CRC Press Cyber Strategy: Risk-Driven Security and Resiliency

Cyber Strategy: Risk-Driven Security and Resiliency provides a process and roadmap for any company to develop its unified Cybersecurity and Cyber Resiliency strategies. It demonstrates a methodology for companies to combine their disassociated efforts into one corporate plan with buy-in from senior management that will efficiently utilize resources, target high risk threats, and evaluate risk assessment methodologies and the efficacy of resultant risk mitigations. The book discusses all the steps required from conception of the plan from preplanning (mission/vision, principles, strategic objectives, new initiatives derivation), project management directives, cyber threat and vulnerability analysis, cyber risk and controls assessment to reporting and measurement techniques for plan success and overall strategic plan performance. In addition, a methodology is presented to aid in new initiative selection for the following year by identifying all relevant inputs. Tools utilized include: Key Risk Indicators (KRI) and Key Performance Indicators (KPI) National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF) Target State Maturity interval mapping per initiative Comparisons of current and target state business goals and critical success factors A quantitative NIST-based risk assessment of initiative technology components Responsible, Accountable, Consulted, Informed (RACI) diagrams for Cyber Steering Committee tasks and Governance Boards’ approval processes Swimlanes, timelines, data flow diagrams (inputs, resources, outputs), progress report templates, and Gantt charts for project management The last chapter provides downloadable checklists, tables, data flow diagrams, figures, and assessment tools to help develop your company’s cybersecurity and cyber resiliency strategic plan. Review "This book is an invaluable step-by-step guide to implementing a truly resilient Cybersecurity framework. The universal concepts and strategies presented here are complemented by pragmatic processes, roadmaps, and templates useful in any organization. Whether you're a project manager, a cyber risk analyst, or a C-level executive, this book has something for you." - William Flynn, Independent Management Consultant   "Achieving a correctly secured, risk-managed technology environment requires a strong plan, great program management, organizational buy-in, and a focus on execution, none of which happen by accident. This book provides a handy step-by-step guide for the cyber security practitioner in the development and implementation of their security improvement plan, including all-important risk assessments, budgeting, project plans, and governance models to help ensure success (or flag and address problems before they become big issues). Electronic templates available to the purchaser help simplify the work required. The practical application of this book to aid in managing real-world program implementation challenges is its greatest strength." - David S Bauer, Managing Partner and Co-Founder, Holding Ground Decision Intelligence LLC   "Cyber security information is a complex topic to understand. There are many organisations offering standards and strategic frameworks that asks you to choose theirs without offering an understanding of the domain first. If you want to learn about the cyber security strategy domain end-to-end then this is the book that does it! You can then use the checklist and templates in the book knowing you are adopting best practice, or if you organisation already has adopted a standard, strengthen these with the information you have learned. " - Ian Thomson, Director of AI Automation Services, SystemsAccountants and Kanbina AI Services   "This is the tour de force on designing, implementing and maintaining a modern cyber security and resiliency program. This book is a necessity for all information security and resiliency professionals." - Howard Taylor, C