The Cybersecurity Control Playbook From Fundamentals to Advanced Strategies

Preface xxv

Acknowledgments xxvii

1 Understanding Cybersecurity Controls 1

2 The Risk-Based Approach 17

3 Small Business Implementation 35

4 Medium-Sized Enterprises 55

5 Large Enterprises 73

6 Introduction to MITRE ATT&CK & DEFEND 97

7 Mapping Threats to Controls Using MITRE ATT&CK 117

8 Enhancing Defenses with MITRE DEFEND 141

9 Cybersecurity Frameworks Overview 169

10 Nist 800-53 191

11 Center for Internet Security (CIS) 18 Controls 221

12 Agile Implementation of Controls and Control Frameworks 253

13 Adaptive Control Testing & Continuous Improvement 267

14 Testing Controls in Small and Medium Enterprises 297

15 Control Testing in Larger and Complex Enterprises 317

16 Control Failures: Identification, Management, and Reporting 365

17 Control Testing for Regulated Companies 389

18 Emerging Threats and Technologies 409

Appendix A Glossary of Terms 427

Appendix B Creating and Using a Cybersecurity Risk Register 431

Appendix C Creating and Using a Cybersecurity Risk Taxonomy 437

Appendix D SME Security Team Structures 441

Appendix E Developing Process Maps 445

Appendix F Establishing a Regulatory Change Management Program 449

Appendix G Recommended Metrics for MITRE ATT&CK Techniques 453

Answers 467

Index 503