Index > Cyber Risk and Resilience > 2021-08-30: Hurdles, State, and intro to Frameworks
Organizational Silos - they don’t often talk to each other, outside of incidents. There is a push for a “Chief Risk Officer” - who’s job is to break the boundaries between these silos.
Insufficient Business Involvement - csec isn’t a technological problem, it’s a business problem.
Over-reliance on training and communications - If you have the training, cyber insurance will cover you; but you can’t rely on just that.
“Cyber resilient organizations can contain attacks without relying solely on people as the way to mitigate risk.”
Talent Shortfalls - we just don’t have enough people.
What’s out there?
Nation State Threats - These boys are big, and to assume they only attack govs is a mistake.
Organized Crime and hackers - The black market provides tools and even customer support.
Hacktivists - hacking for political or social causes. No matter what you’re doing, someone out there doesn’t like it.
Insider Threat - Employees, Vendors, Contractors; often approached by black market actors offering funds for info.
Substandard Products and Services - Not everything you interact with is as good as you are.
A framework is a checklist to make your auditors happy.
This started with critical infrastructure.
Evolving Threats to Critical Infrastructure:
International Standards Organization publishes high-level “best practices”. It looks at:
This framework suggests hundreds of potential controls.
How do you know your blinky lights are working? Evaluation is important.
By the Information Systems Audit and Control Association (ISACA).
Another thick one. It’s expensive too.
Payment Card Industry Data Security Standard.
If you want to interact with payment card gateways, you have to be in compliance with this.
“This is a smaller framework” - Prof. If this is small, I can’t imagine what the big ones are.
A set of recommended controls. A large group of volunteers maintains this set.
Federal information Security Modernization Act.
National Institute of Standards and Technology Cyber Security Framework.
The latest framework. Very popular. It’s made by NIST, free for everyone.
This is the one we’ll be focusing on for the rest of the course.
The 5 core areas:
NIST CSF comes with mappings, to connect it to a ton of other frameworks.
Who uses the CSF?
A nist CSF Profile - what is this? It’s a profile of where an organization stands by the CSF’s standards. How does the org measure up?
The 7 step process
Some information will be coming out over slack in the next few days.