Countering Cyber Sabotage: Introducing Consequence-Driven, Cyber-Informed Engineering (CCE) introduces a new methodology to help critical infrastructure owners, operators and their security practitioners make demonstrable improvements in securing their most important functions and processes. Current best practice approaches to cyber defense struggle to stop targeted attackers from creating potentially catastrophic results. From a national security perspective, it is not just the damage to the military, the economy, or essential critical infrastructure companies that is a concern. It is the cumulative, downstream effects from potential regional blackouts, military mission kills, transportation stoppages, water delivery or treatment issues, and so on. CCE is a validation that engineering first principles can be applied to the most important cybersecurity challenges and in so doing, protect organizations in ways current approaches do not. The most pressing threat is cyber-enabled sabotage, and CCE begins with the assumption that well-resourced, adaptive adversaries are already in and have been for some time, undetected and perhaps undetectable. Chapter 1 recaps the current and near-future states of digital technologies in critical infrastructure and the implications of our near-total dependence on them. Chapters 2 and 3 describe the origins of the methodology and set the stage for the more in-depth examination that follows. Chapter 4 describes how to prepare for an engagement, and chapters 5-8 address each of the four phases. The CCE phase chapters take the reader on a more granular walkthrough of the methodology with examples from the field, phase objectives, and the steps to take in each phase. Concluding chapter 9 covers training options and looks towards a future where these concepts are scaled more broadly.

Details a step-by-step methodology developed by the Idaho National Laboratory in conjunction with multiple branches of the U.S. government including DHS, DoE, and DoD as well as with industry partners. Provides a comprehensive understanding of the highest-impact risks to critical infrastructure organizations and components. Explains to critical infrastructure stakeholders how their most critical processes and functions are targeted. Highlights how leveraging engineering-first principles helps prevent the highest consequence damage and destruction. Outlines prioritized, preventative measures to counter the tactics and practices of highly resourced, adaptive nation-state adversaries. Appendices include checklists for each phase plus a highly detailed technical account of CCE applied to a fictional country

A fresh and refined appraisal of today's top cyber threats

NOW AN HBO® DOCUMENTARY FROM AWARD-WINNING DIRECTOR JOHN MAGGIO • “An important—and deeply sobering—new book about cyberwarfare” (Nicholas Kristof, New York Times), now updated with a new chapter. The Perfect Weapon is the startling inside story of how the rise of cyberweapons transformed geopolitics like nothing since the invention of the atomic bomb. Cheap to acquire, easy to deny, and usable for a variety of malicious purposes, cyber is now the weapon of choice for democracies, dictators, and terrorists. Two presidents—Bush and Obama—drew first blood with Operation Olympic Games, which used malicious code to blow up Iran’s nuclear centrifuges, and yet America proved remarkably unprepared when its own weapons were stolen from its arsenal and, during President Trump’s first year, turned back on the United States and its allies. And if Obama would begin his presidency by helping to launch the new era of cyberwar, he would end it struggling unsuccessfully to defend the 2016 U.S. election from interference by Russia, with Vladimir Putin drawing on the same playbook he used to destabilize Ukraine. Moving from the White House Situation Room to the dens of Chinese government hackers to the boardrooms of Silicon Valley, New York Times national security correspondent David Sanger reveals a world coming face-to-face with the perils of technological revolution, where everyone is a target. “Timely and bracing . . . With the deep knowledge and bright clarity that have long characterized his work, Sanger recounts the cunning and dangerous development of cyberspace into the global battlefield of the twenty-first century.”—Washington Post

ASIS Book of The Year Winner as selected by ASIS International, the world's largest community of security practitioners Critical Infrastructure Risk Assessment wins 2021 ASIS Security Book of the Year Award - SecurityInfoWatch ... and Threat Reduction Handbook by Ernie Hayden, PSP (Rothstein Publishing) was selected as its 2021 ASIS Security Industry Book of the Year. As a manager or engineer have you ever been assigned a task to perform a risk assessment of one of your facilities or plant systems? What if you are an insurance inspector or corporate auditor? Do you know how to prepare yourself for the inspection, decided what to look for, and how to write your report? This is a handbook for junior and senior personnel alike on what constitutes critical infrastructure and risk and offers guides to the risk assessor on preparation, performance, and documentation of a risk assessment of a complex facility. This is a definite “must read” for consultants, plant managers, corporate risk managers, junior and senior engineers, and university students before they jump into their first technical assignment.

Silent Wars: Espionage, Sabotage, and the Covert Battles in Cyberspace delves into the shadowy world of covert cyber conflict, that unfold beyond the public eye. Scrutinizing the intricate balance between espionage and assault, the author, Josh, disentangles the convoluted web of digital warfare, where the line between intelligence-gathering and outright attack blurs. Silent Wars navigates the intricate landscape of covert cyber operations, examining a multitude of cases that shed light on the diverse tactics and strategies employed by nations in this modern arena of intangible warfare. Through a meticulous analysis of case studies, military doctrines, and technical underpinnings, Josh unveils the striking reality that contemporary cyber operations, while seemingly groundbreaking, still embody the age-old essence of conflict waged through non-physical domains such as information space and the electromagnetic spectrum. Silent Wars breaks down the multifaceted nature of offensive cyber operations, emphasizing the stark contrasts between various forms of cyberattacks. From the painstakingly slow and calculated infiltrations that demand unwavering discipline and patience, to the fleeting strikes designed to momentarily disrupt the adversary's tactics, Silent Wars scrutinizes the full spectrum of digital offensives. Venturing into the clandestine strategies of prominent state actors such as the United States, Russia, China, and Iran, Josh's examination of their distinct approaches, strengths, and challenges reveals the complexities of leveraging cyber operations for strategic advantage. Silent Wars unravels the veiled intricacies of this evolving domain, exposing the concealed dynamics that shape the future of covert cyber warfare.

Imagine you work in a power plant that uses a half dozen massive, 5-story-tall steam boilers. If a cyber attack makes a boiler over-pressurize and explode, the event will most likely kill you and everyone else nearby. Which mitigation for that risk would you prefer? A mechanical over-pressure valve on each boiler where, if the pressure in the boiler gets too high, then the steam forces the valve open, the steam escapes, and the pressure is released? Or a longer password on the computer controlling the boilers? Addressing cyber risks to physical operations takes more than cybersecurity. The engineering profession has managed physical risks and threats to safety and public safety for over a century. Process, automation and network engineering are powerful tools to address OT cyber risks - tools that simply do not exist in the IT domain. This text explores these tools, explores risk and looks at what "due care" means in today's changing cyber threat landscape. Note: Chapters 3-6 of the book Secure Operations Technology are reproduced in this text as Appendix B.