Latest / CYBR.Signal / First Book(s) Review

Transcript

First Book(s) Review · CYBR.Signal

• 0:00
  SPEAKER_00: Hey everybody, Michael Farnum here.
• 0:02
  SPEAKER_00: Happy Cyber Sunday.
• 0:03
  SPEAKER_00: Hope you're doing well.
• 0:05
  SPEAKER_00: This Cyber Sunday, I want to do something a little different.
• 0:08
  SPEAKER_00: I want to talk about a couple of books that I am uh reading.
• 0:11
  SPEAKER_00: One that I've read most of, and one that I am uh getting into.
• 0:16
  SPEAKER_00: Kind of two different areas of cybersecurity, if you will.
• 0:20
  SPEAKER_00: Um, the first one is the Security Risk Assessment Handbook by Doug Landah, if you can see that there.
• 0:28
  SPEAKER_00: Uh it's third edition.
• 0:29
  SPEAKER_00: Doug's a good friend of mine, known him for years, worked with him back in a different company back in the day where he ran the GRC practice.
• 0:37
  SPEAKER_00: And if you haven't read any of his uh handbooks, so he's got some other uh a bunch of other stuff out there as well, um, published some really cool material.
• 0:46
  SPEAKER_00: But anything you want to know about GRC, um, it its book is fantastic for that purpose.
• 0:54
  SPEAKER_00: It is really, really well done, well organized.
• 0:58
  SPEAKER_00: If you are um if you're working in the governance risk compliance, if you're doing audits, if you're doing any of that stuff in the GRC area of cybersecurity, and I personally think even if you're not specifically doing GRC, the GRC area I've heard, and some people have talked about, and I believe uh this is true, is a real good area to get into cyber if you're not really heavy tech yet.
• 1:24
  SPEAKER_00: Maybe you want to get into cyber, maybe you don't ever want to be technical, but you want to know about cybersecurity in general.
• 1:31
  SPEAKER_00: Maybe you are a pen tester, maybe you're doing whatever technical, but you need I really think you need to know more about GRC.
• 1:38
  SPEAKER_00: Most people do.
• 1:39
  SPEAKER_00: I think it's a really good um area to study up to get fundamentals of cybersecurity, and that handbook um is fantastic at it.
• 1:48
  SPEAKER_00: Doug does a great job.
• 1:50
  SPEAKER_00: Uh, if if you don't know Doug and you're in GRC, um, or if you want to be in GRC, then you you need to get to know Doug and need to know his handbook.
• 1:59
  SPEAKER_00: Extremely good book.
• 2:00
  SPEAKER_00: And the second one, like I said, it's kind of a totally different world.
• 2:04
  SPEAKER_00: Um, different, it's very, very technical.
• 2:07
  SPEAKER_00: Uh, Cory Ball, uh hacking APIs from No Starch Press.
• 2:12
  SPEAKER_00: Um, first of all, the the cover is fantastic.
• 2:16
  SPEAKER_00: Um, but that's the way No Starch Press goes.
• 2:19
  SPEAKER_00: But uh there the the book itself, I'm just starting to get into.
• 2:23
  SPEAKER_00: If you've watched any of my stuff, uh read any of my stuff, you know I'm a big fan of uh application security.
• 2:29
  SPEAKER_00: It's kind of a uh close to my near and dear to my heart, I always say.
• 2:33
  SPEAKER_00: Um, and specifically APIs, you've if you've watched any of the webinars and stuff that I've done here in the last year, you know that I'm big on uh putting some focus on API security.
• 2:42
  SPEAKER_00: So I'm really looking forward to getting into this.
• 2:45
  SPEAKER_00: Uh my day job doesn't always let me get into the tech as much as I used to, um, but uh I'm really looking forward to getting into this and playing around as from what I understand, it it starts from the beginning, um, really gets you into some fundamentals of web security or application security, web application security in general, and then uh talks you through how to um bust up some APIs, get to know them.
• 3:12
  SPEAKER_00: And as we all know, it's uh fundamental to knowing how to break something in order to how to defend it.
• 3:18
  SPEAKER_00: So uh I I recommend both of these again.
• 3:20
  SPEAKER_00: I've I'm just now getting into this one, um, but from what I can see, and I've uh talked to Corey before, um he seems like uh he's got some really good stuff he's putting together.
• 3:30
  SPEAKER_00: Really excited to dig into it.
• 3:32
  SPEAKER_00: I got a few more books that I'm gonna be picking up here um in the next hopefully they're coming next week.
• 3:39
  SPEAKER_00: Um, they're more on the management side of things, so I'll be doing some um kind of leadership management.
• 3:46
  SPEAKER_00: So I'll be doing some reviews uh of those as well, but I will do uh another review of the hacking a deeper level hacking API review.
• 3:57
  SPEAKER_00: But um this one I will include another link to my review for Doug's book, but this one uh is I can't recommend highly enough for GRC again, very well organized, um, very easy to read through, diagrams are fantastic.
• 4:13
  SPEAKER_00: Um, you really should appreciate how Doug puts it together.
• 4:16
  SPEAKER_00: So that's it for Cyber Sunday.
• 4:18
  SPEAKER_00: Again, a little bit different, but I wanted to give some uh play on these two books and really get people to um to take a look at them.
• 4:25
  SPEAKER_00: I will include links and everything down in the notes.
• 4:29
  SPEAKER_00: And if you've got any questions about this or want to take a look at these books um or got any comments about these books, let me know.
• 4:37
  SPEAKER_00: Talk to you next time.