Jason: Risk-Based Frameworks. 2 2
Now, the other type of framework we have 3 3
is what's known as a risk-based framework. 4 4
When we're dealing with a prescriptive framework 5 5
like we talked about in the last lesson, 6 6
this can actually make it more difficult for us 7 7
because the framework can't keep pace 8 8
with continually evolving threat landscapes. 9 9
Prescriptive frameworks tend to be very matter-of-fact 10 10
and very checklist-driven, 11 11
and so we may start doing things 12 12
to be able to meet those prescriptive frameworks, 13 13
that doesn't really help us in the real world. 14 14
Let me give you an example of this. 15 15
You might have a prescriptive framework that says, 16 16
"You need to have ongoing monitoring done through a SIEM." 17 17
And you think, "Well, that's a great thing, right, Jason?" 18 18
And I would agree, having a SIEM is a good thing, 19 19
but if we start putting everything into the SIEM, 20 20
we can create a situation where the SIEM starts raising 21 21
hundreds of alerts every day, 22 22
and that can start overwhelming our analysts 23 23
because a lot of those might be false positives. 24 24
That would be a big issue for us. 25 25
And if we're only doing it 26 26
to meet the prescriptive framework requirements, 27 27
and not doing it because we have a real risk 28 28
that we're trying to address with that SIEM, 29 29
then we're wasting our time. 30 30
And so, we want to be thinking about these things 31 31
as we're figuring out, 32 32
"Is this going to be something we're doing 33 33
because we're told to because it's prescriptive? 34 34
Or, are we doing it based on a risk that really exists?" 35 35
Well, when we deal with a risk-based framework 36 36
we are dealing with a framework that uses risk assessment 37 37
to prioritize security control selection and investment. 38 38
So maybe having that SIEM is a good thing, maybe it's not, 39 39
but we'll be able to make an intelligent decision, 40 40
and not do it just because we're being told to. 41 41
Now, all of this comes down to regulatory compliance, right? 42 42
When we're dealing with regulatory compliance, 43 43
we are told things that we must do. 44 44
So those things are going to be falling 45 45
much more in the prescriptive category. 46 46
If I'm running an organization and HIPAA says, 47 47
"You must have a SIEM," then I better have a SIEM, right? 48 48
Because I need to be within the constraints of that law. 49 49
But if I'm not barred into this regulatory compliance 50 50
because I'm an organization 51 51
that doesn't fall into one of those categories, 52 52
then it's much better to use a risk-based framework. 53 53
By using a risk-based framework, 54 54
this can allow businesses 55 55
to develop their own way of doing things 56 56
while minimizing risk. 57 57
In my organization, 58 58
we don't have a lot of regulatory compliance requirements. 59 59
The only ones we really have is PCI DSS 60 60
for our credit card payments. 61 61
Everything else, we can really do 62 62
under a risk-based framework, 63 63
and that is what we do. 64 64
We think about what risks exist 65 65
and then we put mitigations in place 66 66
based on the prioritization to help us meet our needs. 67 67
Now, one of the best ways to do this 68 68
is by using something known as 69 69
the NIST Cybersecurity Framework. 70 70
This is a relatively new framework 71 71
that's come out in the last couple of years. 72 72
The NIST Cybersecurity Framework is a risk-based framework 73 73
that's focused on IT security over IT service provisioning, 74 74
and this framework covers three core areas. 75 75
There's the framework core, the implementation tiers, 76 76
and the framework profiles. 77 77
Now, when we talk about the framework core, 78 78
this is going to identify the five cybersecurity functions, 79 79
which are, identify, protect, detect, respond, and recover. 80 80
And then for each of these five functions, 81 81
they can then be divided into categories and subcategories. 82 82
This makes up the core of the framework, 83 83
and it gives you lots of different controls 84 84
that you can pick from under these five categories. 85 85
When we look at the implementation tiers, 86 86
this is going to assess how closely those core functions, 87 87
those five areas 88 88
are integrated into the organization's 89 89
overall risk management process. 90 90
And for each of those tiers, 91 91
they're going to be categorized 92 92
as partial, risk-informed, repeatable, or adaptive. 93 93
Now, if you're partial, that's low on the scale. 94 94
If you're adaptive, that's very high on the scale, 95 95
and so you want to try to get higher on the scale 96 96
as you start getting more and more of this 97 97
integrated into your organization 98 98
and the way you do business. 99 99
And then the final thing we're going to look at 100 100
is our framework profiles. 101 101
These are used to supply statements 102 102
of current cybersecurity outcomes 103 103
and target cybersecurity outcomes 104 104
to identify investments that will be the most productive 105 105
in closing the gap in cybersecurity capabilities, 106 106
shown by the comparison 107 107
of the current and the target profiles. 108 108
Now, that is a lot of words to say this. 109 109
Essentially, you want to look at your organization, 110 110
and you want to capture a baseline 111 111
of where you are in terms of the framework right now. 112 112
Are you at a very high quality or low quality? 113 113
Now, if you're at a low quality, 114 114
and you want to get to a high quality, 115 115
that is your target cybersecurity outcome. 116 116
You want to be at this higher level, 117 117
so what things do you need to do? 118 118
You can identify those things based on the profiles 119 119
so you can then start adding those things over time 120 120
and getting your organization to that higher level. 121 121
That's the idea here. 122 122
And again, all of this is risk-informed. 123 123
This is a risk-based framework 124 124
when you're dealing with the NIST Cybersecurity Framework.