Instructor: In this lesson, 2 2
we're going to discuss industry frameworks 3 3
that you may come across in the cybersecurity industry. 4 4
This includes PCI DSS, 5 5
CIS, OWASP, ISO 27000 and OSS TMM. 6 6
First we have PCI DSS, also known as 7 7
the Payment Card Industry Digital Security Standard. 8 8
Now the Payment Card Industry Data Security Standard 9 9
is a set of security standards created by 10 10
major credit card companies 11 11
to help protect the sensitive payment card information 12 12
from fraud and data breaches. 13 13
This standard applies to all organizations 14 14
that process, store or transmit payment card information 15 15
and is designed to ensure that these organizations 16 16
maintain a secure environment 17 17
to protect cardholder data. 18 18
The PCI DSS standard is divided into six main categories 19 19
or control objectives. 20 20
First, build and maintain a secure network. 21 21
This means that organizations must maintain 22 22
a firewall configuration to better protect cardholder data 23 23
and regularly update and test their security systems. 24 24
Second, protect cardholder data. 25 25
Organizations must protect stored cardholder data 26 26
and encrypt transmission of cardholder data 27 27
across open, public networks. 28 28
Third, maintain a vulnerability management program. 29 29
Organizations have to use antivirus software, 30 30
regularly update their security systems 31 31
and implement vulnerability scanning and patching 32 32
within their organization. 33 33
Fourth, implement strong access control measures. 34 34
Organizations have to limit access to cardholder data 35 35
to only those who need it 36 36
and regularly monitor and test access control systems 37 37
to ensure nobody's accessing it 38 38
that shouldn't be accessing it. 39 39
Fifth, regularly monitor and test networks. 40 40
Organizations have to track and monitor all access 41 41
to network resources and cardholder data, 42 42
as well as regularly test their security systems 43 43
and processes. 44 44
This includes doing vulnerability scanning 45 45
as well as doing penetration testing. 46 46
Sixth, maintain an information security policy. 47 47
Organizations must maintain a policy 48 48
that addresses information security 49 49
and ensures that all employees are aware of 50 50
and understand this policy. 51 51
Now compliance with the PCI DSS standard 52 52
is considered mandatory for all organizations 53 53
that process, store or transmit payment card information. 54 54
Now when I talk about payment card information, 55 55
I'm really talking about things like credit cards 56 56
and debit cards here. 57 57
Organizations also have to be audited 58 58
by a qualified security assessor, 59 59
known as a QSA and pass regular security screens 60 60
to ensure compliance with the PCI DSS standard. 61 61
In addition to all of this, 62 62
organizations also have to maintain documentation 63 63
and evidence of compliance with the standard 64 64
and make it available to credit card companies upon request 65 65
as part of traditional audits. 66 66
Now cybersecurity analysts are going to play 67 67
a critical role in helping organizations comply 68 68
with the PCI DSS standard. 69 69
As a cybersecurity analyst, 70 70
you're going to be responsible for analyzing 71 71
the organization's security systems 72 72
and identifying vulnerabilities that could compromise 73 73
any cardholder data they're processing. 74 74
You're also going to be responsible 75 75
for helping to implement the control objectives 76 76
of the standard such as configuring your firewalls, 77 77
encrypting the data 78 78
and implementing strong access control measures. 79 79
In addition to all of that, 80 80
as a cybersecurity analyst, 81 81
you're also responsible for monitoring 82 82
and testing the organization's security systems, 83 83
to ensure that they're functioning properly 84 84
and that any vulnerabilities are identified and addressed 85 85
in a timely manner. 86 86
Now one of the most critical aspects 87 87
for a cybersecurity analyst 88 88
who's working with PCI DSS is to ensure 89 89
that the security controls are being implemented correctly 90 90
and are tested regularly. 91 91
This includes ensuring 92 92
that regular vulnerability scans are being performed 93 93
and those vulnerabilities are tracked 94 94
and properly patched and remediated. 95 95
Compliance with the PCI DSS standard 96 96
is also considered an ongoing process 97 97
and as a cybersecurity analyst, 98 98
you have to stay up to date on the late security threats 99 99
and technologies 100 100
to ensure your organization's security systems 101 101
continue to meet the PCI DSS standard. 102 102
Now whenever you hear PCI DSS, 103 103
I want you to remember, 104 104
this has to do with credit cards 105 105
and sensitive cardholder data 106 106
that has to be protected. 107 107
Second, we're going to cover CIS 108 108
or the Center for Internet Security. 109 109
Now CIS, or the Center for Internet Security 110 110
is a nonprofit organization 111 111
that provides a set of best practice guidelines 112 112
and security controls for organizations to utilize 113 113
in order to secure their IT systems. 114 114
Now CIS controls are a set 115 115
of 20 different security controls 116 116
that are organized into three categories. 117 117
These are basic, foundational and organizational. 118 118
The basic controls are the first line of defense 119 119
and they include things like inventorying your hardware 120 120
and software and maintaining an incident response plan. 121 121
The foundational controls are going to build 122 122
on those basic controls 123 123
and they include activities 124 124
such as configuring security settings and devices 125 125
and applying security updates. 126 126
The organizational controls are the final layer of defense 127 127
and they include items such as implementing 128 128
security training programs 129 129
and conducting regular risk assessments. 130 130
Now the Center for Internet Security's controls 131 131
are going to be used by cybersecurity analysts like you, 132 132
to provide a framework for identifying 133 133
and addressing potential security risks 134 134
within your organization. 135 135
This is a structured approach to security 136 136
and allows analysts to evaluate 137 137
the organization's current security posture 138 138
and identify areas that need improvement. 139 139
The controls are going to be designed 140 140
to easily be understood and implemented, 141 141
and they can be tailored to fit specific needs 142 142
of your organization. 143 143
By utilizing the CIS controls, 144 144
a cybersecurity analyst can better understand 145 145
the organization's current security posture, 146 146
develop a security strategy 147 147
and implement security controls 148 148
to mitigate potential risks. 149 149
Now one of the main benefits of using the CIS controls 150 150
is that they have been developed and tested 151 151
by security experts from a variety of different industries. 152 152
Including the government, healthcare and finance. 153 153
As a result, the controls have been proven to be effective 154 154
in identifying and mitigating security risks 155 155
in a variety of different types of organizations. 156 156
They're also widely recognized 157 157
as one of the sets of best practices 158 158
in the field of cybersecurity and they are supported 159 159
by various government agencies 160 160
and private sector organizations. 161 161
So, you may find that you're using the CIS controls 162 162
in your own organization too. 163 163
Now when you're analyzing your CIS controls, 164 164
you're trying to determine your current security posture 165 165
and then evaluate your adherence to those controls. 166 166
This allows you to compare the organization's practices 167 167
and procedures to the recommended CIS controls 168 168
and determine whether or not your internal processes 169 169
are adequate. 170 170
Based on your evaluation, 171 171
you can then develop a security strategy 172 172
that's tailored to your specific organizational needs 173 173
and addresses the vulnerabilities you've identified. 174 174
Now once you've developed your security strategy, 175 175
you're then going to begin implementing security controls 176 176
to mitigate the potential risks you've identified. 177 177
This may include making recommended changes 178 178
to your organization's existing security practices 179 179
and procedures, 180 180
or you may implement new security controls 181 181
in addition to what you're already doing. 182 182
For example, an analyst might recommend 183 183
that an organization implements a firewall 184 184
to protect its network from unauthorized access 185 185
or you might want to encrypt your data 186 186
to protect it from being intercepted 187 187
by unauthorized parties. 188 188
The implementation of these controls 189 189
is an ongoing process and you as an analyst 190 190
are going to need to monitor and evaluate them 191 191
to ensure they're continually being effective 192 192
in protecting your organization's systems. 193 193
Now the third thing we need to talk about OWASP 194 194
which is said as O-WASP 195 195
or the Open Web Application Security Project. 196 196
Now OWASP is a nonprofit organization 197 197
that aims to promote and improve web application security. 198 198
One of the ways it does this 199 199
is providing a set of guidelines, 200 200
tools and best practices for secure software development. 201 201
These guidelines are known as the OWASP top 10 202 202
and they're designed to help organizations identify 203 203
and mitigate 204 204
the most critical web application security risks. 205 205
The OWASP top 10 is a list 206 206
of the 10 most critical web application security risks 207 207
as identified by the OWASP organization. 208 208
Now this list is updated every three years 209 209
and it was updated in 2017 and 2021 and again in 2024. 210 210
Now even though it is updated every three years, 211 211
based on the current state of web application security, 212 212
I can tell you that in general, 213 213
about 90% of it doesn't change from year to year 214 214
because most of these things 215 215
are the same things we've been dealing with 216 216
for lots and lots of years. 217 217
Let's take a look at a couple of these. 218 218
Injection attacks, 219 219
broken authentication and session management, 220 220
cross-site scripting, broken access control, 221 221
security misconfiguration, sensitive data exposure, 222 222
insufficient cryptography, 223 223
insufficient security testing, 224 224
improper error handling, lack of infrastructure security, 225 225
all of these are things that are very generic in nature 226 226
and that's why it doesn't change much from year to year. 227 227
Now as a cybersecurity analyst, 228 228
you play a critical role in helping your organization 229 229
address all these different risks. 230 230
These are things 231 231
that we're going to be responsible for analyzing 232 232
to ensure that our organization's 233 233
custom-built web applications 234 234
aren't vulnerable to these types of attacks. 235 235
As a cybersecurity analyst, 236 236
you're also going to be responsible to help implement controls 237 237
to mitigate all of these risks. 238 238
For instance, you'll want to make sure you're doing things 239 239
like input validation, encryption, access control, 240 240
implementing web application firewalls and things like that. 241 241
In addition to all of that, 242 242
a cybersecurity analyst is also responsible 243 243
for monitoring and testing web applications 244 244
to ensure that the vulnerabilities that were identified 245 245
are addressed in a timely manner. 246 246
They're also going to make sure 247 247
we're ensuring the web application security 248 248
is considered throughout 249 249
the entire software development life cycle, 250 250
known as the SDLC. 251 251
Another important aspect for a cybersecurity analyst 252 252
working with OWASP, 253 253
is it ensure that they are aware 254 254
of all of the latest vulnerabilities 255 255
and attack trends because this helps you to identify 256 256
potential threats and come up with a strategy 257 257
to prevent those threats from being realized 258 258
in your organization. 259 259
Security testing and penetration testing 260 260
are also critical roles to help an analyst identify 261 261
those vulnerabilities and then track them 262 262
until they're fully remediated. 263 263
Now fourth, we have ISO 27000. 264 264
Now the ISO 27000 series of standards 265 265
was created 266 266
by the International Organization for Standardization, 267 267
known as ISO and it's used to provide 268 268
a framework for managing information security. 269 269
This standard provides guidelines and general practices 270 270
for initiating, implementing, 271 271
maintaining and improving information security management 272 272
within your organization. 273 273
It also is used to provide a set of best practices 274 274
for establishing and maintaining 275 275
and information security management system. 276 276
Now the main standard inside the ISO 27000 family 277 277
is called the ISO/IEC 27001. 278 278
And this is a standard that specifies the requirements 279 279
for an information security management system 280 280
and it's designed to be used in conjunction 281 281
with other standards inside that ISO 27000 series. 282 282
Such as the ISO/IEC 27002 283 283
which provides a code of practice 284 284
for information security management. 285 285
Now the ISO/IEC 27001 specifies the requirements 286 286
for an information security management system 287 287
in three main areas. 288 288
Policies, procedures and responsibilities 289 289
and organizational structure and management. 290 290
Now organizations are required 291 291
to establish a set of policies 292 292
that outline the objectives and principles 293 293
of their information security management system. 294 294
Then, they need to define the roles and responsibilities 295 295
of those involved in the system and finally, 296 296
they need to describe the procedures 297 297
that must be followed to implement 298 298
and maintain that system. 299 299
This standard also requires organizations to implement 300 300
a set of controls to protect their information assets. 301 301
These controls are divided into two main categories, 302 302
technical and organizational. 303 303
Now technical controls include measures such as encryption 304 304
and firewalls, 305 305
while organizational controls include measures 306 306
such as access controls and incident management. 307 307
Now one of the most important aspects 308 308
that you as a cybersecurity analyst may be working with 309 309
inside of the ISO 2700 is to ensure 310 310
that the organization has 311 311
a robust incident management process in place 312 312
and this ensures that in case of a security incident, 313 313
your organization is going to be able to identify, 314 314
contain and recover from it 315 315
in a timely and effective manner. 316 316
Now compliance with the ISO 27000 series 317 317
does require organizations to keep 318 318
a lot of documentation which can be used 319 319
to show evidence of compliance during an audit. 320 320
Cybersecurity analysts will also need to work 321 321
with other departments to ensure they can meet 322 322
any of those compliance requirements 323 323
and document that you're following 324 324
those compliance requirements. 325 325
Our fifth framework we're going to cover is the OSS TMM 326 326
or the Open Source Software Testing Maturity Model. 327 327
Now the Open Source Software Testing Maturity Model 328 328
is a framework for evaluating 329 329
and improving the quality of open source software 330 330
and its testing processes. 331 331
This was developed by OWASP, 332 332
the Open Web Application Security Project 333 333
and it provides a set of best practices 334 334
for testing open source software 335 335
for security vulnerabilities. 336 336
Now the Open Source Software 337 337
Testing Maturity Model framework 338 338
is designed to help organizations understand 339 339
their current level of open source software testing maturity 340 340
and to identify areas 341 341
where they can improve their testing processes. 342 342
The framework defines five levels of testing maturity, 343 343
each with its own set of goals and best practices. 344 344
These levels are initial, managed, defined, 345 345
quantitatively managed and optimizing. 346 346
Initial means that the organization 347 347
is just starting to use the open source software 348 348
and has no established testing processes in place. 349 349
Managed means the organization has established 350 350
basic testing processes for the open source software 351 351
but they're not yet formalized 352 352
or fully integrated into their development processes. 353 353
Defined means that the organization 354 354
has formalized testing processes for open source software 355 355
that are integrated into the development process 356 356
but they're not yet consistently applied. 357 357
Quantitatively managed 358 358
means the organization consistently applies 359 359
formalized testing processes for open source software 360 360
and uses metrics to measure the effectiveness 361 361
of that testing process and finally, optimizing. 362 362
This means that organization continually improves 363 363
its open source software testing processes 364 364
based on metrics and other data. 365 365
Now as a cybersecurity analyst, 366 366
your job here is to help organizations reach higher levels 367 367
of open source software testing maturity. 368 368
We're responsible for analyzing 369 369
the organization's open source software testing process 370 370
and identifying areas where improvements could be made. 371 371
You'll also be responsible to help implement 372 372
the best practices outlined 373 373
in the open source software testing maturity model framework 374 374
such as formalizing testing processes, 375 375
integrating testing into the development process 376 376
and using metrics to measure the effectiveness 377 377
of the testing process. 378 378
In addition to all of that, 379 379
you'll also be responsible for monitoring 380 380
and testing open source software 381 381
to ensure that vulnerabilities are identified 382 382
and addressed in a timely manner. 383 383
Now the open source software 384 384
testing maturity model framework is really important 385 385
for cybersecurity analysts because it provides us 386 386
with a clear set of goals and best practices 387 387
for testing this open source software 388 388
for different security vulnerabilities. 389 389
By following the framework, 390 390
we can ensure that our organizations 391 391
are applying best practices for software testing 392 392
and if they're identifying and mitigating vulnerabilities 393 393
in a more timely manner. 394 394
This is really important, 395 395
given the rapid growing use of open source software 396 396
in many of our organizations. 397 397
With the increasing reliance on open source software, 398 398
organizations can be exposed 399 399
to more risks and vulnerabilities 400 400
and so the open source software 401 401
testing maturity model framework 402 402
is going to help our organizations 403 403
to test their open source software libraries 404 404
for more vulnerabilities and then validate the software 405 405
is secure for usage inside of our organizations. 406 406
Now I know that was a lot of information we just discussed 407 407
about the five different industry frameworks 408 408
including PCI DSS, CIS, OWASP, ISO 27000 409 409
and the OSS TMM frameworks. 410 410
Now for the exam, 411 411
you do not need to know 412 412
these five industry frameworks in depth, 413 413
but you should be aware of the basics for each one 414 414
and how they're related to 415 415
your vulnerability management program 416 416
inside of an organization.