Cybersecurity Framework – Simplified
Cybersecurity Framework – Cutting Through the Complexity
Hopefully you spent the holidays with family and friend’s instead of reading the latest publication “Framework for Improving Critical Infrastructure Cybersecurity” Version 1.1 Draft 2 published by National Institute for Standards and technology (NIST) on December 5, 2017. If you read it, like I did, kudos! I am not saying it was riveting and should be an episodic series based subscription on Amazon or Netflix, but, there are a few areas that should have every business paying attention.
I am a standards fanboy, as they are public and fair for all. Typically they are measurable and help keep the playing field for enforcement fair. The framework here lets the business take some liberties with aligning processes and technologies to meet conformance and compliance. As industries continue to adopt the cybersecurity framework for compliance, reporting and awareness, businesses are the beneficiary for mitigating risk by implementing. Why? As an example, if your business knows its cyber posture today, it can plan to improve using defined objectives, and implement security policies and controls based upon both business objectives, risks, budgets and need. The benefit to the business is both reduced cyber risk and improved employee productivity. A single breech, malware infection, ransomware event, or patching lapse can cause significant business impacts including loss of revenues, increased expenses and countless hours of productivity that can never be recovered. Using the framework model of “Identify, Protect, Detect, Respond and Recover” helps your organization complete a comprehensive, unbiased, cyber program. Again, as a fan, this is non-vendor specific framework that is neutral on what technology may or will be required.
Let’s take a short journey through the framework and its applicability.
Identify
Perform a Cybersecurity Assessment to understand assets, roles and responsibilities, policies, procedure, risk management monitoring, gaps and people.
Protect
Implement and manage access to assets and infrastructure. Verify that all security and integrity can be measured across networks, identities, devices, data and systems based upon user profiles and permissions. Deploy training and awareness internally and externally. Align and test all security policies and procedure with practice.
Detect
Continuous monitoring and management for cyber events is enabled; Detection of events, 3rd party connections, unauthorized connections, vulnerability scanning, awareness of cyber events and ownership, and incident response plans and procedure.
Respond
Develop a communication and response plan to a cyber event. Understand the cyber event impact and recovery plans are developed by severity.
Recover
Recovery implementations and improvement plans are maintained and updated using lessons learned. Make sure all stakeholders are who are needed to engage in recovery efforts are in constant communication.
Within the framework and organization will develop both knowledge and skills to become cyber aware, prepared and proactive to cyber events. The tactical process to prepare for the framework includes specific tactics that are outlined below.
Assessments
Assessments vary by type and provider and can be either outsourced or completed internally. The main objective of the assessment is a true, unbiased view of the actual state of cyber controls within an organization. Many of the controls cannot be assessed by just subject matter expertise, but require tools and technology to identify vulnerabilities, cyber gaps and process concern. The assessment should cover all aspects of physical, logical and digital security.
Gap analysis and System Security Plans
Every assessment should include both a written summary and a detailed analysis including identification of high, medium and low priority vulnerabilities. Also included in the assessment is a network diagram of the current configuration of the organizations infrastructure. It is important to understand and isolate vulnerabilities in the infrastructure. In addition to these, digitally collected vulnerabilities need to be identified and classified by their importance for remediation.
Plan of Action and Milestones (POAM)
Once the assessment is completed, a task oriented plan is needed. Each gap identified in the assessment needs a logical identifier, owner, solution and alignment with any compliance reference. In addition to the above, adding completion dates, 3rd party technology and dependencies will help drive a budget and or resource conversation. A high quality POAM will help identify internal or external resources, timeframes and project owners making the progress through the cyber framework a systematic approach.
Vulnerability Scanning and Continuous Monitoring
There are specialty tools used to capture and maintain a continuous improvement model for cyber preparedness. A cyber assessment and completion of the PAOM or progression through the cyber framework is a continued effort. Cyber is NOT a one and done event in terms of awareness and continuous understanding of cyber events. Vulnerability scanning should be periodic and scheduled; monthly and quarterly works well for most organizations. Cyber monitoring differs from firewall settings, network monitoring and end-point technology services. The difference is in knowledge and awareness of changes networks, devices and connections. All digital assets, known and unknow, need to be monitored in real-time with the ability to see alerts/changes in real-time that can be acted upon before they manifest into significant cyber events.
The framework model does define the stages needed to improve an organizations cyber posture. Without awareness and a plan, including proactive knowledge of cyber events, it’s a roll of the dice and my money is with the house- it’s a loser roll!
Cytellix® Cyber Watch Platform (C-CWP™)
C-CWP™ provides value by baselining the truth about the true cyber posture of our customers. We then move towards a cybersecurity mesh architecture of integrated continuous improvement that aligns with business objectives. C-CWP™ is an interoperable and open platform designed for change in posture and threat landscape. C-CWP™ is delivered as a complete “turnkey” outsourced service or in combination with internal teams and previously purchased security capabilities
Cytellix® Endpoint Detection Response (C-EDR™)
Cytellix® Endpoint Detection & Response (C-EDR™) is a flexible solution that can be used standalone, enables bring-your-own-license or can be provided turnkey as a complete managed solution with our C-GRC™, C-MDR™, XDR, SOC 24x7x365 managed Turnkey Solutions. The Cytellix turnkey C-EDR™ is a Enterprise grade solution that is complete and has full integration with the Cytellix platform.
Cytellix® Governance Risk & Compliance (C-GRC™) & IT Risk Management (IRM)
Risk Management requirements are evolving to align to the changes arising from compliance risk shifting towards regulatory impact on business process. The demand on organizations to understand their cybersecurity posture, report status and meet regulatory obligations is driving demand across the enterprise (small>large) for a non-technical, turnkey all-inclusive platform.
Cytellix® Managed Detection Response (C-MDR™)
Patented technology compiles information from the vulnerability's, governance, risk, compliance assessments, event data, and analytics. Delivers real-time analysis, including continuous improvement visualization and scorecard.
Extended Detection Response (C-XDR™)
The Cytellix® Extended Detection Response (C-XDR™) solution leverages our flagship Cytellix Cyber Watch Portal (C-CWP™) as turnkey compliance, awareness and response platform. Our C-XDR™ includes, vulnerability management, devices profiling, network segmentation, asset discover, threat intelligence, leak detection, EDR, pre-defined use cases for log ingestion and correlation of threats and our USA based 24x7x365 Security Operations Center (SOC). The Cytellix platform leverages our in-house AI/ML models for real-time telemetry, threat discovery/hunting and ticket reduction. This is a complete turn-key, affordable XDR solution.
Cybersecurity for Small and Medium Business
Cytellix® has designed its platform to enable the small and medium business to adopt quickly, with low friction at an affordable price. We have found that the tasks of both regulatory compliance with cybersecurity frameworks and building a high quality cybersecurity monitoring and infrastructure is a significant time, resource and expense issue for SMB's.
How We're Different
Cytellix® is a first-of-its kind patented SaaS platform that brings together cybersecurity, compliance, and risk management under one fully integrated umbrella. We know your "real security posture" and can provide a new way to manage and deploy cybersecurity capabilities, risk awareness, and compliance with a plan tailored to your specific situation and needs.
Contact Us
The Cytellix® team of experts have been delivering cybersecurity for the past 15-years to some of the largest networks in the world. This expertise is delivered to our SMB customers as an affordable, precise, and comprehensive solution designed for organizations who need to comply with Cybersecurity regulatory requirements. There is no other fully integrated GRC, MDR, XDR, EDR single pane of glass solution that is as rich in capabilities, as easy to use and available in production today.