... 289 Chapter 7: Application Programming Interface Security 291 An API primer ................................................................................................... 292 The web application and API threat landscape .................................................. 296 The security development lifecycle ................................................................... 298 Privacy by design • 299 Threat modeling • 301 Cybersecurity risk register • 304 Security training • 305 OWASP API Security Top 10 .............................................................................. 306 Broken object-level authorization • 307 How do attackers use this type of vulnerability? • 308 Mitigation • 309 Broken authentication • 310 How do attackers use this type of vulnerability? • 310 Mitigation • 311 Table of Contents xiv

Page 16

Summary .......................................................................................................... 313 References ......................................................................................................... 314 Get this book's PDF version and more ................................................................ 315 Chapter 8: Friend or Foe? The Roles Governments Play in Cybersecurity 317 Background information • 318 The roles governments play in cybersecurity ..................................................... 320 Governments as cybersecurity market participants • 321 Governments as standards bodies • 321 Governments as enforcers • 324 Regulators • 324 Law enforcement • 326 Governments as defenders • 328 Public safety • 329 National security • 329 Military • 331 Governments as cybersecurity threats ............................................................... 334 The signals intelligence scenario • 337 Nation-state threat actors (unlawful government access to data) • 338 Lawful government access to data scenario • 342 The commercial lawful intercept scenario • 344 The threat of lawful government access to data ................................................. 347 The CLOUD Act and the PATRIOT Act • 351 FISA, GDPR, the EU-US Privacy Shield, and Schrems • 355 Managing the risk of government access to data ................................................ 362 The volume of law enforcement requests • 367 The probability of US law enforcement accessing enterprise data in the cloud • 369 The probability of US intelligence accessing data in the cloud • 376 Mitigating government access to data • 383 Understanding the scope and defining it • 383 Setting realistic objectives • 384 xv Table of Contents

Page 17

Planning data protection controls • 385 Summary ......................................................................................................... 392 References ........................................................................................................ 393 Get this book's PDF version and more ............................................................... 402 Part 3: Cybersecurity strategies 403 Chapter 9: Ingredients for a Successful Cybersecurity Strategy 405 What is a cybersecurity strategy? ...................................................................... 406 Cybersecurity culture • 406 Coalesce cybersecurity frameworks, models, and standards • 408 Communicating the efficacy of the cybersecurity program • 409 Cybersecurity strategy example • 411 Governance, risk, and compliance • 411 The cybersecurity fundamentals • 414 Advanced cybersecurity capabilities • 415 High-value assets • 415 Other ingredients for a successful strategy ........................................................ 418 Business objective alignment • 418 Cybersecurity vision, mission, and imperatives • 419 Senior executive and board support • 420 Understanding your organization's risk appetite • 422 A realistic view of current cybersecurity capabilities and technical talent • 423 Compliance program and control framework alignment • 424 An effective relationship between cybersecurity and IT • 426 Defensiveness • 428 Lack of accountability for non-compliance with policies and standards • 429 Risk-reward trade-offs are viewed differently • 429 Security culture • 431 Understanding constraints • 432 Summary ......................................................................................................... 433 References ........................................................................................................ 434 Table of Contents xvi

Page 18

Get this book's PDF version and more ............................................................... 434 Chapter 10: Cybersecurity Strategies 435 Measuring the efficacy of cybersecurity strategies ............................................. 436 Protect and recover strategy .............................................................................. 444 CFSS score • 447 Protect and recover strategy summary • 448 Endpoint protection strategy ............................................................................ 449 CFSS score • 452 Endpoint protection strategy summary • 453 Physical control and security clearances as a security strategy ........................... 454 CFSS score • 461 Physical control and security clearances strategy summary • 462 Compliance as a cybersecurity strategy ............................................................. 463 CFSS score • 466 Compliance as a cybersecurity strategy summary • 467 Application-centric strategy ............................................................................. 468 CFSS score • 469 Application-centric strategy summary • 470 Identity-centric strategy .................................................................................... 471 CFSS score • 473 Identity-centric strategy summary • 474 Data-centric strategy ......................................................................................... 475 CFSS score • 479 Data-centric strategy summary • 480 Attack-centric strategy ..................................................................................... 482 CFSS score • 485 Attack-centric strategy summary • 486 Zero trust ......................................................................................................... 487 CFSS score • 490 Resilience as a security strategy ........................................................................ 492 CFSS score • 495 xvii Table of Contents

Page 19

Resilience as a security strategy summary • 496 Cybersecurity strategies summary .................................................................... 497 DevOps and DevSecOps .................................................................................... 499 Summary .......................................................................................................... 501 References ........................................................................................................ 502 Get this book's PDF version and more ............................................................... 505 Chapter 11: Cybersecurity Strategy Implementation 507 What is the Intrusion Kill Chain? ...................................................................... 508 Modernizing the kill chain ................................................................................. 513 Mapping the Cybersecurity Usual Suspects • 513 Updating the matrix • 514 Intrusion Kill Chain or ATT&CK? • 516 Getting started .................................................................................................. 517 Maturity of current cybersecurity capabilities • 518 Pervasiveness of current cybersecurity capabilities • 520 Who consumes the data? • 520 Cybersecurity license renewals • 521 Implementing this strategy ................................................................................ 523 Rationalizing the matrix: gaps, under-investments, and over-investments • 525 Identifying gaps • 525 Identifying areas of under-investment • 525 Identifying areas of over-investment • 526 Planning your implementation • 527 Designing control sets ...................................................................................... 528 Attack phase – Reconnaissance I • 530 Example controls for Reconnaissance I • 533 Insights from ATT&CK • 534 Attack phase – Delivery • 535 Example controls for Delivery • 538 Insights from ATT&CK • 539 Attack phase – Exploitation • 540 Table of Contents xviii

Page 20

Example controls for Exploitation • 542 Insights from ATT&CK • 543 Attack phase – Installation • 545 Example controls for Installation • 548 Insights from ATT&CK • 549 Attack phase – Command and Control (C2) • 550 Example controls for C2 • 552 Insights from ATT&CK • 553 Attack phase – Reconnaissance II • 555 Example controls for Reconnaissance II • 557 Insights from ATT&CK • 558 Attack phase – Actions on Objectives • 560 Example controls for Actions on Objectives • 561 Insights from ATT&CK • 562 Summary ......................................................................................................... 568 References ........................................................................................................ 569 Get this book's PDF version and more ............................................................... 570 Chapter 12: Measuring Performance and Effectiveness 571 The importance of cybersecurity metrics ........................................................... 572 Using vulnerability management data ................................................................ 573 Assets under management versus total assets • 574 Known unpatched vulnerabilities • 577 Unpatched vulnerabilities by severity • 580 Vulnerabilities by product type • 582 Measuring performance and efficacy of an attack-centric strategy ..................... 585 Performing intrusion reconstructions • 585 Reconnaissance I phase • 590 Delivery phase • 591 Exploitation phase • 592 Other phases • 593 Using intrusion reconstruction results • 593 xix Table of Contents

Cybersecurity Strategy for the Al-Driven Era Proven strategies and data-driven tactics to disrupt attacks and strengthen… (Tim Rains)（Z-Library）

Cybersecurity Strategy for the Al-Driven Era Proven strategies and data-driven tactics to disrupt attacks and strengthen… (Tim Rains)（Z-Library）

Registered users can read the full content for free

AI Reading Assistant

Passage locations

Support Author

Recommended for You