Cybersecurity First Principles: A Reboot of Strategy and Tactics

by Rick Howard

Since the 1970s, infosec practitioners have been incrementally improving the overall security landscape without ever taking a moment to consider if they were going in the right strategic direction in the first place. The author makes the case that they weren't. The general direction wasn't wrong per se, but the thought leaders in the space never got to the root of the problem. Retracing the footsteps of scientific thought leaders like Descartes and Elon Musk, this book makes the case for the ultimate cybersecurity first principle and outlines the strategies and tactics necessary to pursue it.

A reboot of infosec strategy and tactics, this book explains:
- Why a first principle approach is necessary
- Five strategies that emerge because of it: Zero Trust, Intrusion Kill Chain Prevention, Resilience, Automation and Risk Forecasting
- Hands-on tactics to achieve each strategy

Unknown Binding

Published April 27, 2023

About the author

Rick is the President of the Cybersecurity Canon Project, a volunteer nonprofit seeking to be the Infosec Community’s first source for curated and timeless cybersecurity content. His prior jobs include Chief Security Officer, Chief Analyst, Senior Fellow, and podcast host at The Cyberwire (a cybersecurity podcasting network), CSO for Palo Alto Networks (a security vendor), CISO for TASC (government contractor), GM for iDefense (A commercial cyber threat intelligence service at Verisign), Global SOC Director for Counterpane (one of the original MSSPs), and Commander for the U.S. Army’s Computer Emergency Response Team where he coordinated network defense, network intelligence and network attack operations for the Army's global network. He was one of the founding organizers of the Cyber Threat Alliance (an ISAC for security vendors) and he is the co-founder of the Cybersecurity Canon Project; a Rock & Roll Hall of Fame for cybersecurity books. Rick holds a Master of Computer Science degree from the Naval Postgraduate School and an engineering degree from the US Military Academy. He also taught computer science at the Academy from 1993 to 1999. He has published one book on cybersecurity and has been the executive editor for two others.