{"id":98596,"date":"2019-05-15T06:00:41","date_gmt":"2019-05-15T13:00:41","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=98596"},"modified":"2019-05-14T10:51:40","modified_gmt":"2019-05-14T17:51:40","slug":"cyber-canon-book-review-digital-resilience","status":"publish","type":"post","link":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/2019\/05\/cyber-canon-book-review-digital-resilience\/","title":{"rendered":"Cyber Canon Book Review: Digital Resilience"},"content":{"rendered":"

Digital Resilience: Is Your Company Ready for the Next Cyber Threat?\u00a0by Ray Rothrock, Book Reviewed by Ron Gula, President Gula Tech Adventures & Co-Founder Tenable Network Security<\/span><\/span><\/b><\/h4>\n

 <\/p>\n

\"\"<\/span><\/div><\/p>\n

 <\/p>\n

We modeled the\u00a0<\/em>Cybersecurity Canon<\/em><\/a>\u00a0after the Baseball or Rock & Roll Hall-of-Fame, except this canon is for cybersecurity books. We have more than 25 books on the initial candidate list, but we are soliciting help from the cybersecurity community to increase the number to be much more than that.\u00a0Please write a review and nominate your favorite.\u00a0<\/em><\/p>\n

The Cybersecurity Canon is a real thing for our community. We have designed it so that you can\u00a0<\/em>directly participate in the process<\/em><\/a>. Please do so!<\/em><\/p>\n

 <\/p>\n

Executive Summary<\/strong><\/h4>\n

I recommend \u201cDigital Resilience: Is Your Company Ready for the Next Cyber Threat\u201d to smart people who need to rapidly learn the history and issues of cybersecurity, so they can make effective decisions and formulate strategies to manage cybersecurity today.<\/p>\n

If you\u2019ve recently been put in charge of IT or IT operations and didn\u2019t grow up in cybersecurity over the past 20 years, this book is for you. This book is also equally useful for new CEOs, CFOs or board members who need to understand cyber risk without getting overwhelmed with IT technology or the defeatism of \u201chackers and nation states will always get in, so why bother\u201d.<\/p>\n

The book does a great job of giving some context to the rich history of cyber events and evolution of IT technology over the past few decades. It answers many of the \u201chow did we get here\u201d types of questions, and more importantly, \u201cwhere are we going?\u201d.<\/p>\n

It does an equally good job of offering some prescriptive actions organizations should take to measure and increase their overall cyber security. It does this with basic common sense and a focus on resiliency than relying on compliance or security frameworks which can be very off-putting to first time cyber readers.<\/p>\n

Ultimately, I found this book very welcoming and inviting to new cyber professionals. There is a very balanced approach to understanding that cyber security is about balancing your people, processes and technologies and communicating this to your management. These approaches will be valid for next generation of technologies and this book will still feel very fresh and modern even ten years from now.<\/p>\n

<\/h5>\n

<\/h4>\n

Review<\/strong><\/h4>\n

I recommend \u201cDigital Resilience: Is Your Company Ready for the Next Cyber Threat\u201d to smart people who need to rapidly learn the history and issues of cybersecurity, so they can make effective decisions and formulate strategies to manage cyber today.<\/p>\n

If you\u2019ve recently been put in charge of IT or IT operations and didn\u2019t grow up in cybersecurity over the past 20 years, this book is for you. This book is also equally useful for new CEOs, CFOs or board members who need to understand cyber risk without getting overwhelmed with IT technology or the defeatism of \u201chackers and nation states will always get in, so why bother\u201d.<\/p>\n

The book does a great job of giving some context to the rich history of cyber events and evolution of IT technology over the past few decades. It answers many of the \u201chow did we get here\u201d types of questions, and more importantly, \u201cwhere are we going?\u201d.<\/p>\n

It does an equally good job of offering some prescriptive actions organizations should take to measure and increase their overall cyber security. It does this with basic common sense and a focus on resiliency than relying on compliance or security frameworks which can be very off-putting to first time cyber readers.<\/p>\n

The eight chapters take the reader on a walk through cyber with very good prescriptions.<\/p>\n

Chapters one, two and three makes the case for why resilience is the best strategy. As an engineer, this really resonates with me. Unless you design security into things from the start, you are always patching and adding to your problem. The scope of how much we are already connected, even for on-premise networks and applications, is also discussed. The complexity of modern networks, their independency on each other and the large amount of cloud services and SaaS applications is discussed. More importantly, Ray suggests a variety of strategies in these chapters to help the reader come up to speed and be proactive.<\/p>\n

The remaining chapters focus on building resilience and takes the reader into some very crucial concepts. The two hardest things for cyber professionals to do well is to speak to their management team effectively and to keep track of all of their assets. Ray does an excellent job of giving a variety of ideas for how executives should be briefed on cyber issues, as well as guidelines for presenting to boards. Ray also does a great job of suggesting that keeping track of your digital assets, both on premise and in the cloud, is step one. You can\u2019t protect what you don\u2019t know. I kept waiting for Ray to pitch the NIST cyber security framework or the Center for Internet Security 20 Critical Controls, but he did not. I\u2019m a big fan of these frameworks, but I\u2019ve struggled using these for first time cyber executive briefings. I felt Ray was very clever in presenting many of the same themes in these frameworks but worded in a commonsense fashion as compared to the necessarily detailed complexity of the frameworks.<\/p>\n

Ray also has a chapter for measuring resilience. I was a fan of this chapter as it talks about what make good key metrics but stops short of claiming a grand unified theory of modeling cyber risk. While I was CEO at Tenable Network Security, I got exposed to many very smart solutions that took vulnerabilities and assets as input to a complex model that would measure risk. I found these models very suspect and felt organizations really needed to focus on simpler key metrics. Ray\u2019s view on this is very similar to mine, in which I recommend that there are two levels of excellence for cyber \u2013 those organizations that can get to a point where they can adequately detect and expel hackers and those organizations that can do this, but also try to minimize cost and redundancy of their security stack. Basically, you can spend and be effective at cyber security and when you get there, you can try to be more efficient about it as well.<\/p>\n

Ultimately, I found this book very welcoming and inviting to new cyber professionals. There is a very balanced approach to understanding that cyber security is about balancing your people, processes and technologies and communicating this to your management. These approaches will be valid for next generation of technologies and this book will still feel very fresh and modern even ten years from now.<\/p>\n

<\/h5>\n

<\/h4>\n

Conclusion<\/strong><\/h4>\n

I got into cyber security because I read books like Winn Schwartau\u2019s \u201cInformation Warfare\u201d, William Gibson\u2019s \u201cNeuromancer\u201d and Cliff Stoll\u2019s \u201cCuckoo's Egg\u201d. These books gave me a very balanced view of what cybersecurity could be, even though no one called them cybersecurity in the 90s. Until I got Ray Rothrock\u2019s book, \u201cDigital Resilience\u201d I didn\u2019t have a book I was comfortable to suggest as a great first read to the next generation of cyber professionals.<\/p>\n","protected":false},"excerpt":{"rendered":"

We modeled the\u00a0Cybersecurity Canon\u00a0after the Baseball or Rock & Roll Hall-of-Fame, except this canon is for cybersecurity books.<\/p>\n","protected":false},"author":641,"featured_media":32398,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4521],"tags":[4270,6777,6778,6779],"coauthors":[6780],"class_list":["post-98596","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-canon","tag-cybersecurity-canon-review","tag-digital-resilience","tag-ray-rothrock","tag-ron-gula"],"jetpack_featured_media_url":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-content\/uploads\/2017\/06\/cybersecuity-canon-blog-600x260.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/98596","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/users\/641"}],"replies":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=98596"}],"version-history":[{"count":6,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/98596\/revisions"}],"predecessor-version":[{"id":98615,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/98596\/revisions\/98615"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media\/32398"}],"wp:attachment":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=98596"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=98596"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=98596"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/coauthors?post=98596"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}