Instructor: Prescriptive frameworks. 2 2
In the last lesson, we brought up the concept 3 3
of a framework and how it fits 4 4
inside the world of IT governance and IT service management. 5 5
In this lesson, 6 6
we're going to focus specifically on prescriptive frameworks. 7 7
Now, when I talk about a prescriptive framework, 8 8
this is a framework that stipulates 9 9
control selection and deployment. 10 10
This is something that is going to be mandatory. 11 11
That's why it is prescriptive. 12 12
A lot of times when you see prescriptive frameworks, 13 13
they're going to be driven by regulatory compliance. 14 14
As I mentioned in the last lesson, 15 15
if you're a healthcare provider 16 16
you're going to be focused on meeting the requirements 17 17
for regulatory compliance of HIPAA, and, therefore, 18 18
you might want to use a prescriptive framework 19 19
to help you meet that. 20 20
Now, there are lots of different frameworks out there. 21 21
As I mentioned before, for instance, 22 22
we have ITIL and COBIT and ISO 27001, 23 23
which is an information security framework, or PCI DSS. 24 24
Now, all of these different frameworks could be chosen, 25 25
depending on what your needs are, and, again, 26 26
that's going to go back to your IT governance structure. 27 27
Depending on which one you're using, 28 28
that's going to have different requirements that you, 29 29
as a cybersecurity analyst, are going to have to fill. 30 30
For the exam, you don't need to know the specifics of that, 31 31
but in the real world, if your company is using 32 32
one of these frameworks, 33 33
you want to start learning about it so you can make sure 34 34
that you're meeting the requirements 35 35
of that framework inside 36 36
of the prescriptive framework itself. 37 37
Now, inside of these frameworks, 38 38
we often use what's known as a maturity model. 39 39
Now, a maturity model is a component 40 40
of an enterprise security architecture framework 41 41
that's used to assess the formality 42 42
and optimization of security, control selection and usage 43 43
and it addresses any gaps that you may have. 44 44
Essentially, we're going to take our organization 45 45
and we're going to do a baseline to figure out where we are 46 46
and then we can place it onto this maturity model 47 47
and say we're a level one, two, three, four 48 48
or five organization 49 49
and if we want to get to a higher level, 50 50
there are certain things we have to do. 51 51
Now, when we start out with a maturity model, 52 52
generally, most organizations start at tier one, 53 53
and this is a very reactive posture. 54 54
Now, what we want to do is get 55 55
out of this reactive mode 56 56
where we're not firefighting all the time. 57 57
If you ever worked in a new company, 58 58
and they're very immature, things are just happening 59 59
and you're reacting to them as they're happening. 60 60
You're not ever getting ahead of the game. 61 61
What we want to do is move ourself from this reactive posture 62 62
into a proactive posture, and as you go 63 63
up the maturity model scale, you'll get more 64 64
and more proactive. 65 65
One of the most common models looks something like this. 66 66
This is a five-tier approach, and we're going to start 67 67
at level one. 68 68
Level one is our initial maturity. 69 69
This is where we first start out, and this is where 70 70
we are highly reactive in nature. 71 71
Then as we get a little bit more mature, we become managed. 72 72
This is level two, and in level two, we're going to prepare 73 73
to mitigate through risk assessments to be able to figure 74 74
out what risks are out there, and we can try 75 75
to get ahead of the game at least a little bit. 76 76
Once we get into level three, we start being defined. 77 77
Now, this is where we have defined policies and procedures 78 78
for lots of different things across our organization, 79 79
but we're still not perfect. 80 80
We're still reacting a lot of the time. 81 81
When we get into level four, 82 82
we're starting to do quantitative management here. 83 83
This is where we have management oversight 84 84
of all of our risks. 85 85
We've captured them in our risk register, 86 86
we know what risks exist 87 87
and we know what we're going to do to fix those things, 88 88
but, again, there are still some things that pop up 89 89
that we didn't think of, 90 90
so we're still only a level four organization. 91 91
Once we get to level five, this is where we're optimizing. 92 92
We are fully proactive at this point. 93 93
We're using risk-driven approaches to figure out 94 94
what type of risk exists and what we can do about 'em. 95 95
We are completely being proactive here 96 96
and trying to stop all risks that we can 97 97
and mitigate them down to an acceptable level. 98 98
Now, when you look at these maturity models, 99 99
they're going to help you review your organization 100 100
against the expected goals 101 101
for that level of organization that you want to meet. 102 102
This will help you determine the level of risk 103 103
that the organization is exposed to based on those goals. 104 104
If you're a level five, that means you're exposed 105 105
to less risk than if you're a level one. 106 106
Now, does that mean that we all want to be level fives? 107 107
Well, no. 108 108
You may not need to be a level five organization. 109 109
This again goes back to your IT governance. 110 110
What is our risk appetite that our shareholders 111 111
and stakeholders have developed for us in terms of risk? 112 112
In my organization, we usually aim 113 113
for a level three or a level four. 114 114
We don't need to be fully proactive 115 115
because the cost associated with doing that is so excessive 116 116
that it doesn't make sense for our business model. 117 117
But, if we're at a level three or a level four, 118 118
that's good enough to be able to keep a lot of the risk 119 119
down to a low enough level that we can accept the risk based 120 120
on our risk appetite.