How to implement NIST cybersecurity standards in my organization

Editor's Notes

• #4: In February 2013, President Obama issued Executive Order 13636 to address the issue of repeated cyber intrusions on our nation’s infrastructure. The NIST CSF was a direct result of this executive order. NIST CSF is different than NIST SP800-53 which was released after the Federal Information Security Management Act (FISMA) of 2002 was issued. CSF is far more generic than SP800-53. The former is about 60 pages and the latter is about 500 pages in length. SP800-53 includes a detailed control catalog whereas CSF does not. CSF references various control catalogs including CIS, COBIT, ISO, and SP800-53. Both the CSF and SP800-53 have applicability outside of federal information systems. In fact, the latest revision, v5 of NIST SP800-53 has dropped the term “federal” altogether and is now known as “Security and Privacy Controls for Information Systems and Organizations”.
• #5: NIST is part of the U.S. Department of Commerce. It’s been around since 1901. NIST's mission is “to promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life”.
• #6: According to Obama’s executive order, NIST was to create “a set of standards, methodologies, procedures, and processes that align policy, business, and technological approaches to address cyber risks.” [1] The NIST Cybersecurity Framework was the result.
• #7: Whereas PCI-DSS and the HIPAA Security Rule are geared to specific industries, the NIST CSF is generic and beneficial for all organizations, regardless of industry. The CSF is more high-level in its scope compared to existing frameworks like NIST 800-53. It focuses on how to access and prioritize security functions, and references existing documents like NIST 800-53, COBIT 5, and ISO 27000 for more detail on how to implement specific controls and processes. This allows the CSF to be a much more concise document. NIST 800-53 is a regulatory document, encompassing the processes and controls needed for a government-affiliated entity to comply with the FIPS 200 certification (Minimum Security Requirements for Federal Information Systems). [3] The ISO 27001 standard is a less technical, more risk management-based approach that provides best practice recommendations for companies of all types and sizes in six defined phases. Companies can get ISO-certified. ISO is also a globally-recognized standard.
• #9: Identifying physical and software assets within the organization to establish the basis of an Asset Management program Identifying the Business Environment the organization supports Identifying cybersecurity policies established within the organization to define the Governance program as well as identifying legal and regulatory requirements regarding the cybersecurity capabilities of the organization Identifying asset vulnerabilities, threats to internal and external organizational resources, and risk response activities as a basis for the organizations Risk Assessment Identifying a Risk Management Strategy for the organization including establishing risk tolerances Identifying a Supply Chain Risk Management strategy including priorities, constraints, risk tolerances, and assumptions used to support risk decisions associated with managing supply chain risks
• #10: Protections for Identity Management and Access Control within the organization including physical and remote access Empowering staff within the organization through Awareness and Training including role based and privileged user training Establishing Data Security protection consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information Implementing Information Protection Processes and Procedures to maintain and manage the protections of information systems and assets Protecting organizational resources through Maintenance, including remote maintenance, activities Managing Protective Technology to ensure the security and resilience of systems and assists are consistent with organizational policies, procedures, and agreements
• #11: Ensuring Anomalies and Events are detected, and their potential impact is understood Implementing Security Continuous Monitoring capabilities to monitor cybersecurity events and verify the effectiveness of protective measures including network and physical activities Maintaining Detection Processes to provide awareness of anomalous events
• #12: Ensuring Response Planning process are executed during and after an incident Managing Communications during and after an event with stakeholders, law enforcement, external stakeholders as appropriate Analysis is conducted to ensure effective response and support recovery activities including forensic analysis, and determining the impact of incidents Mitigation activities are performed to prevent expansion of an event and to resolve the incident The organization implements Improvements by incorporating lessons learned from current and previous detection / response activities
• #13: Ensuring the organization implements Recovery Planning processes and procedures to restore systems and/or assets affected by cybersecurity incidents Implementing Improvements based on lessons learned and reviews of existing strategies Internal and external Communications are coordinated during and following the recovery from a cybersecurity incident
• #14: Cybersecurity is everyone’s job. [5] Just because the cloud can be secure doesn't mean it's configured that way. Both AWS and Office 365 have several security features, but most of them are not enabled by default. For example, you may use Office 365 for email, but most organizations don’t have multi-factor authentication enabled, so they’re at a high risk for account takeover. Aside from management brushing off cybersecurity as unimportant, involving unqualified individuals in the process of security assessments is the single worst mistake that can be made.
• #15: To contact Jeff Miller after this presentation, email him at [email protected] or call 518-818-1501.