Cybersecurity Risk Management
Description
In Cybersecurity Risk Management: Mastering the Fundamentals Using the NIST Cybersecurity Framework, veteran technology analyst Cynthia Brumfield, with contributions from cybersecurity expert Brian Haugli, delivers a straightforward and up-to-date exploration of the fundamentals of cybersecurity risk planning and management. The book offers readers easy-to-understand overviews of cybersecurity risk management principles, user, and network infrastructure planning, as well as the tools and techniques for detecting cyberattacks. The book also provides a roadmap to the development of a continuity of operations plan in the event of a cyberattack.
With incisive insights into the Framework for Improving Cybersecurity of Critical Infrastructure produced by the United States National Institute of Standards and Technology (NIST), Cybersecurity Risk Management presents the gold standard in practical guidance for the implementation of risk management best practices.
Filled with clear and easy-to-follow advice, this book also offers readers:
* A concise introduction to the principles of cybersecurity risk management and the steps necessary to manage digital risk to systems, assets, data, and capabilities
* A valuable exploration of modern tools that can improve an organization's network infrastructure protection
* A practical discussion of the challenges involved in detecting and responding to a cyberattack and the importance of continuous security monitoring
* A helpful examination of the recovery from cybersecurity incidents
Perfect for undergraduate and graduate students studying cybersecurity, Cybersecurity Risk Management is also an ideal resource for IT professionals working in private sector and government organizations worldwide who are considering implementing, or who may be required to implement, the NIST Framework at their organization.
More details
Other editions
Additional editions
Person
Cynthia Brumfield is the President of DCT Associates and a veteran media, communications, and technology analyst who is now focused on cybersecurity. Backed by executive-level experience at top-tier U.S. communications trade associations, a premier investment analysis firm, and her own successful publication and consulting businesses, she has spearheaded research, analysis, consulting, publishing, and education initiatives for major organizations, including Fortune 500 corporations, security organizations, and federal government clients. In addition, she is an award-winning writer who currently runs a pioneering cybersecurity news destination, Metacurity, and writes regularly for top news outlets, including ongoing columns for CSO Online.
Brian Haugli is the Managing Partner and Founder of SideChannel. He has been driving security programs for two decades and brings a true practitioner's approach to the industry. He has led programs for the DoD, Pentagon, Intelligence Community, Fortune 500, and many others. In addition, Brian is a renowned speaker and expert on NIST guidance, threat intelligence implementations, and strategic organizational initiatives.
Content
Academic Foreword xiii
Acknowledgments xv
Preface - Overview of the NIST Framework xvii
Background on the Framework xviii
Framework Based on Risk Management xix
The Framework Core xix
Framework Implementation Tiers xxi
Framework Profile xxii
Other Aspects of the Framework Document xxiii
Recent Developments At Nist xxiii
Chapter 1 Cybersecurity Risk Planning and Management 1
Introduction 2
I. What Is Cybersecurity Risk Management? 2
A. Risk Management Is a Process 3
II. Asset Management 4
A. Inventory Every Physical Device and System You Have and Keep the Inventory Updated 5
B. Inventory Every Software Platform and Application You Use and Keep the Inventory Updated 9
C. Prioritize Every Device, Software Platform, and Application Based on Importance 10
D. Establish Personnel Security Requirements Including Third-Party Stakeholders 11
III. Governance 13
A. Make Sure You Educate Management about Risks 13
IV. Risk Assessment and Management 15
A. Know Where You're Vulnerable 15
B. Identify the Threats You Face, Both Internally and Externally 16
C. Focus on the Vulnerabilities and Threats That Are Most Likely AND Pose the Highest Risk to Assets 17
D. Develop Plans for Dealing with the Highest Risks 18
Summary 20
Chapter Quiz 20
Essential Reading on Cybersecurity Risk Management 22
Chapter 2 User and Network Infrastructure Planning and Management 23
I. Introduction 24
II. Infrastructure Planning and Management Is All about Protection, Where the Rubber Meets the Road 24
A. Identity Management, Authentication, and Access Control 25
1. Always Be Aware of Who Has Access to Which System, for Which Period of Time, and from Where the Access Is Granted 27
2. Establish, Maintain, and Audit an Active Control List and Process for Who Can Physically Gain Access to Systems 28
3. Establish Policies, Procedures, and Controls for Who Has Remote Access to Systems 28
4. Make Sure That Users Have the Least Authority Possible to Perform Their Jobs and Ensure That at Least Two Individuals Are Responsible for a Task 29
5. Implement Network Security Controls on All Internal Communications, Denying Communications among Various Segments Where Necessary 31
A Word about Firewalls 31
6. Associate Activities with a Real Person or a Single Specific Entity 32
7. Use Single- or Multi-Factor Authentication Based on the Risk Involved in the Interaction 33
III. Awareness and Training 34
A. Make Sure That Privileged Users and Security Personnel Understand Their Roles and Responsibilities 35
IV. Data Security 35
A. Protect the Integrity of Active and Archived Databases 35
B. Protect the Confidentiality and Integrity of Corporate Data Once It Leaves Internal Networks 36
C. Assure That Information Can Only Be Accessed by Those Authorized to Do So and Protect Hardware and Storage Media 37
D. Keep Your Development and Testing Environments Separate from Your Production Environment 38
E. Implement Checking Mechanisms to Verify Hardware Integrity 39
V. Information Protection Processes and Procedures 39
A. Create a Baseline of IT and OT Systems 40
B. Manage System Configuration Changes in a Careful, Methodical Way 41
A Word about Patch Management 42
C. Perform Frequent Backups and Test Your Backup Systems Often 43
D. Create a Plan That Focuses on Ensuring That Assets and Personnel Will Be Able to Continue to Function in the Event of a Crippling Attack or Disaster 43
VI. Mainte nance 44
A. Perform Maintenance and Repair of Assets and Log Activities Promptly 45
B. Develop Criteria for Authorizing, Monitoring, and Controlling All Maintenance and Diagnostic Activities for Third Parties 45
VII. Protective Technology 46
A. Restrict the Use of Certain Types of Media On Your Systems 46
B. Wherever Possible, Limit Functionality to a Single Function Per Device (Least Functionality) 47
C. Implement Mechanisms to Achieve Resilience on Shared Infrastructure 48
Summary 49
Chapter Quiz 50
Essential Reading on Network Management 51
Chapter 3 Tools and Techniques for Detecting Cyber Incidents 53
Introduction 54
What Is an Incident? 55
I. Detect 56
A. Anomalies and Events 56
1. Establish Baseline Data for Normal, Regular Traffic Activity and Standard Configuration for Network Devices 57
2. Monitor Systems with Intrusion Detection Systems and Establish a Way of Sending and Receiving Notifications of Detected Events; Establish a Means of Verifying, Assessing, and Tracking the Source of Anomalies 58
A Word about Antivirus Software 60
3. Deploy One or More Centralized Log File Monitors and Configure Logging Devices throughout the Organization to Send Data Back to the Centralized Log Monitor 61
4. Determine the Impact of Events Both Before and After they Occur 61
5. Develop a Threshold for How Many Times an Event Can Occur Before You Take Action 62
B. Continuous Monitoring 62
1. Develop Strategies for Detecting Breaches as Soon as Possible, Emphasizing Continuous Surveillance of Systems through Network Monitoring 63
2. Ensure That Appropriate Access to the Physical Environment Is Monitored, Most Likely through Electronic Monitoring or Alarm Systems 64
3. Monitor Employee Behavior in Terms of Both Physical and Electronic Access to Detect Unauthorized Access 65
4. Develop a System for Ensuring That Software Is Free of Malicious Code through Software Code Inspection and Vulnerability Assessments 65
5. Monitor Mobile Code Applications (e.g., Java Applets) for Malicious Activity by Authenticating the Codes' Origins, Verifying their Integrity, and Limiting the Actions they Can Perform 66
6. Evaluate a Provider's Internal and External Controls' Adequacy and Ensure they Develop and Adhere to Appropriate Policies, Procedures, and Standards; Consider the Results of Internal and External Audits 66
7. Monitor Employee Activity for Security Purposes and Assess When Unauthorized Access Occurs 67
8. Use Vulnerability Scanning Tools to Find Your Organization's Weaknesses 68
C. Detection Processes 68
1. Establish a Clear Delineation between Network and Security Detection, with the Networking Group and the Security Group Having Distinct and Different Responsibilities 69
2. Create a Formal Detection Oversight and Control Management Function; Define Leadership for a Security Review, Operational Roles, and a Formal Organizational Plan; Train Reviewers to Perform Their Duties Correctly and Implement the Review Process 70
3. Test Detection Processes Either Manually or in an Automated Fashion in Conformance with the Organization's Risk Assessment 71
4. Inform Relevant Personnel Who Must Use Data or Network Security Information about What Is Happening and Otherwise Facilitate Organizational Communication 71
5. Document the Process for Event Detection to Improve the Organization's Detection Systems 72
Summary 72
Chapter Quiz 73
Essential Reading for Tools and Techniques for Detecting a Cyberattack 74
Chapter 4 Developing a Continuity of Operations Plan 75
Introduction 77
A. One Size Does Not Fit All 77
I. Response 77
A. Develop an Executable Response Plan 79
B. Understand the Importance of Communications in Incident Response 80
C. Prepare for Corporate-Wide Involvement During Some Cybersecurity Attacks 81
II. Analysis 82
A. Examine Your Intrusion Detection System in Analyzing an Incident 82
B. Understand the Impact of the Event 83
C. Gather and Preserve Evidence 84
D. Prioritize the Treatment of the Incident Consistent with Your Response Plan 84
E. Establish Processes for Handling Vulnerability Disclosures 85
III. Mitigation 86
A. Take Steps to Contain the Incident 86
B. Decrease the Threat Level by Eliminating or Intercepting the Adversary as Soon as the Incident Occurs 87
C. Mitigate Vulnerabilities or Designate Them as Accepted Risk 88
IV. Recover 88
A. Recovery Plan Is Executed During or After a Cybersecurity Incident 89
B. Update Recovery Procedures Based on New Information as Recovery Gets Underway 91
C. Develop Relationships with Media to Accurately Disseminate Information and Engage in Reputational Damage Limitation 92
Summary 92
Chapter Quiz 93
Essential Reading for Developing a Continuity of Operations Plan 94
Chapter 5 Supply Chain Risk Management 95
Introduction 96
I. NIST Special Publication 800-161 96
II. Software Bill of Materials 97
III. NIST Revised Framework Incorporates Major Supply Chain Category 98
A. Identify, Establish, and Assess Cyber Supply Chain Risk Management Processes and Gain Stakeholder Agreement 98
B. Identify, Prioritize, and Assess Suppliers and Third-Party Partners of Suppliers 99
C. Develop Contracts with Suppliers and Third-Party Partners to Address Your Organization's Supply Chain Risk Management Goals 100
D. Routinely Assess Suppliers and Third-Party Partners Using Audits, Test Results, and Other Forms of Evaluation 101
E. Test to Make Sure Your Suppliers and Third-Party Providers Can Respond to and Recover from Service Disruption 102
Summary 103
Chapter Quiz 103
Essential Reading for Supply Chain Risk Management 104
Chapter 6 Manufacturing and Industrial Control Systems Security 105
Essential Reading on Manufacturing and Industrial Control Security 110
Appendix A: Helpful Advice for Small Organizations
Seeking to Implement Some of the Book's Recommendations 111
Appendix B: Critical Security Controls Version 8.0 Mapped to NIST CSF v1.1 113
Answers to Chapter Quizzes 121
Index 131
Preface - Overview of the NIST Framework
The National Institute of Standards and Technology (NIST), located in Gaithersburg, MD, is a US Department of Commerce division. It is assigned the job of promoting innovation and industrial competitiveness. It is a research organization filled with some of the world's leading scientists and has produced many Nobel Prize winners.
NIST has a wide-ranging mandate: develop federal patents, oversee over 1,300 Standard Reference Materials, run a scientific laboratory in Boulder, CO, and pursue innovation in encryption technologies, among other significant efforts. NIST is primarily a scientific and engineering organization and, as such, produces patents, technical breakthroughs, documentation, and recommendations through extensive consultation with experts in various areas. This scientific consensus approach often has impressive results that can be difficult for non-specialists to understand or apply.
The NIST Cybersecurity Framework resulted from an intensive one-year effort to synthesize cybersecurity experts' best thinking into a single "framework of frameworks" that can assure superior risk management. It's well-understood in the cybersecurity field that risks are constant and that the best approach to organizational cybersecurity is to manage those risks because no one can eliminate them.
The NIST Framework attempts to incorporate all the best various risk management and remediation practices into one coherent whole, an ambitious goal in the complex cybersecurity field. It is a multi-layered, spoke-and-wheel collection of ideas grouped along logical lines.
The Framework is conceptual and not technical, making it a challenge for many organizations to apply in the real world. It doesn't help that NIST specifically avoided any technical recommendations when developing the Framework. NIST instead chose to map its recommendations to a host of standards, or informative references, designed in-house and at other standards-setting bodies.
Despite its growing use among leading corporations, government offices, and non-profit organizations in the United States and worldwide, many non-cybersecurity professionals, and even some cybersecurity specialists, struggle with the practical application of the NIST Framework.
The following summary provides a broad overview of what the Framework is and how it's structured. Keep in mind that the rest of the book focuses on the much-needed practical guidance on applying the NIST Framework, which we hope even non-cybersecurity professionals will grasp and find useful.
BACKGROUND ON THE FRAMEWORK
In the face of growing concerns over the prospect of a devastating cyberattack on US critical infrastructure, President Barack Obama issued on February 12, 2013, Executive Order (EO) 13636 "Improving Critical Infrastructure Cybersecurity."1 The EO aimed to create a "partnership with the owners and operators of critical infrastructure to improve cybersecurity information sharing and collaboratively develop and implement risk-based standards." To achieve that objective, the EO mandated that NIST develop within one year "a voluntary risk-based Cybersecurity Framework, a set of industry standards and best practices to help organizations manage cybersecurity risks."
To hammer out the Framework, NIST hosted five workshops at multiple universities involving thousands of domestic and international private- and government-sector participants. Finally, on February 12, 2014, NIST issued the Framework for Improving Critical Infrastructure Cybersecurity.2 The Department of Homeland Security (DHS) currently considers 16 sectors to be critical infrastructure sectors, encompassing information technology, financial services, energy, communications, manufacturing, and many other central services.3 However, NIST hopes that the Framework will be helpful to all organizations and anticipates that its application will extend beyond critical infrastructure.
Underscoring the "living" nature of the Framework, on April 16, 2018, NIST issued an update, Version 1.1.4 The updated Framework features several additional subcategories, including an expansive new set of subcategories dealing with Supply Chain Risk, a timely addition as the protection of digital supply chains has taken center stage due to some recent damaging and high-profile supply chain attacks.
In developing the Framework, NIST wanted to ensure maximum flexibility of application. The final document is industry- and technology-neutral. It encompasses hundreds of standards. It is also international in scope.
NIST stresses that the Framework is not intended to replace any organization's existing cybersecurity program but is a tool to strengthen existing practices. Suppose an organization does not have a cybersecurity risk management program or set of cybersecurity practices in place? In that case, the Framework should serve as a good starting point for developing that program or those practices.
FRAMEWORK BASED ON RISK MANAGEMENT
NIST premised the entire Framework on the concept of risk management, which is "the ongoing process of identifying, assessing, and responding to risk," an approach that provides a dynamic implementation of the Framework's recommendations. Under a risk management approach, "organizations may choose to handle risk in different ways, including mitigating the risk, transferring the risk, avoiding the risk, or accepting the risk, depending on the potential impact to the delivery of critical services."5
The Framework consists of three parts: The Framework Core, the Framework Implementation, and the Framework Profile Tiers. The purpose of these three parts is to provide a "common language" that all organizations can use to understand, manage, and communicate their cybersecurity initiatives, both internally and externally, and can scale down or up to various parts of an organization as needed.
THE FRAMEWORK CORE
The Framework Core is a set of activities aimed at organizing cybersecurity initiatives to achieve specific outcomes. The Core has five functions: Identify, Protect, Detect, Respond, and Recover (Figure 0.1).
Figure 0.1 NIST CORE FRAMEWORK.
Within each of these functions are categories of activities. Within each category of activities are subcategories, and for each subcategory, there are informative references, usually standards, for helping to support the activities (Figure 0.2).
Figure 0.2 NIST CATEGORIES, SUBCATEGORIES, AND INFORMATIVE REFERENCES.
For example, one category under the function Identify is Asset Management (Figure 0.3). A subcategory of Asset Management is "Physical devices and systems within the organization are inventoried." For that subcategory, the Framework offers informative references that guide physical devices' inventory, mostly standards established by various technical standards-setting bodies. The complete listing of the Functions, Categories, Subcategories, and Informative References are in Appendix A of the final Framework Document on the NIST website.6
Figure 0.3 NIST FUNCTIONS AND CATEGORIES.
Although some organizations find the Framework Core, Categories, and Subcategories to be daunting, NIST intends them to be resources from which certain elements can be selected or examined, or used depending on the organization's unique configuration. NIST does not intend it to serve as a checklist of required activities. Nor are the Functions "intended to form a serial path, or lead to a static desired end state."
FRAMEWORK IMPLEMENTATION TIERS
The Framework Implementation Tiers consist of four levels of "how an organization views cybersecurity risk and the processes in place to manage that risk." Although the levels are progressive in terms of rigor and sophistication from Tier 1 (partial) to Tier 4 (Adaptive), they are not "maturity" levels in terms of cybersecurity approaches. NIST based successful implementation on the outcomes described in the organization's Target Profiles (see the next section) rather than a progression from Tier 1 to Tier 4.
The final Framework document describes the implementation tiers in more detail, but the following is a summary of the four tiers, modified from NIST's description (Figure 0.4):
- Tier 1: Partial - Risk is managed in an ad hoc and sometimes reactive manner. There is limited awareness of cybersecurity risk at the organizational level with no organization-wide approach to cybersecurity. The organization may not have the processes in place to participate in coordination or collaboration with other entities.
- Tier 2: Risk-Informed - Management approves risk management practices, but they may not be an organization-wide policy. There is awareness of cybersecurity risk at the organization level. Still, an organization-wide approach has not been established, and the organization understands the broader ecosystem but has not formalized its participation in it.
- Tier 3: Repeatable - The organization's risk management practices are approved and formally adopted as policy. There is an organization-wide approach to risk management. The organization collaborates with and receives information from partners in the wider ecosystem.
- Tier 4: Adaptive - The organization...
