On February 12, 2013, Executive Order 13636, “Improving Critical Infrastructure Cybersecurity,” was signed by President Obama. The goal of this Executive Order was to increase the level of core capabilities for our critical infrastructure to manage cyber risk. Executive Order 13636 has three main components:
- Information Sharing
- Privacy
- Adoption of cybersecurity practices.
The National Institute for Standards and Technology (NIST) was responsible for developing a Cybersecurity Framework to help drive better adoption of cybersecurity practices. NIST published Version 1.0 in 2014 and later made available Version 1.1 in 2018. The Framework allows businesses and other organizations to assess their risk and adopt risk controls.
The NIST Cybersecurity Framework has five core functions, and those functions are subdivided into a total of 23 “categories.” Each category contains subcategories, for a total of 108 subcategories. The Core Functions are as follows:
- Identify: Create the appropriate governance and identify information assets and risks.
- Protect: Put in place the preventive controls to stop a security event from happening.
- Detect: Putting in place the capabilities to detect a security event within an organization.
- Respond: Having the processes in place to take the appropriate actions in a security event.
- Recover: Having processes and procedures in place to restore services, communicate with stakeholders and make future improvements.
Applying the NIST Cybersecurity Framework
Most smaller to medium organizations may not have a formal Information Security program, so taking on the NIST Cybersecurity Framework can be a daunting task. The Cybersecurity Framework was intentionally created broadly so it could be adapted to many types of organizations. But this makes it challenging for some organizations to know where to start and what types of technology to use to align with the Framework.
Identify
The Identity function is focused on developing the necessary security capabilities. The goal is to identify risk, assets, and capabilities.
| IDENTIFY (ID) | Asset Management (ID.AM): The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization’s risk strategy. | Recommendation:
|
|
Technology:
|
|||
|
Business Environment (ID.BE): The organization’s mission, objectives, stakeholders, and activities are understood and prioritized; this information is used to inform cybersecurity roles, responsibilities, and risk management decisions. |
Recommendation:
|
||
Technology:
|
|||
| Governance (ID.GV): The policies, procedures, and processes to manage and monitor the organization’s regulatory, legal, risk, environmental, and operational requirements are understood and inform the management of cybersecurity risk. | Recommendations:
|
||
Technology
|
|||
| Risk Assessment (ID.RA): The organization understands the cybersecurity risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals. | Recommendations:
|
||
Technology:
|
|||
| Risk Management Strategy (ID.RM): The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support operational risk decisions. | Recommendations:
|
||
| Supply Chain Risk Management (ID.SC): The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support risk decisions associated with managing supply chain risk. The organization has established and implemented the processes to identify, assess and manage supply chain risks. |
Recommendations:
|
||
Technology:
|
|||
Protect
The Protect function is focused on taking proactive steps to prevent a security event from occurring.
| PROTECT (PR)availability | Identity Management, Authentication and Access Control (PR.AC): Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions. | Recommendations:
|
Technology:
|
||
| Awareness and Training (PR.AT): The organization’s personnel and partners are provided cybersecurity awareness education and are trained to perform their cybersecurity-related duties and responsibilities consistent with related policies, procedures, and agreements. | Recommendations:
|
|
Technology:
|
||
| Data Security (PR.DS): Information and records (data) are managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information. | Recommendations:
|
|
Technology:
|
||
| Information Protection Processes and Procedures (PR.IP): Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets. | Recommendations:
|
|
Technology:
|
||
| Maintenance (PR.MA): Maintenance and repairs of industrial control and information system components are performed consistent with policies and procedures. | Recommendations:
|
|
| Protective Technology (PR.PT): Technical security solutions are managed to ensure the security and resilience of systems and assets, consistent with related policies, procedures, and agreements. | Recommendations:
|
|
Detection
The Detection Function is centered around developing the capabilities to detect a cyber security event.
| DETECT (DE) | Anomalies and Events (DE.AE): Anomalous activity is detected and the potential impact of events is understood. | Recommendations:
|
Technology:
|
||
| Detection Processes (DE.DP): Detection processes and procedures are maintained and tested to ensure awareness of anomalous events. | Recommendations:
|
|
Technology
|
||
Respond
The Respond function is focused on containing, analyzing, and communicating the security incident.
| RESPOND (RS) | Response Planning (RS.RP): Response processes and procedures are executed and maintained, to ensure response to detected cybersecurity incidents. | Recommendations:
|
| Communications (RS.CO): Response activities are coordinated with internal and external stakeholders (e.g. external support from law enforcement agencies). | Recommendations:
|
|
| Analysis (RS.AN): Analysis is conducted to ensure effective response and support recovery activities. | Recommendations:
|
|
| Mitigation (RS.MI): Activities are performed to prevent expansion of an event, mitigate its effects, and resolve the incident. | Recommendations:
|
|
Technologies:
|
||
| Improvements (RS.IM): Organizational response activities are improved by incorporating lessons learned from current and previous detection/response activities. | Recommendations:
|
|
Recover
The Recovery function is focused on maintaining and improving normal operations, as well as improving incident response plans.
| RECOVER (RC) | Recovery Planning (RC.RP): Recovery processes and procedures are executed and maintained to ensure restoration of systems or assets affected by cybersecurity incidents. | Recommendations:
|
| Improvements (RC.IM): Recovery planning and processes are improved by incorporating lessons learned into future activities. | Recommendations:
|
|
| Communications (RC.CO): Restoration activities are coordinated with internal and external parties (e.g. coordinating centers, Internet Service Providers, owners of attacking systems, victims, other CSIRTs, and vendors). | Recommendations:
|
|