Foreword |
|
xi | |
|
Preface |
|
xxi | |
Author Bio |
|
xxix | |
Introduction |
|
xxxi | |
|
I Running to Stand Still and Still Falling Behind |
|
|
1 | (28) |
|
"I Can Deal with Disruption; I Can't Handle Destruction" |
|
|
1 | (1) |
|
Implications for Critical Infrastructure and National Security |
|
|
2 | (4) |
|
Goodbye to Full Manual: Automating Critical Infrastructure |
|
|
3 | (3) |
|
What It Means to be a Full Digitally Dependent in an Insecure-by-Design World |
|
|
6 | (3) |
|
|
7 | (1) |
|
|
8 | (1) |
|
A Strategy Based on Hope and Hygiene |
|
|
9 | (7) |
|
The Hollow Promise of Cyber-insurance |
|
|
11 | (1) |
|
Experts Speak Out on Hygiene |
|
|
11 | (2) |
|
|
13 | (1) |
|
A Deep Ocean of Security Solutions |
|
|
14 | (1) |
|
|
15 | (1) |
|
Congress Asks a Good Question |
|
|
16 | (2) |
|
|
18 | (11) |
|
2 Restoring Trust: Cyber-Informed Engineering |
|
|
29 | (28) |
|
Software Has Changed Engineering |
|
|
32 | (3) |
|
|
33 | (2) |
|
Engineers Still Trust the Trust Model |
|
|
35 | (2) |
|
|
35 | (2) |
|
Trusting What Works: CIE in Detail |
|
|
37 | (11) |
|
Security as a Co-equal Value to Safety |
|
|
48 | (9) |
|
Failure Mode, Near Misses, and Sabotage |
|
|
51 | (1) |
|
Failure Mode and Effects Analysis |
|
|
52 | (1) |
|
Inter-chapter Transition Thoughts and Questions |
|
|
53 | (4) |
|
3 Beyond Hope and Hygiene: Introducing Consequence-Driven, Cyber-Informed Engineering |
|
|
57 | (20) |
|
|
58 | (3) |
|
Failure Mode Analysis, Misuse, and Mis-operation |
|
|
59 | (1) |
|
Origins in Idaho and Elsewhere |
|
|
60 | (1) |
|
CCE from a Threat Perspective |
|
|
61 | (6) |
|
The USG Is Using CCE to Better Secure National Critical Functions (NCFs) |
|
|
62 | (2) |
|
CCE to Secure the Rest of Critical Infrastructure |
|
|
64 | (3) |
|
Methodology Hacking and Calculating Risk |
|
|
67 | (5) |
|
True Intent Company-Wide Conversion |
|
|
72 | (1) |
|
Transitioning to a Closer Look at CCE |
|
|
73 | (4) |
|
4 Pre-engagement Preparation |
|
|
77 | (10) |
|
Objectives of Pre-engagement Preparation |
|
|
78 | (1) |
|
Pre-engagement Preparation Walkthrough |
|
|
78 | (8) |
|
|
78 | (2) |
|
|
80 | (4) |
|
|
84 | (1) |
|
Refine Initial Taxonomy and Determine Knowledge Base Requirements |
|
|
85 | (1) |
|
Form and Train Execution Teams |
|
|
85 | (1) |
|
|
86 | (1) |
|
5 Phase I: Consequence Prioritization |
|
|
87 | (18) |
|
|
88 | (1) |
|
Killing Your Company--Investigating Potential HCEs |
|
|
89 | (2) |
|
|
91 | (7) |
|
Getting Started with Assumptions and Boundaries |
|
|
91 | (2) |
|
High-Consequence Event Scoring Criteria |
|
|
93 | (2) |
|
|
95 | (3) |
|
|
98 | (1) |
|
The (Reasonable) Resistance |
|
|
98 | (3) |
|
|
98 | (1) |
|
|
99 | (1) |
|
|
100 | (1) |
|
Sequencing and Key Participants |
|
|
101 | (2) |
|
|
102 | (1) |
|
|
102 | (1) |
|
|
103 | (2) |
|
6 Phase 2: System-of-Systems Analysis |
|
|
105 | (18) |
|
|
106 | (1) |
|
Mapping the Playing Field |
|
|
106 | (2) |
|
|
108 | (12) |
|
Translating HCEs into Block Diagrams |
|
|
110 | (1) |
|
|
111 | (2) |
|
|
113 | (4) |
|
Pursuing the "Perfect Knowledge" View |
|
|
117 | (1) |
|
Populating the Functional Taxonomy |
|
|
117 | (3) |
|
|
120 | (3) |
|
7 Phase 3: Consequence-Based Targeting |
|
|
123 | (18) |
|
|
124 | (1) |
|
Becoming your Worst (and Best) Enemy |
|
|
124 | (6) |
|
|
125 | (2) |
|
|
127 | (3) |
|
|
130 | (7) |
|
Develop Scenario Concept of Operations (CONOPS) for Each HCE |
|
|
130 | (4) |
|
Critical Information Needs |
|
|
134 | (1) |
|
Deliver CONOPS and Iterate with SMEs |
|
|
135 | (1) |
|
Attack Scenario Complexity and Confidence |
|
|
136 | (1) |
|
Present CONOPS to C-Suite |
|
|
137 | (1) |
|
Threat Intelligence from Different Sources |
|
|
137 | (2) |
|
|
139 | (2) |
|
8 Phase 4: Mitigations and Protections |
|
|
141 | (24) |
|
|
142 | (1) |
|
Taking Targets Off the Table |
|
|
142 | (5) |
|
|
147 | (4) |
|
Identifying Gaps in Expertise |
|
|
147 | (1) |
|
Develop and Prioritize Mitigation Options |
|
|
148 | (2) |
|
|
150 | (1) |
|
Present and Validate Mitigations with Entity SMEs |
|
|
150 | (1) |
|
Develop Adversary Tripwires (NCF Engagements Only) |
|
|
151 | (1) |
|
A Longer Look at Non-digital Mitigations |
|
|
151 | (9) |
|
|
158 | (2) |
|
Revisiting Phase I's Next-Worst HCEs |
|
|
160 | (1) |
|
Codifying CCE's Learnings in Policy |
|
|
161 | (4) |
|
9 CCE Futures: Training.Tools, and What Comes Next |
|
|
165 | (16) |
|
|
165 | (3) |
|
|
166 | (1) |
|
|
166 | (2) |
|
CCE Tool Suites and Checklists |
|
|
168 | (2) |
|
|
168 | (1) |
|
|
169 | (1) |
|
A More Inherently Secure Critical Infrastructure |
|
|
170 | (11) |
|
Certification and Scaling via Partners |
|
|
170 | (1) |
|
Ensuring Cybersecurity for Safety |
|
|
171 | (1) |
|
|
172 | (3) |
|
Emerging Technology Only Elevate CCE's Importance |
|
|
175 | (1) |
|
Injecting Cyber into Engineering Curricula |
|
|
175 | (2) |
|
|
177 | (4) |
Acknowledgments |
|
181 | (4) |
Glossary |
|
185 | (14) |
Appendix A CCE Case Study: Bakavia Substation Power Outage |
|
199 | (60) |
Appendix B CCE Phase Checklists |
|
259 | (11) |
Index |
|
270 | |