Big-picture cybersecurity experts/ theorists

[billofrights]

Ok, I know this is kind of an esoteric thing but someone asked me about this at work and it hadn't occurred to me.

I do IT support in a university, and was asked for a recommendation on books/ articles from anyone who has a very 'big picture' view of cybersecurity, sort of like a military strategist. When attacks should happen, what form they take, how they'll evolve over the next few decades.

I know this is hugely broad but it can't hurt to put it out there and see if any of you guys know where I should look.

[Jimmy Deuce]

NSA training manual?

[ocabj]

http://www.sans.edu/research/book-reviews/article/security-books-best

If you work for UC and plan on going to UCCSC we can talk there as well.

[Cyberion]

https://www.us-cert.gov/security-publications

[sl0re10]

Ok, I know this is kind of an esoteric thing but someone asked me about this at work and it hadn't occurred to me.

I do IT support in a university, and was asked for a recommendation on books/ articles from anyone who has a very 'big picture' view of cybersecurity, sort of like a military strategist. When attacks should happen, what form they take, how they'll evolve over the next few decades.

I know this is hugely broad but it can't hurt to put it out there and see if any of you guys know where I should look.

I don't have a big picture theory but I can tell you the best tools available to log and stop attacks...

Anyway IMO; step one is to read up on evasion attacks in relation to firewalls. Almost everyone is wide open to them.... today.

The next is probably the new devices that run VMs and intentionally expose them to questionable code being sent into an org... just to see what happens. If something does (like the VM in question tries to send any traffic out) the unit emails you about the code and who it went to... they also use time shifts on the VM to fake them out... for if the code had a timer...

Third are some of the new-ish devices that collect logs from all your existing devices and look for patterns for you. Even if there are clues here and there that something is going on; what are the odds someone checking the logs would notice them? Let alone check all the involved devices (will the server people check the cisco stuff too)?

[Cyberion]

I do IT support in a university

And if you've not read it, I would highly recommend you read the following paperback by Cliff Stoll.

http://www.amazon.com/The-Cuckoos-Egg-Tracking-Espionage/dp/1416507787/ref=sr_1_1?ie=UTF8&qid=1397052332&sr=8-1&keywords=cliff+stoll