Cybersecurity Frameworks Tutorial | Cybersecurity Training | Edureka | Cybersecurity Rewind- 2

Key Takeaways

data is the most valuable asset which is the reason why data security has become an international agenda data breaches and security failures can put the world economy at risk realizing the need for the national and economic security the president of the United States issued an executive order to develop a cyber security framework to help reduce cyber risks hi folks my name is Arya and here I am with another interesting video on cyber security so first let's have a look at the agenda of today's session all right to begin with we'll see how the US government recognized the need for Reliable function to secure the national and economic infrastructure to improve critical infrastructure security next we'll discuss the importance of cyber security Frameworks and why it is required in an organization then I'll be telling you about the different types of Frameworks moving on I'll tell you about the confidence of cyber security Frameworks that make it up all and after discussing the framework I'll tell you what steps are required required to implement Frameworks in an organization finally I'll describe a common flow of information and decisions at the different levels within an organization okay so let's begin so recognizing the national and economic security of the United States depends on the reliable function of critical infrastructure the President issued executive order 13636 which is improving critical infrastructure cyber security in February 2013 the order directed nist to work with stakeholders to develop a voluntary framework based on existing standards guidelines and practices for reducing cyber risks to critical infrastructures the cyber security enhancement Act of 2014 reinforced nist's executive order 13636 rule created through collaboration between industry and government the voluntary framework consists of Standards guidelines and practices to promote the protection of critical infrastructure the prioritized flexible repeatable and cost effective approach of the framework helps owners and operators of critical infrastructure to manage cyber security related risks now according to section 7 of executive order the Secretary of Commerce shall direct the director of the National Institute of Standards and Technology to lead the development of a framework to reduce cyber risks to critical infrastructure the cyber security framework shall include a set of Standards methodologies procedures and processes that align policy business and technological approaches to address cyber risks the cyber security framework shall incorporate voluntary consensus standards and Industry best practices to the fullest extent possible now let's see why exactly do we need a cyber security framework let's tackle that question so the framework will help an organization better understand manage and reduce its cyber security risks it will assist in determining which activities are most important to assure critical operations and service is delivery in turn that will help prioritize Investments and maximize the impact of each dollar spent on cyber security it results in a shift from compliance to action and specifies outcomes by providing a Common Language to address cyber security risk management it is especially helpful in communicating inside and outside the organization that includes improving Communications awareness and among I.T planning and operating units as well as senior Executives of organizations it gives you a measure of where you are and where you need to go it can be implemented in stages or degrees which make it more appealing to business it has built-in maturity models and GAP analysis so you don't need additional maturity models on top of CSF organizations also can readily use the framework to communicate current or desired cyber security postures between a buyer or supplier now let's see what exactly is a cyber security framework the framework is voluntary guidance based on existing standards guidelines and practices for organizations to better manage and reduce cyber security risks in addition to helping organizations manage and reduce risks it was designed to Foster risk and cyber security management Communications amongst both internal and external organizational stakeholders now let's see the types of cyber security Frameworks that we have so the first type of framework is PCI DSS which stands for payment card industry and data security standards it is a set of security control required to implement protected payment account security it is designed to protect credit cards debit cards and cash card transactions the second type of framework that we have is ISO 27001 and 27002 it is the International Organization for standardization now the best practices recommendations for information security management and information security program elements are from this framework the third type of framework is CIS which stands for critical security controls a prescribed arrangement of activities for cyber protection that gives particular and noteworthy approaches to stop the present most inescapable and perilous attacks a key advantage of the controls is that they organize and Center fewer activities with high outcomes last but not least we have the nist framework now nist framework is made for improvising critical infrastructure cyber security with a goal to improve organization's Readiness for managing cyber security risk while leveraging standard methodologies and processes now out of all the Frameworks we just discussed nist is the most popular framework Mist was developed in the February of 2013 after the U.S presidential executive order it was designed to address National and economic challenges and it is supposed to be voluntary at least for private sectors now let's discuss the objectives of the framework so the cyber security Frameworks prioritized flexible and cost effective approach helps to promote the protection and resilience of critical infrastructure and other sectors important to the economy and National Security the framework was developed to be adaptable flexible and scalable by an organization also it should improve organization's readiness for managing cyber security risks the framework was designed to be flexible and Performance Based and it should be cost effective it should leverage standard and methodologies and processes and should promote technological advancement and Innovation and it should be actionable across the Enterprise focus on outcomes now let's discuss the components of the nist cyber security framework the cyber security framework consists of three main components namely the core implementation tires and profiles the framework core provides a set of desired cyber security activities and outcomes using common language that is easy to understand the core guides organizations in managing and reducing their cyber security risks in a way that is complementing an organization's existing cyber security and risk management processes next we have the framework implementation tiers which assist an organization by providing context on how an organization views cyber security risk management the tiers guide organization to consider the appropriate level of rigor for other cyber security program and are often used as a communication tool to discuss the risk appetite Mission priority and budget last but not least is the framework profiles which are in organization's unique alignment of their organizational requirements and objectives risk appetite and resources against the desired outcomes of the framework core profiles are primarily used to identify and prioritize opportunities for improving cyber security at an organization let's discuss the framework tires now the tires describe the degree to which an organization's cyber security risk management practices exhibit the characteristics defined in the framework the tires range from partial which is Time 1 to Adaptive which is Type 4 and describe an increasing degree of rigor and how well integrated cyber security risk decisions are into broader risk decisions and the degree to which an organization shares and receives cyber security information from external parties tires do not necessarily represent maturity levels organizations should determine the desired Tire Ensure wondering that the selected level meets organizational goals reduces cyber security risks to the level acceptable by the organization and is feasible to implement fiscally and otherwise next we have the core the core is a set of desired cyber security activities and outcomes organized into categories and align into informative references the framework core is designed to be intuitive and to act as a translation layer to enable communication between multi-disciplinary teams by using simplistic and non-technical language the core consists of three parts functions categories and subcategories the core includes five high-level functions which is identify protect detect respond and recover these five functions are not only applicable to cyber security risk management but also to risk management as a whole the core asks an organization to identify what processes and assets need to be protected now after assessing that you need to find what protection is available then you need to find out what techniques can identify the threats and what techniques can contain the impact of an incident and finally the core defines what techniques can restore the capabilities of the organization before the attack alright now let's dive deeper into the functions to see what these functions actually do and what purpose they serve so the functions are the highest level of abstraction included in the framework they act as the backbone of the framework core that all the other elements are organized around so the first function is identified it helps develop an organizational understanding to manage cyber security risk the systems people assets data and capabilities the activity is in the identify functions are foundational for Effective use of the framework understanding the business context the resources that support critical functions and related cyber security risks enable an organization to focus and prioritize its efforts consistent with its risk management strategy examples of outcome categories within this function include Asset Management business environment governance risk management and risk assessment now the next type is the protect function so to develop and Implement appropriate safeguards to ensure delivery of critical Services the protect function supports the ability to limit or contain the impact of a potential cyber security event example of outcome categories within this function include identify management and access control awareness and training data security information protection processes and procedures maintenance and protective technology the next kind of function is the detect function so this is used to develop and Implement appropriate activities to identify the occurrence of a cyber security event the detect function enables timely discovery of cyber security events example of outcome categories within this function includes anomalies and events security continuous monitoring and detection processes now next we have this fund function now to develop and Implement appropriate activities to take action regarding undetected cyber security incident the respond function supports the ability to contain the impact of a potential cyber security incident the outcomes category within this function includes response planning Communications analysis mitigation and improvements last but not the least we have the recover function now to develop and Implement appropriate activities to maintain plans for resilience and restore any capabilities or services that were impaired due to a cyber security incident the recovery function supports timely recovery to normal operations to reduce the impact from a cyber security incident examples of outcome categories within this function include recovery planning Improvement and Communications these five functions were selected because they represent the five primary pillars for a successful and holistic cyber security program they aid organizations in easily expressing their management of cyber security risk at a high level and and enabling risk management decisions okay now let's understand the last component of the nist framework nist recommends that the framework we customized in a way that maximizes business value and that customization is referred to as a profile profiles are an organization's unique alignment of their organizational requirements and objectives risk appetite and resources against the desired outcomes of the framework core profiles can be used to identify opportunities for improving cyber security posture by comparing a current profile with the target profile profiles are about optimizing the cyber security framework to best serve the organization the framework is voluntary so there is no right or wrong way to do it one way of approaching profiles is for an organization to map their cyber security requirements mission objectives and operating methodologies along with the current practices against the subcategories of the framework core to create a current state profile these requirements and objectives can be compared against the current operating state of the organization to gain an understanding of the gaps between the two now the following steps illustrate how an organization could use a framework to create a new cyber security program or improve on an existing program these steps should be repeated as necessary to continually improve cyber security so the first step is to prioritize unscope the organization identifies its business mission objectives and high-level organizational priorities with this information the organization makes strategic decisions regarding cyber security implementations and determines the scope of systems and assets that support the selected business line or process the framework can be adapted to support the different business lines or processes within an organization which may have different business needs and Associated risk tolerance risk tolerances may be reflected in a Target implementation deal step two is to orient yourself now once the scope of cyber security program has been determined for the business line or process the organization identifies related systems and assets regulatory requirements and overall risk approach the organization then consults sources to identify threats and vulnerabilities applicable to those systems and assets so step three is to create a current profile the organization develops a current profile by indicating which category and subcategory outcomes from the framework core are currently being achieved if an outcome is partially achieved noting this fact will help support subsequent steps by providing Baseline information the fourth step is to conduct a risk assessment this assessment could be guided by organization's overall risk management process or previous risk assessment activities the organization analyzes the operational environment in order to discern the likelihood of a cyber security event and the impact that the event could have on the organization it is important that the organization identify emerging risks and use cyber threads information from internal and external sources to gain a better understanding of the likelihood and impact of cyber security events so the fifth step is to create a Target profile the organization creates a Target profile that focuses on the assessment of the framework categories and subcategories describing the organization's desired cyber security outcomes organizations may also develop their own additional categories and subcategories to account for Unique organizational risks the organization may also consider influences and requirements of external stakeholders such as sector entities customers and business partners when creating a Target profile the target profile should appropriately reflect criteria within the target implementation tier the sixth step is to determine analyze and prioritize gaps the organization compares the current profile and the target profile to determine gaps next it creates a prioritized action plan to address gaps reflecting Mission drivers costs and benefits and risks to achieve outcomes in the target it profile the organization then determines resources including funding and Workforce necessary to address the gaps using profiles in this manner encourages the organization to make informed decisions about cyber security activities support risk management and enables the organization to perform cost-effective targeted Improvement the last step is to implement action plan the organization determines which actions to take to address the gaps if any identified in the previous step and then adjust its current cyber security practices to achieve the target profile for further Guidance the framework identifies examples informative reference regarding the categories and subcategories but organizations should determine which standards guidelines and practices including those that are sector-specific work best for their needs an organization repeats the steps as needed to continuously assess and improve its cyber security for instance organizations may find that more frequent repetition of origin step improves their quality of risk assessment furthermore organ organizations May monitor progress through iterative updates to the current profile subsequently comparing the current profile to the Target profile organizations may also use this process to align their cyber security program with their desired framework implementation deal now the framework helps guide key decision points about the risk management activities through the various levels of an organization for supporting risk management now as you can see in the picture it describes a common flow of information and decisions at the following levels within an organization the levels are executive business process and implementations or operations the executive level communicates Mission priorities available resources and overall risk tolerance to business process levels the business or process level uses the information as input into the risk management process and then collaborates with the implementation or operation level to communicate business needs and create a profile the implementation or operation level the implementation or operations level communicates the profile implementation progress to the business level the business level uses this information to perform an impact assessment next the business level management reports the outcomes of that impact assessment to the executive level to inform the organization's overall risk management process and to the implementation operation levels for awareness of business impact okay guys that was it from me for the topic of cyber security Frameworks we discussed how nist has actually changed the whole cyber security environment since it was released in the February of 2013 I hope you all learned something valuable that's it from me goodbye