Secrets of a Cyber Security Architect 1st Edition by Brook Schoenfield ISBN 9781315352176 1315352176

Chapter 1 The Context of Security Architecture

1.1 Omnipresent Cyber War

1.2 Know the Threat Actors

1.2.1 Useful Exploits Don’t Die

1.3 Everything Can Become a Target

1.4 Warlords and Pirates

1.5 What Is the Scope of a Security Architect?

1.5.1 Are There Really Two Distinct Roles?

1.6 Essential Technique

1.6.1 Threat Modeling: An Essential Craft

1.6.2 Architecture Is Primary

1.7 Aiming Design Toward Security

1.7.1 What Is Secure Software?

1.7.2 Secure Design Primer

1.8 Summary

Chapter 2 What Is Security Architecture, and Why Should I Care?

2.1 Define Security Architecture

2.1.1 Software Security

2.1.2 Security Architecture Practices

2.2 Relevant Knowledge Domains

2.3 More About Architecture

2.4 Architectures of Security

2.5 Architecture as a Part of Cyber Security

2.6 Security Architecture in Software Development

2.7 Generally, Experience Is a Teacher

2.8 Introducing Attack Methods

2.9 Speaking of Defense

2.10 More Precise Definition

2.11 Summary

Chapter 3 Architecture, Attacks, and Defenses

3.1 Yes, Exploit Details, But

3.2 Security Architects Must …

3.3 Understanding Categories of Attacks

3.4 Attack Knowledge for Defense

3.5 Example: Heartbleed Analysis

3.5.1 Heartbleed Technical Analysis

3.6 Analyze to Defend

3.7 Turn OffTLS?

3.8 Security Architecture Analyses

3.8.1 Some Cheap Risk Concepts

3.8.2 JGERR Risk Rating

3.8.3 At Base: Threat Model

3.9 Threat Modeling Definition

3.9.1 Alternate Definition

3.9.2 When Is My Threat Model Done?

3.10 Summary

Chapter 4 Culture Hacking

4.1 Team Tourism

4.1.1 Build and Maintain Trust

4.1.2 Don’t Squander Influence

4.2 Threat Modeling: Just Do It

4.2.1 “Trust Developers?”

4.2.2 Threat Model Training Is for Everyone

4.3 More Culture Hacks

4.3.1 Nimble Governance

4.3.2 Build Skills by Sharing

4.3.3 What to Do About “It Depends”

4.3.4 Is the Threat Model Finished?

4.3.5 Create a Security Contract

4.3.6 Threat Models Are Not Additive!

4.3.7 Audit and Security Are Not the Same Thing

4.4 From Program to Transformation

4.4.1 Pro-Social Modeling

4.4.2 Leaders Must Get Challenged

4.4.3 Hack All Levels

4.4.4 Coding Is Fraught with Error

4.4.5 Effective Secure Coding Training

4.4.6 Make Validation Easy

4.5 Summary

4.5.1 We All Can Use Some Feedback

Chapter 5 Learning the Trade

5.1 Attack Knowledge

5.2 Which Defenses for What System?

5.3 Threat Modeling: The Learning Method

5.3.1 How to Escalate for Management Decision

5.4 To Accelerate: Cross Pollinate

5.5 Build a Community of Practice

5.6 Support Learners’ Errors

5.7 Facilitate as Much as Lead

5.8 Summary

Chapter 6 Problem Areas You Will Encounter

6.1 What Does a Mature Practice Look Like?

6.1.1 Do We Add Value?

6.1.2 The War Is Over

6.1.3 Optimum Tool Use

6.1.4 You Know That You’re Maturing When

6.1.5 “Nothing Proves Architecture Like Nothing”

6.1.6 Get It in Writing!

6.2 Typical Problems Programs Encounter

6.2.1 Scale

6.2.2 Assessments Take Too Long

6.2.3 Late Engagement

6.2.4 Skill Churn

6.2.5 Exceptions

6.2.6 Fostering Innovation

6.3 Dealing with Chaotic Elements

6.3.1 There Are Differences

6.3.2 Translate and Generalize

6.4 Summary

Appendix A Heartbleed Exposure, What Is It Really?

Appendix B Developer-Centric Security

Appendix C Don’t Substitute CVSS for Risk: Scoring System Inflates Importance of CVE-2017-3735

Appendix D Security Architecture Smart Guide:

Appendix E Threat Modeling’s Definition of Done

References

Index