Speaker 1: Imagine a multinational corporation drops like ten million dollars on
Speaker 1: military grade encryption.
Speaker 2: Oh easily. People spend that without blinking, right.
Speaker 1: So they buy the next generation zero trust architecture, the
Speaker 1: most sophisticated firewalls money can buy. They feel completely.
Speaker 2: Invincible, invincible until reality actually hits.
Speaker 1: Them exactly because then their entire network just goes dark.
Speaker 1: And it's not some superhacker. It's because an accountant on
Speaker 1: the third floor tripped over a power cable in the
Speaker 1: server room while looking for a stapler.
Speaker 2: It's funny, but it completely shatters the illusion of what
Speaker 2: we think of as security.
Speaker 1: It really does.
Speaker 2: We get so hyper focused on the shadowy adversaries writing
Speaker 2: malicious code that we just forget the physical, mundane realities
Speaker 2: where these systems actually live.
Speaker 1: Welcome to today's Deep Dive. I'm your host and today's Saturday,
Speaker 1: April eighteenth, twenty twenty six. Glad to be here for you,
Speaker 1: our listener. You're navigating a world where the boundary between
Speaker 1: the digital and the physical isn't just blurry, I mean
Speaker 1: it is entirely non existent.
Speaker 2: Yeah, the line is just completely gone.
Speaker 1: Today, and that's why today we are looking at why
Speaker 1: true cybersecurity is less about hooded hackers and much more
Speaker 1: about human nature, law and wealth foundational architecture, which is.
Speaker 2: Such a crucial shift in perspective.
Speaker 1: We're diving into a really monumental document published back in
Speaker 1: October twenty nineteen. It's called the Cybersecurity Body of Knowledge
Speaker 1: Version one point zero or Cybook for Sure cybock.
Speaker 2: Yeah, funded by the UK National Cybersecurity.
Speaker 1: Program exactly, and this was the moment top minds tried
Speaker 1: to wrangle a completely chaotic Wild West industry into a mature,
Speaker 1: codified discipline.
Speaker 2: Because that transition from a chaotic trade into a mature discipline,
Speaker 2: it requires a bedrock of agreed upon.
Speaker 1: Knowledge, like how doctors all agree on basic anatomy right?
Speaker 2: Or civil engineering, We don't just guess how to build
Speaker 2: a bridge, right, We have established physics and material sciences.
Speaker 1: Swebook did that for software engineering too, exactly.
Speaker 2: Software Engineer had similar awakening with SWEVIK their codified standard.
Speaker 1: Yeah.
Speaker 2: But for the longest time, cybersecurity education was just incredibly fragmented.
Speaker 1: It was all over the place.
Speaker 2: You had university degrees teaching one thing, vendor specific certifications
Speaker 2: teaching another, and literally no global consensus on what a
Speaker 2: professional actually needed to know.
Speaker 1: So my first thought when I was reading this was,
Speaker 1: how on earth do you decide what goes into a
Speaker 1: foundational blueprint without it just devolving into a massive shouting
Speaker 1: match between international.
Speaker 2: Experts or the ego in the room.
Speaker 1: Right, Yeah, I imagine everyone has their own pet theory
Speaker 1: on what is quote unquote essential.
Speaker 2: Well, you take the human bias out of the initial sweep.
Speaker 1: Wait, really, how the editors.
Speaker 2: Didn't just lock themselves in a room and start writing.
Speaker 2: Starting in twenty seventeen, they used natural language processing in
Speaker 2: automatic text clustering.
Speaker 1: So they brought in algorithms from the start.
Speaker 2: Exactly. They essentially fed existing gold standards into a text
Speaker 2: mining engine. We're talking about the CISSP.
Speaker 1: Which is practically the bar exam for security professionals.
Speaker 2: Right along with the ACM's Global Curriculum guidelines for universities
Speaker 2: and international standards like ISO two seven zero three to two.
Speaker 1: Okay, so they algorithmically clustered the entire global curriculum to
Speaker 1: see what topics organically grouped together.
Speaker 2: That is wild it is, And only after the algorithms
Speaker 2: map the landscape did they bring in the humans.
Speaker 1: Ah, there's the human element.
Speaker 2: Right, they held eleven community workshops and conducted deep dive
Speaker 2: interviews with experts across the globe, just.
Speaker 1: To refine those algorithmic clusters.
Speaker 2: Yeah, into what they called straw man proposals, and then
Speaker 2: those were fiercely debated and publicly reviewed.
Speaker 1: Okay, let's unpack this because while that methodology is brilliant,
Speaker 1: it raises a massive red flag for me.
Speaker 2: Oo, what's up?
Speaker 1: It sounds like trying to write a dictionary for a
Speaker 1: language that people are literally making up as they speak.
Speaker 2: That's a great analogy.
Speaker 1: I mean, if a new zero day exploit is discovered
Speaker 1: this morning and an entirely new class of IoT devices
Speaker 1: is released this afternoon, how does a printed codified book
Speaker 1: not become entirely obsolete the second it hits the server?
Speaker 2: By drawing a very harsh, strict line between transient technological
Speaker 2: trends and enduring principles.
Speaker 1: So they just ignore the new shiny stuff.
Speaker 2: Basically, yeah, Sybok deliberately ignores the latest gadget or this
Speaker 2: specific signature of yesterday's ransomware. Instead, it maps the mechanisms
Speaker 2: that make the technology function at a structural level.
Speaker 1: Give me an example of what that looks like. In practice,
Speaker 1: how do you separate the trend from the principle.
Speaker 2: Well, take operating system security. The specific code used to
Speaker 2: exploit a buffer overflow in Windows eleven. It might look
Speaker 2: completely different than an exploit in Linux, and both will
Speaker 2: be patched eventually. CYBAC doesn't care about the patch.
Speaker 1: What does it care about.
Speaker 2: Sybock cares about the mechanism of memory isolation. How does
Speaker 2: a system mathematically and architecturally assign a specific block of
Speaker 2: RAM to your web browser and.
Speaker 1: Then physically prevent a background application from reading that same
Speaker 1: block of RAM?
Speaker 2: Exactly the concept of virtual memory, paging and privilege rings.
Speaker 2: That is the foundational physics of computing.
Speaker 1: And those mechanisms don't change just because of new smartphone drugs.
Speaker 2: Right. What's fascinating here is that it's focusing on the
Speaker 2: physics of the digital world rather than the weather of
Speaker 2: the day.
Speaker 1: The physics instead of the weather.
Speaker 2: I like that.
Speaker 1: That completely shifts the perspective. It really does, and that
Speaker 1: shift really becomes obvious when you look at how CYBOC
Speaker 1: actually defines cybersecurity. They pull their definition from the UK
Speaker 1: National Cybersecurity Strategy and it completely moves away from what
Speaker 1: we traditionally call information security.
Speaker 2: Yeah, because information security is historically bound by the CIA triad.
Speaker 1: Right, preserving the confidentiality, integrity, and availability of data Exactly.
Speaker 2: It's a very data centric view. But cyberspace is no
Speaker 2: longer just a digital filing cabinet.
Speaker 1: No, not at all. It's a sociotechnical reality. It's a
Speaker 1: place where we conduct diplomacy, manage power, grip, and perform
Speaker 1: remote surgeries.
Speaker 2: Which means the scope of protection must expand radically. Cybock
Speaker 2: defines cybersecurity as protecting information systems, so the hardware, the software,
Speaker 2: the infrastructure, as well as the services they provide.
Speaker 1: The services, that's the keyword there.
Speaker 2: Yes, if a ransomware attack hits a hospital network, the
Speaker 2: primary crisis isn't that the patient records lack availability.
Speaker 1: Right, It's that people are in danger exactly.
Speaker 2: The priceis is that the eneri machines won't turn on
Speaker 2: and the blood bank inventory is frozen. The service itself,
Speaker 2: the real world impact is under threat.
Speaker 1: So what does this all mean for the actual definition.
Speaker 1: What's fascinating to me is how that definition explicitly includes
Speaker 1: the word accidental.
Speaker 2: Yes, that's a huge shift.
Speaker 1: It states we are protecting these services from unauthorized access,
Speaker 1: harm or misuse, whether caused intentionally by an operator or
Speaker 1: accidentally by failing to follow procedures.
Speaker 2: Which brings us right back to the account tripping over
Speaker 2: the server cable exactly.
Speaker 1: We always picture a cyber threat as a shadowy hacker
Speaker 1: and a hoodie, but according to this definition, sometimes the
Speaker 1: biggest threat to an organization is just someone accidentally hitting
Speaker 1: reply all or tripping over a cable.
Speaker 2: Or you know, a tired systems administrator who accidentally leaves
Speaker 2: a cloud storage bucket configure to public instead of private.
Speaker 1: Oh Man exposing fifty million records.
Speaker 2: Okay, the damage to the organization is mathematically identical whether
Speaker 2: it was a nation state hacker or just a sleepy employee.
Speaker 1: And because human error and real world consequences are baked
Speaker 1: into the very definition of the field, it creates this
Speaker 1: massive structural pivot in the blueprint itself.
Speaker 2: It really does dictate the whole flow of the document.
Speaker 1: Yeah, because when I first opened sidebox, I expected chapter
Speaker 1: one to be about like deep cryptography or firewall configuration.
Speaker 2: Most people do.
Speaker 1: But the very first grouping of knowledge areas is entirely
Speaker 1: devoid of code. It's the human Organizational and Regulatory Aspects category, because.
Speaker 2: Before you can defend a system, you have to understand
Speaker 2: the environment in which it operates.
Speaker 1: And that environment is governed by laws and inhabited by
Speaker 1: humans exactly.
Speaker 2: The Law and Regulation Knowledge area tackles this head on,
Speaker 2: specifically the nightmare of applying geography based laws to a
Speaker 2: borderless digital vacuum.
Speaker 1: The jurisdictional conflicts there blew my mind.
Speaker 2: It gets really complicated, it does.
Speaker 1: Sybock highlights the friction between territorial jurisdiction, which is the
Speaker 1: right of a country to govern what happens physically inside
Speaker 1: its borders, and prescriptive jurisdiction, the right of a country
Speaker 1: to apply its laws to its citizens no matter where
Speaker 1: they are.
Speaker 2: This raises an important question, though. Consider a scenario where
Speaker 2: a server farm is physically located in Russia. Okay, so
Speaker 2: Russian territory, but it's storing the personal data of a
Speaker 2: German citizen.
Speaker 1: Ah, so European GDPR protections.
Speaker 2: Apply, yes, And then that data is suddenly accessed and
Speaker 2: manipulated by a hacker sitting in an Internet cafe in
Speaker 2: the United States.
Speaker 1: That is a mess. Who investigates who's privacy laws were violated.
Speaker 2: Right, If the US wants to seize that server, they
Speaker 2: are violating Russian territorial sovereignty, even though the data belongs
Speaker 2: to a European under GDPR.
Speaker 1: It's just a legal Rubik's cube, and security architects have
Speaker 1: to build systems that somehow comply with all of those
Speaker 1: overlapping mandates simultaneously.
Speaker 2: It is incredibly daunting.
Speaker 1: But as complex as the international law is, the knowledge
Speaker 1: area that I think our listeners will relate to the
Speaker 1: most is human factors.
Speaker 2: Oh, absolutely, human factors is essentially the science of usable security.
Speaker 1: Usable security, I love that term.
Speaker 2: For decades, the industry operated under a massive misconception that
Speaker 2: security systems should be designed by engineers for engineers.
Speaker 1: And that regular users just needed to be trained to
Speaker 1: comply with whatever rigid policies were thrown at them.
Speaker 2: Exactly, just comply and don't complain.
Speaker 1: Right. If you are listening to this on a company
Speaker 1: laptop right now, think about how often you delay forced
Speaker 1: software updates because you're right in the middle of a
Speaker 1: massive or how.
Speaker 2: Many times you've had to invent a twenty character password
Speaker 2: with a mix of hieroglyphics.
Speaker 1: Only to be forced to change it thirty days later.
Speaker 2: It's exhausting, It really is.
Speaker 1: Yeah, but let me play Devil's advocate here.
Speaker 2: Sure, go for it.
Speaker 1: If human error is such a massive liability, why don't
Speaker 1: system architects just try to automate everything and take the
Speaker 1: human completely out of the loop. Whoa why bother making
Speaker 1: security usable if you can just make it mandatory, lock
Speaker 1: the system down, automate the compliance at the hardware level.
Speaker 2: If we connect this to the bigger picture, taking the
Speaker 2: human out of the loop is an arrogant.
Speaker 1: Illusion, really an illusion.
Speaker 2: Yes, because security is almost never a person's primary task.
Speaker 2: People are hired to process invoices, to treat patients, to
Speaker 2: code applications, right.
Speaker 1: They just want to get their work done exactly.
Speaker 2: So, if a security control is so draconian that it
Speaker 2: creates immense friction preventing people from doing the very jobs
Speaker 2: they were hired to do, the humans will not just complain.
Speaker 1: I'll find a way around it.
Speaker 2: They will actively engine your ways to bypass your security.
Speaker 1: Wow. They basically become the adversary inside your.
Speaker 2: Own network unintentionally. Yes, this is the root cause of shadow.
Speaker 1: I t ah shadow I T Yeah.
Speaker 2: If the corporate VPN is too slow, to transfer massive
Speaker 2: video files. An employee will just upload those proprietary files
Speaker 2: to their personal dropbox to get the project.
Speaker 1: Done on time, because they have a deadline.
Speaker 2: Right if the password requirements exceed human cognitive limits, they
Speaker 2: will write the password on a sticky note and stick
Speaker 2: it right to their monitor.
Speaker 1: We've all seen the sticky notes exactly.
Speaker 2: Unusable security actively breeds insecurity. The human Factors area codifies
Speaker 2: this psychological reality.
Speaker 1: So if you don't fit the security task to the
Speaker 1: human's cognitive load, your technical controls are practically.
Speaker 2: Useless, completely useless.
Speaker 1: But you know, humans aren't perfect, no matter how well
Speaker 1: you design the interface.
Speaker 2: No, they're not.
Speaker 1: Eventually someone will be tired, they will get tricked, and
Speaker 1: they will click the wrong link in a phishing email.
Speaker 2: And that's when things get real.
Speaker 1: Right when that human perimeter fails, the threat slams right
Speaker 1: into the technical architecture. And that is exactly where the
Speaker 1: cybox transitions us from human behaviors into the technical front lines,
Speaker 1: the attacks and defenses category.
Speaker 2: This is where we move from the boardroom and the
Speaker 2: legal department into the trenches.
Speaker 1: The messy part.
Speaker 2: Yeah, when malicious code enters the environment, you have to
Speaker 2: understand exactly what you are looking at. The malware and
Speaker 2: attack technologies. Knowledge area maps out how analysts actually dissect
Speaker 2: these threats.
Speaker 1: And they heavily rely on the mechanisms of static and
Speaker 1: dynamic analysis they do. Here's where it gets really interesting
Speaker 1: for me. Let's break those down because the difference in
Speaker 1: how they work is fascinating.
Speaker 2: Sure, think of static analysis like examining the architectural blueprints
Speaker 2: of a bomb without actually detonating it.
Speaker 1: Okay, so you're not running the code, right.
Speaker 2: You are looking at the dormant code. You're extracting the
Speaker 2: strings of text, looking at the structural hashes, and using
Speaker 2: reverse engineering tools to disassemble the program into readable instructions.
Speaker 1: You're just trying to guess what it might do based
Speaker 1: on how it's built exactly.
Speaker 2: But malware authors are smart. They obcuse gate and encrypt
Speaker 2: their code. So the blueprint just looks like gibberish.
Speaker 1: Which means you can't just rely on static analysis. You
Speaker 1: have to use dynamic analysis. To use your analogy, you
Speaker 1: have to put the bomb in a blastproof room and
Speaker 1: hit the ignition.
Speaker 2: That's dynamic analysis. You place the malware into a highly instrumented,
Speaker 2: isolated sandbox. Environment and you execute it.
Speaker 1: So you aren't just looking at the code anymore.
Speaker 2: No, you're monitoring the behavior. What registry keys, is it
Speaker 2: trying to modify, what external IP addresses? Is it attempting
Speaker 2: to contact? What internal APIs? Is it calling wow?
Speaker 1: And by combining the static structure with the dynamic behavior,
Speaker 1: defenders can build a complete profile of the attack exactly.
Speaker 1: And while the analysts are dissepting the weapon, the incident
Speaker 1: responders and forensic investigators are trying to piece together the.
Speaker 2: Crime, which is a whole different ballgame it is.
Speaker 1: And side Putt gets incredibly rigorous here. It doesn't just
Speaker 1: list a bunch of data extraction tools for forensics. It
Speaker 1: dives into the cognitive task model of an investigation.
Speaker 2: It explores forensics as a sense making loop, which is
Speaker 2: a critical distinction.
Speaker 1: Yeah, it's not just pulling a hard drive image.
Speaker 2: No, it is the cognitive process of an investigator taking
Speaker 2: bottom up data like scattered log files and timestamps and
Speaker 2: combining it with top down hypotheses like maybe saying I
Speaker 2: think the attacker moved latterly through the HVAC system.
Speaker 1: Ah, So you're reconstructing a verifiable timeline of reality based
Speaker 1: on a theory and the data exactly. But all of
Speaker 1: these frontline defenses, I mean the malware analysts the forensic investigators,
Speaker 1: that they are entirely dependent on the underlying architecture of
Speaker 1: the systems. They are defending the bedrock right, and that
Speaker 1: brings us to the deepest technical foundation in the blueprint,
Speaker 1: the system's security category. This encompasses cryptography, operating system and
Speaker 1: distributed systems.
Speaker 2: To really understand how vital this layer is, you have
Speaker 2: to look at the concept of formal methods, which Cybog
Speaker 2: highlights as a cross cutting theme.
Speaker 1: Okay, formal methods.
Speaker 2: In normal software development, how do you know program works?
Speaker 2: You test it, right.
Speaker 1: You throw a bunch of inputs at it and see
Speaker 1: if it crashes.
Speaker 2: It's like testing a bridge by driving heavier and heavier
Speaker 2: trucks over it.
Speaker 1: But testing can only prove the presence of bugs. It
Speaker 1: can never prove the absence of them. You might just
Speaker 1: not have driven a heavy enough truck.
Speaker 2: Yet that is exactly the problem. But formal methods operate
Speaker 2: completely differently. It uses mathematical logic to rigorously specify and
Speaker 2: verify the behavior of software and hardware.
Speaker 1: So instead of driving trucks over the bridge.
Speaker 2: You are using physics and mathematics to definitively prove that
Speaker 2: the bridge cannot collapse under a specified weight.
Speaker 1: Wow, you are proving the structural integrity of the code itself,
Speaker 1: which is incredibly resource intensive. So I imagine you only use
Speaker 1: it for the absolute bedrock, like the cryptographic algorithm or
Speaker 1: the core kernel of the operating system.
Speaker 2: Exactly. You wouldn't use it for a simple web app.
Speaker 1: And here is where the blueprint concept truly solidifies for me,
Speaker 1: because it's structured exactly like modern medicine. What do you mean, Well,
Speaker 1: you have your emergency responders handling incident management and forensics
Speaker 1: on the front lines. Sure, but you also need the
Speaker 1: geneticists and immunologists deep in the lab working on cryptography
Speaker 1: and system security to build the vaccines. When you look
Speaker 1: at these cross cutting themes, you realize these knowledge areas
Speaker 1: cannot exist in silos.
Speaker 2: That is so true, they are deeply interwoven. You could
Speaker 2: have a brilliant cryptographer design and encryption key using mathematically
Speaker 2: verified formal methods.
Speaker 1: Okay, so the math is flawless.
Speaker 2: Flawless, but if the operating system lacks the memory isolation mechanisms,
Speaker 2: we talked about earlier. Oh, then a piece of malware
Speaker 2: can simply reach into the adjacent memory space and steal
Speaker 2: the cryptographic key while the application is using it.
Speaker 1: Man so the math doesn't matter. If the the operating
Speaker 1: system leaves the front door off the hinges.
Speaker 2: Precisely, And if you scale that up to a distributed system,
Speaker 2: say a massive peer to peer cloud infrastructure, oh boy,
Speaker 2: you now have to secure the cryptographic keys, enforce the
Speaker 2: operating system memory isolation, encrypt the network transit protocols, and
Speaker 2: these somehow manage the human factors of the administrators running
Speaker 2: the whole.
Speaker 1: Thing across multiple legal jurisdictions no less exactly.
Speaker 2: A failure in any one of those adjacent disciplines compromises
Speaker 2: the entire system. You are never aiming for perfect defense,
Speaker 2: You're engineering for systemic resilience.
Speaker 1: That fundamentally changes how you view the industry. I mean,
Speaker 1: cybersecurity is not an IT problem relegated to the basement,
Speaker 1: no about it all. It is an incredibly demanding interdisciplinary science.
Speaker 1: And having a codified body of knowledge like CYBUK means
Speaker 1: the industry finally has a shared vocabulary.
Speaker 2: It sets the benchmark. If a university is designing a
Speaker 2: master's program, or global enterprise is building a training matrix
Speaker 2: for their engineering teams. They don't have to guess what matters.
Speaker 2: They have a mathematically, algorithmically and socially verified map of.
Speaker 1: The territory, which completely upgrades your analytical framework. The next
Speaker 1: time you hear about a massive corporate data breach, you
Speaker 1: aren't just going to ask what kind of malware was used?
Speaker 2: Right, You'll dig deeper.
Speaker 1: You were going to ask what was the failure in
Speaker 1: usable security that caused the employee to bypass the controls?
Speaker 1: You will ask what were the latent design conditions in
Speaker 1: the operating system that failed to contain the blast radius.
Speaker 2: It really elevates the conversation from reactive panic to systemic analysis.
Speaker 1: It really does. But you know, we have to leave
Speaker 1: you with a final thread to pull Cybuck Version one
Speaker 1: point zero mapped nineteen distinct knowledge areas back in October
Speaker 1: twenty nineteen.
Speaker 2: Yeah, it was a while ago.
Speaker 1: Now, it was a snapshot of the foundation at that time.
Speaker 1: But building on the very premise of the text that
Speaker 1: the discipline is constantly adapting to the sociotechnical reality, we
Speaker 1: have to consider our vantage point today right now in
Speaker 1: April six.
Speaker 2: Well, the sociotechnical reality has fractured in ways that were
Speaker 2: really only theoretical seven years ago.
Speaker 1: We have seen an absolute explosion in generative AI, hyper
Speaker 1: realistic deep fakes, automated disinformation campaigns operating out a global scale.
Speaker 2: That's a wolder frontier.
Speaker 1: We are looking at threats that don't just compromise a
Speaker 1: database or lock a hard drive. They actively compromise the
Speaker 1: concept of truth itself.
Speaker 2: That's the real threat model.
Speaker 1: Now, So what will the twentieth or twenty first knowledge
Speaker 1: area look like in the next iteration of this blueprint?
Speaker 1: Will something like synthetic reality or algorithmic manipulation become its
Speaker 1: own foundational pillar of cybersecurity?
Speaker 2: That almost has to be.
Speaker 1: When the boundary between the physical and the digital is
Speaker 1: completely erased, how do you architect a system to secure
Speaker 1: reality itself? Something for you to mull over until our
Speaker 1: next deep dive.