In this lesson,
we're going to focus on selecting
infrastructure controls for our enterprise infrastructure.
Now, our networks and infrastructure security is created
by a large number of different decisions
that we have made over the years.
Each decision to install a new piece
of hardware or software,
will introduce new vulnerabilities
into our enterprise infrastructure,
but we can also strategically select different controls
to effectively mitigate the risks presented
by these new vulnerabilities and weaknesses.
As a cybersecurity professional,
you're going to spend a lot of time
selecting or recommending various controls
that you can use to effectively secure
and protect your network and the data it contains.
Now, a control is a measure
or safeguard that's implemented to mitigate potential risks
and to protect an organization's assets.
Selecting effective controls ensures
that we can prevent breaches
and to minimize vulnerabilities while ensuring
that our resources are being used efficiently.
Effective control selections can also help us
to foster trust among our stakeholders by demonstrating
that we have a proactive approach
to our organization security and compliance postures.
So in this lesson,
we're going to go through some key principles,
methodologies, and best practices that you can use
to make more informed decisions when you're selecting
effective controls inside of your organization's
network infrastructure.
Now, first, let's talk about some key principles
when it comes to selecting effective controls.
We should consider the key principles
of least privilege, defense in depth,
utilizing a risk-based approach,
conducting lifecycle management,
and focusing on open design principles
to secure our infrastructure.
Now, the principle of least privilege mandates that a user
or system should only have the necessary access rights
that they need to perform their duties.
Selecting and implementing controls associated
with the principle of least privilege really does help
to reduce the potential attack surface of your network.
Another key principle to use
is the concept of defense in depth.
Now, the defense in depth approach emphasizes the use
of multiple layers of security to ensure
that if one control fails,
that our other controls will still be ready
to stop a potential threat from successfully
exploiting our infrastructure.
Now, a risk-based approach is another good idea for you
to implement because it underscores the need
for the prioritization of controls based on the potential
risks and vulnerabilities that are specific
to your organization's infrastructure.
After all, no organization has enough people time
or money to completely mitigate every single potential
threat or vulnerability that's out there.
So we have to prioritize them using a risk-based approach
to more effectively use our limited resources
while giving us the best protection for our infrastructure.
Additionally, the principle of lifecycle
management will be used to focus on the importance
of regularly reviewing, updating,
and retiring our controls that align
with the always changing threat
landscape that we're experiencing.
After all, we don't select
and implement our controls one time
and then expect that our network will be
well protected for the rest of time.
So we need to conduct proper lifecycle management for all
of our controls as our networks evolve over the years.
Now, the final key principle we need to utilize is one known
as the open design principle.
The open design principle is focused on creating
transparency and accountability by ensuring
that our infrastructure and our controls undergo rigorous
testing and scrutiny to ensure they're effective
and being implemented securely.
By deeply understanding and integrating these key principles
into the selection of your infrastructure's controls,
you can ensure that you have a more robust,
resilient and responsive enterprise infrastructure.
Second, let's take a look at the methodology
that you can use to select some effective controls.
Now, the basic methodology that I recommend is
to assess the current state,
conduct a gap analysis, set clear objectives,
conduct benchmarking, conduct a cost benefit analysis,
ensure stakeholder involvement,
and then implement monitoring
and feedback loops into your organization.
So remember that when you're examining methodologies,
it's always important that you adopt a structured
and systematic approach to ensure the security
of your infrastructure remains intact.
Now, you should always start out
by assessing the current state of your security
and the controls that you already have in place.
You must have a clear understanding
of your current infrastructure set up its vulnerabilities,
and its existing controls, if any,
before you start adding any kind of new controls.
Once you understand your baseline,
you should then utilize a gap analysis
to identify any discrepancies
between your current security posture
and your desired security posture that you want to achieve
inside your organization's network.
Then once you have this information,
you can set clear objectives for what you're hoping
to achieve as you add additional controls,
whether you want to safeguard specific data,
ensure uptime,
or maintain compliance with laws and regulations.
Setting up clear objectives is going to help you do this
during your control selection process.
Once your objectives have been set,
you can conduct benchmarking
to compare your organization's processes,
performance, and security metrics
against your industry's best practices
to determine how you compare to your competitors
and others in your industry.
Next, you should consider performing a cost benefit analysis
before you start implementing your new controls.
While we want the best controls in place,
these controls also need to be cost effective.
So it's important to find the right balance
between the level of security
that you want to achieve versus the amount of financial
and other resources that are going to have to be invested
to achieve that level of security.
Stakeholder involvement is also important
during this process because it's going to help you
to ensure the controls you choose are going to be adopted
by your users, and they're going to work
in the business context of your current
and ongoing operations.
Finally, we need to create monitoring
and feedback loops so that we can ensure our controls
remain effective over time.
Because the cyber threat landscape is constantly changing
and evolving by regularly revisiting your control selection
methodology to ensure it remains relevant
and adjusting it as required,
we're going to be able to ensure
that our enterprise infrastructure remains agile
in the face of continually evolving threats.
Third, let's consider some best practices to use
during the selection of various controls
for your enterprise networks.
Now, when you're determining the best controls
for your enterprise infrastructure,
you must first conduct a comprehensive risk assessment
to better understand the threats
and vulnerabilities that are specific to your organization.
This will provide us with a foundation
for every subsequent decision that we're going to be asked
to make during the control selection process.
Also, a risk assessment should not be
considered a one-time thing,
but instead, it should be a recurring process
that's going to be repeated and updated anytime
there's a significant change
in your enterprise infrastructure
or your business' operations.
Next, you need to align your control selection
to a well-established framework or standard.
For example, the National Institute of Standards
and Technology known as NIST
and the International Organization for Standardization,
known as ISO,
both have published guidelines
that have been vetted and refined over time.
By adhering to these frameworks,
you can be assured that your approach is comprehensive
and based on tried and tested methodologies.
For example, I personally like
to use the NIST Cybersecurity framework
and the NIST Risk Management framework when I'm working
as a cybersecurity consultant,
because they're both very in-depth
and well-regarded frameworks
that we can rely on during our engagements.
Another best practice is to perform customization
of the frameworks for your own usage
to meet your specific use cases.
Here, customization is key
because while these frameworks provide
a robust starting point,
you can also tailor their controls
to the unique aspects of your organization's business
operations and its infrastructure's
own specific risk profile.
Finally, I cannot overemphasize the importance
of conducting stakeholder engagement
and training as part
of your effective control selection process.
Your security controls are only going to be as effective
as the people who are asked
to implement them and monitor them.
Therefore, you have to engage all relevant stakeholders
in the decision making processes
to ensure that they understand the rationale
behind each control that was being selected,
and it's rolling your organization's
broader security strategy.
Regular training sessions should also be conducted
to keep everyone up to date on the latest threats,
the purpose of the security controls we have in place,
and the best ways to utilize those control measures.
When it comes to implementing effective security controls
in your organization,
you really will have to rely on a knowledgeable
and engaged workforce to achieve a higher level
of security for your infrastructure.
So remember, a control is a measure
or safeguard that's implemented to mitigate potential risks
and protect an organization's assets.
Selecting effective controls will ensure
that we can prevent breaches
and minimize vulnerabilities while ensuring our resources
are being utilized efficiently.
To select your controls,
you should use a structured methodology
like the basic methodology I presented
that includes an assessment of the current state,
a gap analysis, clear objectives,
benchmarking, a cost benefit analysis,
stakeholder involvement,
and monitoring and feedback loops.
Also, that control selection
is not going to be a one-time event,
but instead it's something that we need
to practice time and time again,
and I recommend that you do this either annually
or quarterly based on your business
to ensure your enterprise infrastructure remains secure.