Big Breaches: Cybersecurity Lessons for Everyone

by Neil Daswani and Moudy Elbayadi

The key to understanding the value of the new book, Big Breaches: Cybersecurity Lessons for Everyone, by Neil Daswani and Moudy Elbayadi, is the word “everyone” in its title. The authors go into significant detail recounting the most destructive and notorious data breaches of the last decade. These are cybersecurity disasters that “everyone” surely knows about. Tout le monde! We know all about these breaches, or so we think. As the book makes clear, “everyone” clearly doesn’t have much of a real clue how bad things are—and how much worse things are about to get. Thus, “everyone,” me included, needs some cybersecurity lessons.

The book goes into depth on the breaches at Capitol One, Marriott, Equifax and more. It reviews what went wrong at Office of Personnel Management (OPM), Yahoo, Target and JP Morgan Chase. The authors also delve into some of Facebook’s data leaks and irregularities. Throughout, they look at how these incidents almost always involve a failure to prioritize, invest in and execute cybersecurity initiatives.

Big Breaches deals with one of the great ironies of this era: Despite spending tens of billions of dollars on security, the world seems less and less secure with every passing year. Hundreds of thousands of security jobs remain unfilled, a problem that doesn’t seem to have an immediate solution. Thus, the authors have undertaken this ambitious book as a step toward empowering more people (everyone!) to become informed and more active in mitigating cyber risk.

Case by case, Daswani and Elbayadi lay out effective prevention and detection countermeasures. They explore the meta-level causes of breaches and suggest seven crucial habits for optimal security in the organization. One of their main points is that security needs to evolve beyond its current scope. The sophistication of today’s threats demand it. Companies can no longer rely on the traditional “InfoSec” policies. The security perimeter that once supported these ideas no longer exists.

Instead, it’s up to everyone to get more involved. That’s the only way to avoid more Marriotts, Yahoos and Equifaxes going forward.

Book details:

Publisher : Apress; 1st ed. edition (March 12, 2021)

Language : English

Paperback : 475 pages

ISBN-10 : 1484266544

ISBN-13 : 978-1484266540

Mathieu Gorge, a noted cybersecurity expert and founder of VigiTrust, has published a new book, The Cyber Elephant in the Boardroom, with ForbesBooks. Gorge brings a significant amount of experience and insight to the serious challenge of getting corporate boards of directors and C-level executives to make the right choices on cybersecurity risk management. Indeed, cyber threats and regulatory compliance challenges have become increasingly difficult to deal with, even as the penalties for making mistakes have risen astronomically.

Gorge has worked with many senior leadership teams and CXOs who have struggled to understand and respond to the new threat environment. In his experience, board members are willing and interested in doing the right thing. The problem is a lack of awareness of how things actually work, coupled with poor solution choices. As he points out in the book, many remedies for cyber risk and compliance take board directors down technological rabbit holes that leave everyone scratching their heads.

He offers an approach that enables decision makers to fully understand the components and philosophies that comprise a cybersecurity program. This is Gorge’s 5 Pillars of Security Framework™, a proven and industry-agnostic methodology that enables businesses of all sizes to map cybersecurity risks and implement a cybersecurity strategy. The Framework demonstrates cyber accountability to regulators, government bodies and law enforcement agencies.

As Gorge put it, “The Cyber Elephant in the Boardroom addresses the growing divide between what must be done and what boards are willing to do – and provides the real-world advice necessary to meet this challenge.”

To keep things simple and relatable, the 5 Pillars cover:

• Physical security
• People security
• Data security
• Infrastructure security
• Crisis management

With this understandable foundation, boards can then dive into the detail that it will take to mitigate risks. The brilliance of this approach is its technically agnostic nature. It strips away vendor and industry jargon and paradigms. It’s not selling anything.

Other chapters cover a range of topics, including PCI DSS compliance, HR cybersecurity risk, and the intersection of cybersecurity and business digitization. Guest authors include: James Grundvig, author and tech journalist; Nina Shulepina, Banking Compliance Professional and Member Of The VigiTrust Global Advisory Board; Cathy C. Smith, founder, Women in Tech NJ & NY; Marco Antonio Soriano, CIO, The Soriano Group & Family Office; Robert K. Gardner, president, New World Technology Partners; Nick Vigier, CXO advisor – cyberstrategy, Coalfire; Ed Adams, president and CEO, Security Innovation; Marie-Christine Vittet, VP of compliance, Accor; Cecile Martin and Thibaud Lauxerois, managing partner and attorney (respectively) of the Ogletree Deakins Paris office; and Alexander Abramov, Board Member and Past President of ISACA New York Metropolitan Chapter.

The Reasonable Robot: Artificial Intelligence and the Law, a new book by Ryan Abbott, MD, JD, MTOM, PhD, takes on a topic that is surely coming to a courtroom and legislative session near you. Though it’s written for lawyers and policy makers, the book is accessible to the general reader. It uses relatable examples from real life to explore how Artificial Intelligence (AI) is changing society, business and government to the point where the law will have to adapt to accommodate it.

Abbott approaches the issue from a variety of perspectives, including liability and torts, criminal law, intellectual property and taxation. In each area, he argues that AI is not on a “level playing field” with human beings in the eyes of the law. This begs the question, though, “Should AI be on the same level as human beings?” Should “an AI,” as he calls the hypothetical, human-like machine-based intelligence, be held to a different legal standard than actual humans?

It’s a good question, and even if you think you know the answer, it’s an issue that is definitely going to be getting a lot of attention in coming years. For example, if an AI, such as one that powers a self-driving car, causes an accident, should the courts treat it (the AI, not the car) as if it were a human driver? That way, the AI’s “conduct” would be viewed from the perspective of the “reasonable man” standard, versus being treated merely as a defective product. The latter standard would result in much higher and less flexible financial judgments against the AI and its maker.

Abbott also examines how AI inadvertently creates tax incentives for automation, which drives job loss. He highlights AI’s role as a criminal actor and its potential to create new inventions and artistic works. As a patent attorney, Abbott is actually in the process of trying to get a patent registered to an AI, rather than a human inventor in the UK.

It’s a readable book, though it will likely only be relevant to people with a strong interest in the topic. However, Abbott, who is a Professor of Law and Health Sciences at the University of Surrey School of Law and Adjunct Assistant Professor of Medicine at the David Geffen School of Medicine at UCLA, has done the legal and policy fields a significant service with this book. He methodically lays out the contours of the complex legal and philosophical arguments that will go into addressing the underlying issues.

It can be a slightly frustrating subject, however. For one thing, the AI entity he envisions is not quite here yet. Most uses of AI, impressive as they may be, relate to deployments of extremely deep but narrow cognitive technologies, e.g. analysis of MRI scans to detect tumors. Such a computer program (and that’s really all AI is) can be an outstanding diagnostician, but it doesn’t know the difference between a loaf of bread and the Mona Lisa.

Also, certain issues are moot, even if they’re interesting to discuss. AI is used to commit crimes, for instance. That is already a big problem and will only grow more serious over time. However, the perpetrators will never be held to account. They hide behind anonymous machines and foreign countries that lack extradition. The resulting legal arguments about AI’s criminal conduct are academic.

As Abbott reveals, though, a discussion of AI’s legal rights quickly takes the reader into some grand themes, like what is the nature of the law itself? What is intelligence? If an artificial “person” in the form of a corporation has legal rights and responsibility, then why can’t an AI have such rights and responsibilities?

Your opinion of the book will probably depend on whether you view AI as a product that’s owned by a company or an independent life form. If AI is a product, then its owners are responsible for whatever it does—even if they can’t control it. In that sense, AI is no different from the wild ox discussed in Talmudic law 2,000 years ago. Who is responsible if it goes on a rampage? These are not new issues. AI revivifies them.