[3 min. read]
by Allan Jacks, vCISO
When I started my career in the military, I wanted to do all the cool stuff I heard about from my recruiter. But then week one started into my 6-month initial training course. I was given what seemed like a mountain of books to use and reference. Many of them were published by the Combined Communications Electronics Board which prescribed standards to be used when conducting communications within member nations. For successful communication, you must speak the same language and when it came to electronic communications, it had a standard and protocol that all who were involved adhered to.
This allowed successful communications between multiple parties to occur in an orderly manner.
As an engineer, we like to have order in our world, and by following templates, rules, guidelines, and best practices, we understand what to expect when implemented correctly.
A framework is exactly that!
What is a Cyber Security Framework?
From the NIST glossary, a Framework is defined as:
“A set of cybersecurity activities and references that are common across critical infrastructure sectors and are organized around particular outcomes. The Framework Core comprises four types of elements: Functions, Categories, Subcategories, and Informative References.”
NIST developed the Cybersecurity Framework in 2014 to provide voluntary guidance for critical infrastructure organizations.
Even though this framework may have been focused on critical infrastructure organizations initially, the NIST CSF is an excellent framework to follow and protect your company’s critical infrastructure. “The framework was developed with a focus on industries vital to national and economic security, including energy, banking, communications, and the defense industrial base. It has since proven flexible enough to be adopted voluntarily by large and small companies and organizations across all industry sectors, as well as by federal, state, and local governments.”
What Does the NIST CSF do?
Every company that relies on its network and the importance of its reliability should consider its network vital to economic security. The NIST Cybersecurity Framework is a proven framework to protect their business.
NIST CSF is made up of 5 core functions: Identify, Protect, Detect, Respond and Recover. These functions provide an overview of the cyclical process for managing cybersecurity risk.
Identify
First identify what your business’s core function is, what is the mission, and why it exists. What are the core assets that make up the business that needs to be secured? These can include physical assets and people. To continue the business, what third parties do I need to continue business successfully?
Protect
Second is the protection of the components identified to ensure the availability of infrastructure services. By protection, we limit the impact of a cybersecurity event through the implementation of policies and procedures, managing the maintenance of infrastructure, and establishing data protection to protect the confidentiality, integrity, and availability of the company’s information.
Detect
The third is to allow continuous monitoring of logs that can identify any anomalies occurring within the infrastructure that may point to a cybersecurity event.
Respond
Fourth is to detail the actions to be taken in the event a cybersecurity incident occurs. Being prepared to act and knowing what action to take before it occurs will allow an ordered process to limit the damage caused. By practicing what to do, the stakeholders will be better prepared in the event of an incident.
Recover
Finally, in the event of an incident implementing planning processes to restore assets to working order, will allow quicker return to service and return to business operations. Evaluating what went wrong, what went right, and what can be improved, will allow the optimization of the processes, and reduce cybersecurity risk to the organization.
NIST Resources
Just like the Allied communications books that I read in the military, the NIST publications can be quite challenging to read. One does not just pick them up and follow from chapter one through the ending to fully secure your company’s system, though they do have a quick start guide which can be found here:
Getting Started with the NIST Cybersecurity Framework: A Quick Start Guide
With the changing cybersecurity technologies and threats, NIST is currently working on updating the NIST Cybersecurity Framework to version 2.0. Information can be found here:
Updating the NIST Cybersecurity Framework – Journey To CSF 2.0 | NIST
No company is too small to follow parts of the NIST CSF and by doing so, your company will be better prepared in the event of a cybersecurity incident.
Trust Morefield with NIST CSF
At Morefield, we can assist in providing guidance or assist you in implementing the NIST CSF Framework within your organization. Our team of experts is ready to start talking to you about your needs and goals. Contact our team now!
References
NIST Releases Version 1.1 of its Popular Cybersecurity Framework | NIST