I’m pleased to share that the Cybersecurity Policy Guidebook, Second Edition, is now available from Wiley (ISBN 978-1-394-40740-8).

I am grateful for the opportunity to collaborate again with a distinguished team of cybersecurity experts to produce this important reference.

The cybersecurity policy landscape for enterprise and operational leadership has fundamentally changed. This guidebook is not a summary of the latest technology news cycle. Rather, it is a structured reference examining the evolution of cybersecurity policy, the decisions facing organizations and governments, and the responsibilities of three important groups:

• The Decision Maker
• The Technology Leader
• The Control System Engineer

What is the book about?

Rather than simply asking how to secure a system, the guidebook examines what governments, organizations, and individuals can do about cyber risks that cross systems, industries, and national boundaries. It also explores the trade-offs associated with different policy alternatives.

Who should read it?

The book is intended for executives and board members responsible for cyber risk decisions, technology and risk professionals navigating the policy landscape, and faculty and students in cybersecurity policy programs. It also provides valuable information for control-system engineers responsible for the cybersecurity of critical infrastructure.

An instructor companion site is available to support classroom use.

What's new in the second edition?

The first edition was published in 2012. This edition builds on the historical foundation of cyber threats, governance, and risk management while addressing today's evolving policy challenges, including:

• Updated cybersecurity policy objectives
• Artificial intelligence and its implications for cybersecurity policy
• The custodial responsibilities of technology platforms
• Cyber threats to critical infrastructure, including industrial control systems
• Impacts on the cybersecurity workforce

Get your subscription to Control's tri-weekly newsletter.

Why my contribution is particularly important

I was grateful for the opportunity to contribute the examples in Table 4.3. My objective was to use this book as a platform to address a longstanding and increasingly consequential divide between traditional network security and control system engineering.

Cybersecurity of critical infrastructure cannot be addressed solely through an IT or network security perspective. Protecting the networks that communicate with industrial systems is important, but it is equally important to understand and protect the physical processes those systems monitor and control.

This distinction is fundamental. The consequences of cybersecurity incidents in electric power, water, manufacturing, oil and gas, transportation, food, and other critical infrastructure sectors are ultimately measured in terms of their impact on physical processes, equipment, safety, and reliability.

Bridging the divide between network security and engineering is essential as threats to critical infrastructure continue to grow.

Acknowledgments

Special thanks to Jennifer Bayuk for inviting me to participate in the second edition and for her leadership in developing the book.

It was an honor to work alongside such a distinguished group of authors:

• Art Ehuan, Duke University
• Jason Healey, Columbia University
• Paul Rohmeyer, Stevens Institute of Technology
• Marcus H. Sachs, P.E., Center for Internet Security
• Donald Saxinger, Independent Advisor on Technology, Cyber & Third-Party Risk in Banking; former FDIC Chief of IT Supervision

My thanks also to Dan Geer for contributing the foreword.

I hope this second edition will help advance the discussion of cybersecurity policy and, importantly, bring network security and control system engineering closer together.