Оглавление
Chris Castaldo. Start-Up Secure
Table of Contents
List of Illustrations
Guide
Pages
Additional praise for Start-Up Secure
Start-Up Secure. Baking Cybersecurity into Your Company from Founding to Exit
Foreword
Preface
WHY WRITE THIS BOOK?
NOTES
Acknowledgments
About the Author
Introduction. ABOUT THIS BOOK
HOW TO USE THIS BOOK
CHAPTER ONE Minimum Security Investment for Maximum Risk Reduction
COMMUNICATING YOUR CYBERSECURITY
EMAIL SECURITY
SECURE YOUR CREDENTIALS
SAAS CAN BE SECURE
PATCHING
Example 1
Example 2
ANTIVIRUS IS STILL NECESSARY BUT GOES BY A DIFFERENT NAME
MOBILE DEVICES
SUMMARY
ACTION PLAN
NOTES
CHAPTER TWO Cybersecurity Strategy and Roadmap Development
WHAT TYPE OF BUSINESS IS THIS?
WHAT TYPES OF CUSTOMERS WILL WE SELL TO?
WHAT TYPES OF INFORMATION WILL THE BUSINESS CONSUME?
WHAT TYPES OF INFORMATION WILL THE BUSINESS CREATE?
WHERE GEOGRAPHICALLY WILL BUSINESS BE CONDUCTED?
BUILDING THE ROADMAP
Opening Statement
Stakeholders
Tactics
Measurability
CASE STUDY
SUMMARY
ACTION PLAN
NOTE
CHAPTER THREE Secure Your Credentials
PASSWORD MANAGERS
PASSPHRASE
MULTI-FACTOR AUTHENTICATION
ENTITLEMENTS
KEY MANAGEMENT
CASE STUDY
SUMMARY
ACTION PLAN
NOTES
CHAPTER FOUR Endpoint Protection
VENDORS
SELECTING AN EDR
MANAGED DETECTION AND RESPONSE
CASE STUDY
SUMMARY
ACTION PLAN
NOTES
CHAPTER FIVE Your Office Network
YOUR FIRST OFFICE SPACE
CO-WORKING SPACES
VIRTUAL PRIVATE NETWORK
SUMMARY
ACTION PLAN
NOTES
CHAPTER SIX Your Product in the Cloud
SECURE YOUR CLOUD PROVIDER ACCOUNTS
PROTECT YOUR WORKLOADS
Patching
Endpoint Protection
SECURE YOUR CONTAINERS
SUMMARY
ACTION PLAN
NOTES
CHAPTER SEVEN Information Technology
ASSET MANAGEMENT
IDENTITY AND ACCESS MANAGEMENT
SUMMARY
ACTION PLAN
CHAPTER EIGHT Hiring, Outsourcing, or Hybrid
CATALYSTS TO HIRING
GET THE FIRST HIRE RIGHT
EXECUTIVE VERSUS INDIVIDUAL CONTRIBUTOR
RECRUITING
JOB DESCRIPTIONS
INTERVIEWING
FIRST 90 DAYS IS A MYTH
SUMMARY
ACTION PLAN
NOTE
CHAPTER NINE Compliance
MASTER SERVICE AGREEMENTS, TERMS AND CONDITIONS, OH MY
PATCH AND VULNERABILITY MANAGEMENT
ANTIVIRUS
AUDITING
INCIDENT RESPONSE
POLICIES AND CONTROLS
CHANGE MANAGEMENT
ENCRYPTION
DATA LOSS PREVENTION
DATA PROCESSING AGREEMENT
SUMMARY
ACTION PLAN
NOTE
CHAPTER TEN Industry and Government Standards and Regulations
OPEN SOURCE. OWASP
Center for Internet Security 20
UNITED STATES PUBLIC. SOC
RETAIL. PCI DSS
SOX
ENERGY, OIL, AND GAS
NERC CIP
ISA-62443-3-3 (99.03.03)-2013
Federal Energy Regulatory Commission
Department of Energy Cybersecurity Framework
HEALTH
HIPAA
HITECH
HITRUST
FINANCIAL
FFIEC
FINRA
NCUA
EDUCATION
FERPA
INTERNATIONAL
International Organization for Standardization (ISO)
UL 2900
GDPR
Privacy Shield
UK Cyber Essentials
UNITED STATES FEDERAL AND STATE GOVERNMENT
NIST
NISPOM
DFARS PGI
FedRAMP
FISMA
NYCRR 500
CCPA
SUMMARY
ACTION PLAN
NOTES
CHAPTER ELEVEN Communicating Your Cybersecurity Posture and Maturity to Customers
CERTIFICATIONS AND AUDITS
QUESTIONNAIRES. Shared Assessments
Cloud Security Alliance
Vendor Security Alliance
SHARING DATA WITH YOUR CUSTOMER
CASE STUDY
SUMMARY
ACTION PLAN
NOTES
CHAPTER TWELVE When the Breach Happens
CYBER INSURANCE
INCIDENT RESPONSE RETAINERS
THE INCIDENT
TABLETOP EXERCISES
SUMMARY
ACTION PLAN
NOTE
CHAPTER THIRTEEN Secure Development
FRAMEWORKS
BSIMM
OpenSAMM
CMMI
MICROSOFT SDL
PRE-COMMIT
INTEGRATED DEVELOPMENT ENVIRONMENT
COMMIT
BUILD
PENETRATION TESTING
SUMMARY
ACTION PLAN
NOTES
CHAPTER FOURTEEN Third-Party Risk
TERMS AND CONDITIONS
SHOULD I REVIEW THIS VENDOR?
WHAT TO ASK AND LOOK FOR
Verify DMARC Settings
Check TLS Certificates
Check the Security Headers of the Website
SUMMARY
ACTION PLAN
NOTE
CHAPTER FIFTEEN Bringing It All Together
Glossary
Index
WILEY END USER LICENSE AGREEMENT
Отрывок из книги
“It's rare to see a cybersecurity guide of any kind that is relevant, current, and, most importantly, cogent and accessible. Chris Castaldo has not only produced such a guide but has tailored it for an audience who has never before received such wisdom in a digestible manner – the startup community. Startups are notoriously fast-moving, and Castaldo's book keeps up with them, showing them the types of practical security controls they need throughout their rapid journey to whatever exit strategy they envision.”
– Allan Alford, CISO/CTO, TrustMAPP and Host of the The Cyber Ranch Podcast
.....
This syncs your phone and the specific account. When you log in with your credentials again you simply open the app and enter the code displayed. There are alternative services to this app, such as Authy. Both of these apps work on iPhone and Android. Large organizations may even employ a physical token that displays a number that changes every 30 seconds. These physical tokens offer a higher degree of security but are more expensive to deploy and maintain.
FIGURE 1.2 Google Titan Security Keys
.....
