JupiterOne Press Releases New Book: Cyber Defense Matrix

By

In a world where cybersecurity threats evolve and proliferate at dizzying speed, a confusing and disordered cybersecurity landscape makes it all too difficult to ensure that our assets are defended from harm. The Cyber Defense Matrix is my attempt to organize the many activities that we perform within this landscape into a clear, coherent, and comprehensive scheme to guide the work of security professionals, solution providers, investors, and others in the field.

Over the years, I’ve discussed the Cyber Defense Matrix with hundreds of workshop attendees at RSA, brainstormed on its use cases with colleagues, advised organizations from the Fortune 500 to top government agencies on its usage, and continued to iterate on its nuances. However, these types of conversations do not scale well and demand more and more of my time.

To enable greater scale in sharing the lessons that I’ve learned in using the Cyber Defense Matrix, I’m excited to announce the availability of the Cyber Defense Matrix in book form—making this valuable and versatile tool readily available to advance our common goal of a more secure environment.

The book is available today on Amazon and as a complimentary download from JupiterOne. Join me in upcoming discussions on the book on the next episode of Cyber Therapy on Tues., Feb. 15, and a JupiterOne webinar on Wed., Feb. 23.  I’ll also sign copies at this year’s RSA Conference, where I’ll elaborate on new use cases in my sessions, Cyber Defense Matrix: Revolutions and Cyber Defense Matrix Learning Lab. I hope you’ll join me there!

The road to the Cyber Defense Matrix

CDM_Book Mockup

The Cyber Defense Matrix has been evolving over many years of thought, discussion, and practical application in my work as a cybersecurity professional. Its genesis was a desperate need I faced as the Chief Security Scientist at Bank of America.

Chartered to define the company’s long-term security technology strategy, I met with hundreds of cybersecurity startups to determine what capabilities they offered and how they might fit into our portfolio. I found the world highly confusing to say the least. Each vendor had its own way of talking about the space, its own jargon and marketecture, making hard to understand what each one actually did, how they related to each other, and how these solutions matched up with the needs we had. I needed to create a common framework encompassing the full spectrum of requirements across our environment, with a consistent way to define and map each solution into this structure.

Simple in form, easy to grasp and memorize, the Cyber Defense Matrix is also rich in angles and viewpoints to deepen one’s understanding of the cybersecurity landscape. The matrix plots the five distinct functions of the NIST Cybersecurity Framework (IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER) against the five classes of assets in need of defense (DEVICES, NETWORKS, APPLICATIONS, DATA, and USERS) to provide a high-level overview of the entire cybersecurity environment. There’s nothing terribly novel about these two dimensions, but by cross-mapping them, we can extend this familiarity in new ways to bring insight to a space that badly needed it.

Cyber Defense Matrix - JupiterOne


This two-dimensional view reveals patterns and sequences that make gaps easier to perceive. For example, if we’re maintaining an inventory (a subfunction of the IDENTIFY function) across devices, applications, networks, and users, the Cyber Defense Matrix will immediately highlight the fact that we’re not doing so for data. Why not? Should we be? Is there a solution to do so?

The Cyber Defense Matrix also includes a gradient of dependencies on technology and on people across specific functions. On the left side of the scale, we find functions better executed by technology, such as an inventory that can be completed more quickly, completely, and accurately by automation than by a staffer with a clipboard. On the right side, we find areas where human expertise becomes more critical, such as an understanding of the psychology and motivations of insider threats, or the intricacies of response and recovery operations. This gradient can help us think about whether we’re relying too much on one or the other for a given function—a common factor in processes where outcomes aren’t living up to expectations.

Putting the Cyber Defense Matrix to work for cybersecurity professionals, investors, and vendors

While the Cyber Defense Matrix has proved highly useful for mapping security vendors, this is only one of many use cases where it offers value. For cybersecurity professionals, the matrix can help identify gaps in security controls, prioritize investments, develop a roadmap, understand organizational responsibilities and handoffs, and inform conversations with executive leadership. For solution providers, it can highlight promising areas for new product development. For investors, it offers a way to discover problems that have yet to be addressed through a commercial product, and to understand a prospective company’s market opportunity and potential—a use case I myself have embraced in my work as the CISO-in-Residence at YL Ventures.

Imagine going through life always knowing exactly where to put things—which pocket or shelf or drawer is the right place for each item you come across. As a hopelessly untidy person that would mortify Marie Kondo, this kind of organized mindset has always eluded me in mundane personal matters, but the Cyber Defense Matrix has brought exactly this kind of order to my work in cybersecurity. And there’s no end to the ways this mental model can be applied. It’s not just about organizing vendors—it’s achieving a new understanding of how different elements of the entire cybersecurity ecosystem fit together, helping us explore and navigate a space that had typically been so challenging to comprehend.

One of my favorite things about the Cyber Defense Matrix is its living, breathing nature. While its structure remains constant, new use cases continue to emerge as people find novel ways to leverage it. Over the past few years, I’ve invited other practitioners to join me at my sessions at RSA to present their own experiences and use cases with the matrix, and I always come away newly inspired and eager to discover the next hidden gem within the Cyber Defense Matrix. If you discover a new use case, I would love to hear from you!

Get your copy of the book on Amazon or download a complimentary copy from JupiterOne.

Sounil Yu
Sounil Yu

Before Sounil Yu joined JupiterOne as CISO and Head of Research, he was the CISO-in-Residence for YL Ventures, where he worked closely with aspiring entrepreneurs to validate their startup ideas and develop approaches for hard problems in cybersecurity. Prior to that role, Yu served at Bank of America as their Chief Security Scientist and at Booz Allen Hamilton where he helped improve security at several Fortune 100 companies and government agencies.

To hear more from Sounil, get our newsletter. No spam, just the good stuff once or twice a month. Sign up below.

Keep Reading

What’s new in JupiterOne: Reducing time to value with the new Query Builder (Part 2)
February 6, 2023
Blog
What’s new in JupiterOne: Reducing time to value with the new Query Builder (Part 2)

The new JupiterOne Query Builder streamlines your querying experience by eliminating errors, simplifying query builds, and reducing time to value.

The top 10 questions that every engineering leader should be able to answer
February 2, 2023
Blog
The top 10 questions that every engineering leader should be able to answer

We polled some of our engineering leaders to see what it takes to succeed. In part two, we see if their answers align with the CISOs we talked to.

Identify compromised versions of Github using JupiterOne
January 31, 2023
Blog
Identify compromised versions of GitHub apps using JupiterOne

As a preventative measure, Github will be deprecating the Mac and Windows signing certificates used to sign Desktop app versions 3.0.2-3.1.2 and Atom versions 1.63.0-

15 Mar 2022
Blog
One line headline, one line headline

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud eiut.

15 Mar 2022
Blog
One line headline, one line headline

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud eiut.

15 Mar 2022
Blog
One line headline, one line headline

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud eiut.