The Cybersecurity Framework Jerry Beasley, CISM Security Services Manager Presented to NASCUS/CUNA Cybersecurity Symposium 2017

Overview Today’s session will explore: The Threat Landscape Defense Strategies Defense Frameworks Implementing the NIST Cybersecurity Framework

Threat Landscape Threat Landscape Attacks ARE increasing: According to Symantec’s 2016 Internet Security Threat Report: 42% increase in targeted attacks 5,585 new vulnerabilities discovered 55% increase in phishing campaigns 415 new vulnerabilities on mobile operating systems 54 zero-day vulnerabilities (up 125%) – no warning before exploit 43% of targeted attacks aimed at businesses with < 250 employees 3

Threat Landscape Threat Landscape Cyber Crime is Growing: Attack distribution for 2015/16 (as reported by hackmageddon.com): 4

Threat Landscape Threat Landscape Cybercrime costs the global economy up to US$575 billion annually according to a recent report by BofA Merrill Lynch Global Research. Another new record was set near the end of the year when 191 million identities were exposed, surpassing the previous record for the largest single data beach. 2017 promises to easily break these records. 5

Threat Landscape Threat Landscape Does it make you “WannaCry” ? 6

What is Cybersecurity? INFORMATION SECURITY Background Cyber ~ “computer” “computer network” “virtual” In our practical application, it is synonymous with: INFORMATION SECURITY

DEFENSE STRATEGIES Information/Cyber Security Lessons Learned We cannot rely solely on firewalls and anti-malware Attack vectors are present at all layers of an organization / infrastructure Attack defenses must address all of these (Defense in Depth) Aggressive testing can help identify undiscovered weaknesses Vulnerability or Penetration Testing alone cannot prevent a breach Successful organizations have a plan and establish a framework

DEFENSE STRATEGIES Defense in Depth An information assurance concept in which multiple layers of security controls (defense) are placed throughout an IT system The strategy is to provide redundancy so that if one layer of defense fails, another layer may thwart or further delay attacks 9

People, Policies & Procedures Defense in Depth Firewall IDS / IPS NAC Permissions HIDS Anti-malware People, Policies & Procedures Updates User Training Analogy – layers of an onion. I like this slide better than the previous – they’ll get this. DiD is an important term… Encryption Backups Physical 10

Building People, Policies, and Procedures: Existing Models DEFENSE STRATEGIES Building People, Policies, and Procedures: Existing Models NIST Risk Management Framework (SP 800-53, 800-53A) CIS 20 Critical Security Controls ISO/IEC 27001 The Cybersecurity Framework Version 1.0 /1.1 (draft) CAREFUL!!! This will open questions like “which one(s) does FP use? What do you audit against, which is best? I’d highlight that these are all guidelines to help make our jobs easier to cover everything.

NIST Risk Management Framework

CIS 20 Critical Security Controls Is a compilation of 20 critical controls providing: Controls mapped to specific attack types Specific actions that organizations are taking to implement, automate, and measure effectiveness Recommended procedures and tools to enable implementation The Critical Controls are characterized by: Increased asset accountability (hardware & software) Increased integration / automation 13

CIS 20 Critical Security Controls The Critical Controls are characterized by: Increased asset accountability (hardware & software) Increased integration / automation 14

ISO/IEC 27001/27002 Code of practice for information security controls: 15

DEFENSE STRATEGIES A National Cybersecurity Framework With executive order 13636, the President initiated the Framework for Improving Critical Infrastructure Cybersecurity A general framework for mass consumption Uses business drivers to focus efforts on the security agenda Use is voluntary, but the framework is gaining steam Flexible – not a “one size fits all” approach Founded on risk management principles

Who is part of this community? National Cybersecurity Framework Who is part of this community? Entities with a role in securing the nation’s infrastructure Members of each critical infrastructure sector perform functions that are supported by information technology (IT) and industrial control systems…”

NIST Implementation The National Institute of Standards and Technology (NIST) Implementation NIST developed the initial implementation guidance: “Framework for Improving Critical Infrastructure Cybersecurity” Also known as, “The Cybersecurity Framework” or CSF

Emphasis for adoption by FDIC, OCC, FFIEC and NCUA, others The Cybersecurity Framework Industry Adoption Emphasis for adoption by FDIC, OCC, FFIEC and NCUA, others

The Cybersecurity Framework FFIEC Cybersecurity Assessment Tool (CSAT) Management tool for evaluating framework implementation

The Cybersecurity Framework Designing your program around the NIST Cybersecurity Framework provides: A framework to implement a defense-in-depth strategy (risk reduction) An method to assure alignment with regulatory guidance (compliance)

The Cybersecurity Framework The framework aligns with the common Cybersecurity functions:

The Cybersecurity Framework The framework provides the required program elements (high-level controls).

The Cybersecurity Framework The framework introduces the concept of “Implementation Tiers” or the degree of implementation. FFIEC’s CSAT translates this concept into “Maturity Levels”

The Cybersecurity Framework The framework maps to implementation guidance

The Cybersecurity Framework A recommended starting point is the Framework Core 98 controls/practices that should be common to most organizations These will be adapted and supplemented based on your needs

The Cybersecurity Framework SO…if you’ve implemented another standard (ISO, CIS 20 Critical Controls, COBIT, etc.)… …You can still use the implementation details within the CSF.

The Cybersecurity Framework Is intended to be integrated into a Risk Management program Source: Cybersecurity Framework Version 1.0

IMPLEMENTATION STRATEGY Risk Assessment Existing Program Inventory Modeling New Program Measuring Progress Adapting Source: Cybersecurity Framework Version 1.0

IMPLEMENTATION STRATEGY Risk Assessment Determine what you are protecting Determine the type and likelihood of threats Determine if your current controls are adequate to reduce the risk Provides prioritization for control implementation Source: Cybersecurity Framework Version 1.0

IMPLEMENTATION STRATEGY Existing Program Inventory Gap Analysis CSAT provides a good program-level view and helps determine the degree of implementation required May also be derived from existing Risk or Compliance Assessments This documents “current” profile Elements of the CSF you already have in place Source: Cybersecurity Framework Version 1.0

IMPLEMENTATION STRATEGY Model New Program Translate functions into strategies Translate categories into roles / responsibilities Translate sub-categories into plans of action Establish your “target” profile Source: Cybersecurity Framework Version 1.0

IMPLEMENTATION STRATEGY Monitor & Re-assess How do you know it’s working? Risk Assessments Audit and Compliance Testing and Exercises New CSAT to determine changes in inherent risk or maturity Source: Cybersecurity Framework Version 1.0

IMPLEMENTATION STRATEGY Adapt Add to or modify the CSF core to ensure effective: Identification – knowing what you have Protection – establishing defense-in-depth Detection – awareness of cybersecurity events Response – knowing what to do when events happen Recovery – having the means to recover from events Source: Cybersecurity Framework Version 1.0

Tier 4 Tier 3 Tier 2 Tier 1 Where to go from here? Improve and optimize Identify Protect Tier 1 Tier 2 Tier 3 Tier 4 Detect IMPROVE/ADAPT Respond Recover

Innovative Advanced Intermediate Evolving Baseline Where to go from here? Improve and optimize Identify Baseline Evolving Intermediate Advanced Innovative Protect Detect IMPROVE/ADAPT Respond Recover

Summary Today we discussed: The Threat Landscape Defense Strategies The Need for Defense in Depth Defense Frameworks Common Frameworks Employing the Cybersecurity Framework

Summary QUESTIONS?

References Executive Order 13636 Improving Critical Infrastructure Cybersecurity NIST Framework for Improving Critical Infrastructure Cybersecurity https://www.nist.gov/cyberframework CIS Critical Controls for Effective Cyber Defense https://www.cisecurity.org/controls/ NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations Symantec’s 2016 Internet Security Threat Report NSA Whitepaper “Defense in Depth” http://www.nsa.gov/ia/_files/support/defenseindepth.pdf

Learn more and request a TraceCSO Demo. Questions? Clean up the “extra” slides now…. Learn more and request a TraceCSO Demo. info@tracesecurity.com