‘Don’t expect to be motivated every day to get out there and make things happen. You won’t be. Don’t count on motivation. Count on Discipline.’ Jocko Willink, retired U.S. Navy SEAL officer ‘This is a tremendous resource for every security professional and orga- nization whose goal is to improve their cybersecurity posture. The evi- dence-based cybersecurity approach ties the criticality of understanding human behavior with the technical aspects of cyber-crime. A true data centric treasure trove of valuable knowledge.’ – Kausar Kenning, Executive Director, Cyber Security, Morgan Stanley ‘Despite its technical nature, the evidence base supporting cybersecurity as a field of practice remains flimsy, at best. Some have even compared cybersecurity to “medieval witchcraft’”. This timely and essential book provides a much needed and comprehensive overview of the available evidence and of the knowledge gaps that persist, also charting the path ahead for a more scientific approach to the design, implementation, and evaluation of cybersecurity measures.’ – Dr. Benoît Dupont, Professor of Criminology, University of Montreal, Canada, and Canada Research Chair in Cybersecurity ‘Dr. Pomerleau does a masterful job of deep diving into the realm of con- temporary Cybersecurity. Beyond recounting the historical evolution of Cybersecurity, Pomerleau astutely weaves together a traditional IT risk management system approach with a multi-faceted humanistic approach (with ethical, sociological, psychological, and criminal elements) to present a comprehensive how-to guide for evidence-based Cybersecurity analysis.’ – Dr. David L. Lowery, Full Professor of Homeland Security & Public Administration, Northcentral University Evidence-Based Cybersecurity Security, Audit and Leadership Series Series Editor: Dan Swanson, Dan Swanson and Associates, Ltd., Winnipeg, Manitoba, Canada. The Security, Audit and Leadership Series publishes leading-edge books on critical subjects facing security and audit executives as well as business leaders. Key topics addressed include Leadership, Cybersecurity, Security Leadership, Privacy, Strategic Risk Management, Auditing IT, Audit Management and Leadership Rising from the Mailroom to the Boardroom: Unique Insights for Governance, Risk, Compliance and Audit Leaders Bruce Turner Operational Auditing: Principles and Techniques for a Changing World (Second Edition) Hernan Murdock CyRMSM: Mastering the Management of Cybersecurity David X Martin The Complete Guide for CISA Examination Preparation Richard E. Cascarino Blockchain for Cybersecurity and Privacy: Architectures, Challenges, and Applications Yassine Maleh, Mohammad Shojafar, Mamoun Alazab, Imed Romdhani The Cybersecurity Body of Knowledge: The ACM/IEEE/AIS/IFIP Recommendations for a Complete Curriculum in Cybersecurity Daniel Shoemaker, Anne Kohnke, Ken Sigler For more information about this series, please visit: https://www.routledge. com/Internal-Audit-and-IT-Audit/book-series/CRCINTAUDITA Evidence-Based Cybersecurity Foundations, Research, and Practice Pierre-Luc Pomerleau David Maimon First edition published 2022 by CRC Press 6000 Broken Sound Parkway NW, Suite 300, Boca Raton, FL 33487-2742 and by CRC Press 4 Park Square, Milton Park, Abingdon, Oxon, OX14 4RN CRC Press is an imprint of Taylor & Francis Group, LLC © 2022 Pierre-Luc Pomerleau and David Maimon Reasonable efforts have been made to publish reliable data and information, but the author and publisher cannot assume responsibility for the validity of all materials or the consequences of their use. The authors and publishers have attempted to trace the copyright holders of all material reproduced in this publication and apologize to copyright holders if permission to publish in this form has not been obtained. If any copyright material has not been acknowledged please write and let us know so we may rectify in any future reprint. Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented, including photocopying, microfilming, and recording, or in any information storage or retrieval system, without written permission from the publishers. For permission to photocopy or use material electronically from this work, access www.copyright.com or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. For works that are not available on CCC please contact mpkbookspermissions@tandf. co.uk Trademark notice: Product or corporate names may be trademarks or registered trademarks and are used only for identification and explanation without intent to infringe. Library of Congress Cataloging‑in‑Publication Data Names: Pomerleau, Pierre-Luc, author. | Maimon, David, 1978- author. Title: Evidence-based cybersecurity : foundations, research, and practice / Pierre-Luc Pomerleau, David Maimon. Description: First edition. | Boca Raton, FL : CRC Press, 2022. | Series: Internal audit and IT audit | Includes bibliographical references and index. | Identifiers: LCCN 2021060090 (print) | LCCN 2021060091 (ebook) | ISBN 9781032062761 (hbk) | ISBN 9781032062785 (pbk) | ISBN 9781003201519 (ebk) Subjects: LCSH: Computer security. | Comptuter networks-- Security measures. | Computer crimes--Prevention. Classification: LCC QA76.9.A25 P5968 2022 (print) | LCC QA76.9.A25 (ebook) | DDC 005.8--dc23/eng/20220201 LC record available at https://lccn.loc.gov/2021060090 LC ebook record available at https://lccn.loc.gov/2021060091 ISBN: 9781032062761 (hbk) ISBN: 9781032062785 (pbk) ISBN: 9781003201519 (ebk) DOI: 10.1201/9781003201519 Typeset in Sabon by KnowledgeWorks Global Ltd. To all cybersecurity professionals and researchers working tirelessly to make the world a safer place. Contents Foreword xv About the authors xvii Acknowledgment xix 1 The case for an evidence-based approach to cybersecurity 1 The evidence-based approach 3 Evidence-based medicine 4 Evidence-based policing 5 Evidence-based learning 6 The case for evidence-based cybersecurity 7 References 8 2 Computers, computer networks, the Internet, and cybersecurity 11 Introduction: computers and computer networks 11 The Open System Interconnection (OSI) model and the communication process 13 The importance of cybersecurity 14 The cybersecurity ecosystem 16 Cybersecurity doctrines, practices, and policies 18 Current practices, tools, and policies to secure cyber infrastructures 23 References 25 3 Human behavior in cyberspace 29 Introduction: cybercrime and cyberspace 29 Four key actors within the cybercrime ecosystem 31 The offenders 31 The enablers 32 The victims 33 The guardians 33 ix