Show
Download/Print PDF You may have heard about the NIST Cybersecurity Framework, but what exactly is it?And does it apply to you? NIST is the National Institute of Standards and Technology at the U.S. Department of Commerce. The NIST Cybersecurity Framework helps businesses of all sizes better understand, manage, and reduce their cybersecurity risk and protect their networks and data. The Framework is voluntary. It gives your business an outline of best practices to help you decide where to focus your time and money for cybersecurity protection. You can put the NIST Cybersecurity Framework to work in your business in these five areas: Identify, Protect, Detect, Respond, and Recover. 1. IdentifyMake a list of all equipment, software, and data you use, including laptops, smartphones, tablets, and point-of-sale devices. Create and share a company cybersecurity policy that covers: Roles and responsibilities for employees, vendors, and anyone else with access to sensitive data. Steps to take to protect against an attack and limit the damage if one occurs. 2. Protect
3. DetectMonitor your computers for unauthorized personnel access, devices (like USB drives), and software. Investigate any unusual activities on your network or by your staff. Check your network for unauthorized users or connections. 4. RespondHave a plan for:
Test your plan regularly5. RecoverAfter an attack:Repair and restore the equipment and parts of your network that were affected. Keep employees and customers informed of your response and recovery activities. For more information on the NIST Cybersecurity Framework and resources for small businesses, go to NIST.gov/CyberFramework and NIST.gov/Programs-Projects/Small-Business-Corner-SBC Download/Print PDF In a world where digital transformation increases compliance burdens, understanding how to best secure on-premises, cloud, and hybrid IT stacks becomes more crucial than ever. Most organizations, regulations apply penalties but rarely offer concrete strategies for securing systems, networks, software, and devices. While cybersecurity frameworks provide a set of “best practices” for determining risk tolerance and setting controls, knowing which one is best for your organization can be difficult. Moreover, many regulations cross-reference more than one standard or framework. Understanding the similarities and differences across the top 25 security frameworks can help you create a more robust cybersecurity compliance program. 1. Australian Signals Directorate (ASD) Essential 8ASD’s Essential 8 takes a maturity model approach to cybersecurity, listing three levels. The eight essential strategies encompass:
Each maturity level aligns with having specific controls within those eight strategies in place. Maturity Level One means the organization is “partly aligned.” Maturity Level Two means an organization put additional controls in place to be “mostly aligned.” Maturity Level Three means an organization has implemented all required controls and is “fully aligned.” 2. Center for Internet Security (CIS) ControlsWhile some frameworks offer flexibility, others take a more prescriptive approach. Probably the cybersecurity framework most often cited by professionals, the CIS Controls framework lists twenty mission-critical
controls across three categories:
The CIS Controls framework then goes even further to define three implementation groups. Implementation Group 1 is for organizations with limited resources and cybersecurity expertise. Implementation Group 2 is for organizations with moderate resources and cybersecurity expertise. Implementation Group 3 is for mature organizations with significant resources and cybersecurity expertise. Under each of the 20 controls, the CIS Controls framework provides a list of sub-controls, color-coded to indicate which implementation group should be using them. For example, CIS Control 1 “Inventory and Control of Hardware Assets” lists sub-control “Utilize an Active Discovery Tool” is appropriate for Implementation Groups 2 and 3 but considered too much of a burden for Group 1. 3. Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM)Consisting of 197 control
objectives organized into 17 domains, the CCM focuses solely on cloud computing. The 17 domains include:
Within each domain, CCM lists controls and specifications to help organizations create a compliant security program. 4. Control Objectives for Information Technology (COBIT)The Information Systems Audit and Control Association (ISACA) updated its COBIT framework in 2019 to create a Governance System and Governance Framework. Instead of basing compliance on individual security controls, COBIT 2019 starts with stakeholders’ needs, assigns job-related governance responsibilities to each type, then maps the responsibility back to
technologies. Ultimately, COBIT’s goal is to ensure appropriate oversight of the organization’s security posture. The COBIT core model groups governance and management objectives into five domains:
COBIT’s design principles include:
Ultimately, COBIT’s focus on governance creates a security framework that streamlines audits and incorporates continuous improvement to enhance those outcomes. 5. Cybersecurity and Infrastructure Security Agency (CISA) Transporation Systems Sector (TSS) Cybersecurity FrameworkThe Department of Transportation, Transportation Security Administration,
United States Coast Guard, and Transportation Systems Sector worked together to create a framework that addressed industry-specific needs. Based on NIST’s Cybersecurity Framework, the TSS Cybersecurity Framework focuses on five discrete TSS strategy goals:
It aligns each goal to the appropriate NIST categories. For example, “Ensure Sustained Coordination and Strategic Implementation” aligns with NIST’s “Business Environment Governance.” The TSS Cybersecurity Framework takes a risk-based and maturity model approach, allowing organizations to apply threat intelligence to determine security breach impact. By defining low, moderate, and high impact levels, organizations can prioritize the next steps to reduce the risk profile. 6. Cybersecurity Maturity Model Certification (CMMC)The Office of the Under Secretary of Defense Acquisition and Sustainment (OUSD(A&S)) worked with Department of Defense (DoD) stakeholder, University Affiliated Research Centers (UARCs), and Federally Funded Research and Development Centers (FFRDC) to
standardize cybersecurity across the Defense Industrial Base (DIB). Unlike other maturity models, CMMC is both a set of best practices and a requirement for organizations that solicit DoD contracts. CMMC lists five maturity levels, primarily based on whether the data an organization collects, transmits, stores, and processes is Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). The five certification levels are:
As an organization’s maturity level increases, so do the required controls’ number and sophistication level. At Maturity Level 1, an organization only needs seventeen practices. Meanwhile, an organization that needs to meet Maturity Level 5 compliance needs 173 practices in place. 7. European Telecommunications Standards Institute (ETSI)ETSI is a non-profit standards organization with more than 900 members from across 65 countries and five continents. A European Standards Organization (ESO), ETSI supports European regulations and legislation by creating standards used throughout the EU. Technical Report (TR) 103 305-1 “Critical Security Controls for Effective Cyber Defence.” ETSI based the top twenty Enterprise industry level cybersecurity best practices on the Critical Security Controls (CSC) CIS established. However, unlike the CIS Critical Controls, ETSI does not divide activities into Implementation Groups. The “Critical Security Controls for Effective Cyber Defence” includes the following for each of the twenty controls:
8. European Union Agency for Cybersecurity (ENISA) National Capabilities Assessment FrameworkPublished on December 7, 2020, the ENISA National Capabilities Assessment Framework provides the Member States a way to engage in self-assessments so that they can identify their maturity level. The framework offers a way for countries to assess their cybersecurity capabilities, ultimately giving them guidelines for setting national strategies. The Framework outlines the following benefits that come from engaging in a national assessment:
9. Factor Analysis of Information Risk (FAIR) Cyber Risk FrameworkThe FAIR Institute is a nonprofit organization whose mission is to establish and promote risk management best practices so that risk professionals can collaborate better with their business partners. The FAIR cyber risk framework takes an explicit approach to cyber risk management so that organizations can quantify risk regardless of the cybersecurity framework they use. According to FAIR, an implicit risk management approach starts with a compliance requirement and aligns controls to it, creating a reactive risk posture. Meanwhile, FAIR’s explicit approach creates a cycle of continuous improvement integrating risk targets, controls, and a proactive risk posture. FAIR creates a risk management system focused on:
10. HITRUST Cybersecurity Framework (CSF)To help healthcare organizations and their business associates find a more flexible way to meet Health Insurance Portability and Accountability Act (HIPAA) compliance, HITRUST offers an integrated risk and compliance approach. Privacy, information security, and risk management leaders across the public and private sectors worked together to establish a set of safeguards for protecting the security and privacy of protected health information (PHI) and electronic PHI (ePHI). The HITRUST CSF consists of 49 control objectives across 156 control specifications, all of which fall into one of the following 14 control categories:
11. Information Security Forum (ISF) Standard of Good Practice for Information Security (SOGP 2020)The ISF is a no-profit organization whose members consist of companies on the Fortune 500 and Forbes 2000 lists. The organization focuses on creating a knowledge exchange where members share security issues, experiences, and practical solutions. The SOGP 2020 provides a set of best practices intended to:
12. International Society of Automation (ISA/IEC 62443)Founded in 1945, ISA is a non-profit professional association that established a Global Security Alliance (GSA) to work with manufacturers and critical infrastructure providers. GSA incorporates various stakeholders, including end-user companies, automation and control systems providers, IT infrastructure providers, services providers, and system integrators. ISA/IEC 62443 is an industrial security framework focused on both traditional IT environments and SCADA or plant floor environments and includes:
13. International Telecommunications Union (ITU) National Cybersecurity/ Critical Information Infrastructure Protection (CIIP)Recognizing the increasing importance of information and communication technologies (ICTs) to national security, economic well-being, and social cohesion, ITU created its CIIP as a model for sharing the responsibility between government, business, other organizations, and individual users. The CIIP sets forth the following key elements that a national cybersecurity strategy should include:
14. Internet of Things (IoT) Cybersecurity Alliance (IOTCA)The IoTCA’s mission is to forge a community that brings together cybersecurity and IoT experts so that they can address real-world IoT security issues and work to establish a security-first IoT posture. Their framework takes a multi-layered approach to create end-to-end security, taking into account all connected devices and their associated applications. The framework includes:
Their goal is to mitigate risks such as:
15. Internet of Things (IoT) Security Foundation (IoTSF) Security Compliance FrameworkThe IoTSF is a non-profit international organization that brings together IoT security professionals, IoT hardware and software product vendors, network providers, system specifiers, integrators, distributors, retailers, insurers, local authorities, and government agencies. They focus on securing IoT during the design phase to mitigate financial and brand reputation risk. The IoTSF Security Compliance Framework released in May 2020 takes a risk-based approach to compliance and focuses on six key issues:
16. International Office of Standardization (ISO) 27001ISO represents one of the oldest standards organizations. Founded in 1947, this non-governmental organization has members from 165 countries. ISO sets standards for various technologies, including several security standards. The ISO/IEC 27000 “family” boasts over a dozen standards, but ISO 27001 sets the foundation for establishing an information security management system (ISMS). ISO 27001 includes requirements for establishing, implementing, maintaining, and continually improving an ISMS influenced by the organization’s needs, objectives, security requirements, processes, size, and structure. Its best practices include setting controls and processes based on:
As part of establishing an ISMS, organizations need to consider additional ISO 27000 family standards such as:
17. MITRE ATT&CKThe non-profit, federally funded MITRE is a cybersecurity-focused research and development center. When MITRE began documenting common cyberattack tactics, techniques, and procedures (TTPs) used against Windows enterprise networks, ATT&CK became the baseline acting as a common language for offensive and defensive researchers. MITRE is responsible for establishing and trademarking the Common Vulnerabilities and Exposures (CVE) list. MITRE Enterprise has 14 tactics commonly used when malicious actors set up advanced persistent threats (APTs) within a corporate ecosystem. Each of the following 14 tactics is then broken down into specific activities:
In response to the increasing use of mobile devices, MITRE created the Mobile matrix to help security staff better track emerging threats. The 14 MITRE mobile tactics, again divided into sub-categories, are:
18. National Cyber Security Centre (NCSC) Cyber Assessment Framework (CAF)The United Kingdom’s NCSC launched in 2016 and brings together SMEs, enterprise organizations, government agencies, the general public, and departments to address cybersecurity concerns. Its CAF provides guidance for UK Critical National Infrastructure (CNI), organizations subject to the NIS Directive cyber regulation, and organizations managing cyber-related risks to public safety. CAF guides organizations toward establishing a cyber resiliency program, focusing on outcomes rather than checklists. It has four primary objectives:
It embeds 14 subparts within these four primary objectives, many aligned with other international standards. These subparts are:
19. New Zealand Protective Security Requirements (PSR)New Zealand’s PSR creates a policy framework for how organizations should manage security governance (GOVSEC), personnel (PERSEC), information (INFOSEC), and physical security (PHYSEC) across the public and private sectors. The four-tiered, hierarchical structure requires organizations to:
Across the four key areas it lays out 32 focus areas:
20. National Institute of Technologies (NIST) Cybersecurity Framework (CSF)NIST is a US non-regulatory government agency that sets standards across the physical sciences. Originally intended for critical infrastructure owners and operators, NIST CSF can be used by any organization. Many companies outside of the critical infrastructure industry also use the CSF, especially if they need to meet other US federal data protection requirements. The CSF consists of three sections:
The Framework Core consists of five functions with categories and subcategories embedded within them. The Framework Core Functions are:
The four Implementation Tiers are:
21. NIST Special Publication (SP) 800-82 Guide to Industrial Control Systems (ICS) SecurityIn order to address the unique cybersecurity concerns facing ICS, NIST SP 800-82 provides guidance for supervisory control and data acquisition (SCADA) systems, distributed control systems (IDS), and other control system configurations found in the industrial control sectors, like Programmable Logic Controls (PLC). To protect ICS, NIST suggests a defense-in-depth strategy, including:
22. North American Electric Reliability Corporation (NERC)NERC is a non-profit international regulatory authority focused on effectively and efficiently reducing risks facing the grid system. Its jurisdiction includes bulk power system users, owners, and operators. NERC currently has 19 approved security guidelines across the following areas:
23. OASIS Security Assertion Markup Language (SAML)OASIS Open is a community where experts can advance projects, including open source projects, for cybersecurity, blockchain, IoT, emergency management, cloud computing, and legal data exchange. SAML is a standard that defines a framework for exchanging security information between online business partners. Developed by the Security Services Technical Committee, SAML is an XML-based framework that supports business communications for user authentication, entitlement, and attribute information. Organizations can apply it to human and machine entities, partner companies, or other enterprise applications. Organizations most often use SAML for web single-sign-on (SSO), attribute-based authorization, and securing web services. SAML consists of four main components:
24. Payment Card Industry Data Security Standard (PCI DSS)Founded in 2006 as a response to increased credit card fraud, the Payment Card Industry Security Standards Council (PCI SSC) consists of the five major credit card companies, American Express, Discover, JCB International, Mastercard, and Visa, Inc. The Payment Card Industry Data Security Standard (PCI DSS) is a prescriptive security compliance requirement for merchants and financial services providers. PCI DSS contains 5 categories of controls:
Within those 5 categories, PCI DSS then sets out 12 detailed requirements:
25. Saudi Arabian Monetary Authority (SAMA) Cybersecurity FrameworkIn May 2017, the Saudi Arabian Monetary Authority (SAMA) issued Version 1.0 of its Cyber Security Framework (SAMA CSF). In the introduction, SAMA noted that applying new online services and new developments, such as fintech, and blockchain, require additional regulatory standards to protect against continuously evolving threats. SAMA explained its Framework’s objectives as: 1. To create a common approach for addressing cybersecurity within the Member Organizations. The SAMA CSF defines its scope as:
Additionally, it focuses more broadly than other financial cybersecurity frameworks by incorporating applicability to the following industries:
SecurityScorecard enables complianceSecurityScorecard’s security ratings platform and Atlas offering enable organizations to monitor their cybersecurity and compliance posture more efficiently. Our security ratings provide real-time visibility into cybersecurity risks, using an easy-to-read A-F scoring system. Our Atlas platform maps controls across various standards so that customers have visibility into their compliance posture. Using SecurityScorecard, organizations can align their security controls with our ten categories of risk. Since Atlas maps to over 20 industry-standards, organizations can create a holistic, automated compliance program and remove the human error risk that comes from using spreadsheets. With our all-in-one solution, organizations can monitor their own infrastructure and build out a robust vendor risk management program for a proactive approach to cybersecurity and compliance. What are the 5 areas of the NIST Cybersecurity Framework?They include identify, protect, detect, respond, and recover. These five NIST functions all work concurrently and continuously to form the foundation where other essential elements can be built for successful high-profile cybersecurity risk management.
What are the 5 functions described in the NIST framework Core?This learning module takes a deeper look at the Cybersecurity Framework's five Functions: Identify, Protect, Detect, Respond, and Recover.
What are the five 5 steps of the cybersecurity lifecycle?It consists of five concurrent and continuous Functions: Identify, Protect, Detect, Respond and Recover.
What are the main components of the NIST Cybersecurity Framework?The Cybersecurity Framework consists of three main components: the Core, Implementation Tiers, and Profiles.
|