Cybersecurity First Principles

A Reboot of Strategy and Tactics

By: Rick Howard

Narrated by: Rick Howard

The first expert discussion of the foundations of cybersecurity

In Cybersecurity First Principles, Rick Howard, the Chief Security Officer, Chief Analyst, and Senior fellow at The Cyberwire, challenges the conventional wisdom of current cybersecurity best practices, strategy, and tactics and makes the case that the profession needs to get back to first principles. The author convincingly lays out the arguments for the absolute cybersecurity first principle and then discusses the strategies and tactics required to achieve it.

In the book, you'll explore:

• Infosec history from the 1960s until the early 2020s and why it has largely failed
• What the infosec community should be trying to achieve instead
• The arguments for the absolute and atomic cybersecurity first principle
• The strategies and tactics to adopt that will have the greatest impact in pursuing the ultimate first principle
• Case studies through a first principle lens of the 2015 OPM hack, the 2016 DNC Hack, the 2019 Colonial Pipeline hack, and the Netflix Chaos Monkey resilience program
• A top to bottom explanation of how to calculate cyber risk for two different kinds of companies

This book is perfect for cybersecurity professionals at all levels: business executives and senior security professionals, mid-level practitioner veterans, newbies coming out of school as well as career-changers seeking better career opportunities, teachers, and students.

©2023 Rick Howard (P)2023 G&D Media

Goodbye to the CIA Triad

Mr. Howard finally defines the Cybersecurity First Principle. This is what will be used going forward as the baseline for all Cybersecurity programs!

Just What I was looking for

I’m a 20 plus year networking IT and was looking for a kickstarter on Cybersecurity. This was a great start in catching up on methodologies and pragmatic approaches in putting them into action. The Cybersecurity Principles are obviously well thought out, explained, and practical application examples provided for each. I’m also an Army vet and really enjoy the author’s stories about his days in service. I would love to sit down with the author and hear more… about Cybersecurity of course!

Practical and Tactical

Really good advice that avoids the buzzword approach coming from vendors. The elegance of a first principles will make this more enduring.

Good information but…

The author is very knowledgeable and breaks everything down. However this is just my opinion (which doesn’t matter in the large scheme of things) but the narrators voice was very bland. I found it difficult staying awake listening to the book on my commute.

The first principle and the discussion of security and development and DevOps.

The thankfully brief discussion of Musk was mercifully short, but left me skeptical of the content. I am not a fan of DOGE, fascism, or dictatorship that seemingly infects the upper echelons. The author predates me in security by almost ten years. I was my unit's first ADPSSO. After 28 years in software, I couldn't agree more that integrating development, security, and DevOps is essential. We're also a very, very far away from this integration. Developers look at security as an unnecessary brake on feature velocity. security remains unaware--even as I drag them along--of the many data streams available to them to better understand vulnerabilities and do more than blindly sign off on products riddled with static critical and high CVE vulnerabilities, bad security design, and bad or nonexistent unit and integration to validate both the feature and it's security.

engaging cyber security overview and great road map

enthusiasm and expertise of author made it easy to listen to with lots of real world stories

Tools instead of just cyberhorror stories

I like that there are methods presented that will allow me to manage cyber security instead of curling up in a corner thinking it's only a matter of time before everything implodes. I'm the "Kevin" in this book and cyber security literally keeps me awake at nights. I now have an idea about some actual strategies I can use to reduce risk.

Best cybersecurity book I've read thus far!

from start to finish this book is packed with useful information. not only useful but also very interesting and put together logically. first principles helped refine the lens I view cybersecurity through.

For the love of all that is holy, please get an audio editor

Book would be fine, but was released without any form of audio editing. So you get to hear the narrator repeat himself numerous times, clear his throat, stumble over words.
This is easily fixed, that it highly annoys me that it's not been fixed yet