How the NIST cybersecurity framework can help secure the enterprise

[Audrey McNeil <audrey () riskbasedsecurity com>]

http://www.networkworld.com/news/2014/021414-how-the-nist-cybersecurity-framework-278802.html?source=nww_rss


Now that the National Institute of Standards and Technology has finalized
the much-discussed cybersecurity framework, organizations can use it as the
guideline for measuring how well their systems are secured.

One year ago, President Barack Obama directed NIST to develop a security
framework that could be used as a guide to secure the country's
cyberinfrastructure of basic vital services such as banking, transportation
and telecommunications. Although the White House directed the development
of the framework chiefly for measuring and mitigating risk in the country's
cyberinfrastructure to protect airlines, roads and other vital aspects of
the U.S. economy and well-being, it can be used by any organization.

Certainly, retailers that have been hit by cyberattacks, such as Target,
could benefit from the framework.

To develop the framework, NIST consulted hundreds of experts in industry
and reviewed feedback from thousands of additional contributors culled from
multiple draft releases that were posted for review. In its final form, the
framework offers a core set of activities to anticipate and mitigate
against attacks on systems. It provides a set of measurements to assess to
what degree an organization has implemented these core activities, which
can be used as a gauge to assess how prepared the organization's systems
are, in terms of being secured against an attack.

While some have criticized the 41-page framework as too vague to be of much
value, it can offer a road map for organizations, some say.

The framework was written preliminarily for the higher levels of
management, such as a boards of directors, chief security officers, audit
committees, senior executives and others "working inside an organization
who are responsible for different aspects of security and privacy," said
Harriet Pearson, a partner in the Washington, D.C., office of Hogan
Lovells, who was involved in the shaping of the framework.

It is a valuable indicator of what a standard of care should be, Pearson
said: "A CSO might be wondering 'How do I know if I've done enough?'" The
document provides a standard measure that organizations can agree on in
terms of assessing risk assessment.

"While not technology specific, it points to the governance and action,"
Pearson said. "You don't have to use every part of the framework. It's more
of the thought process."

"The framework does a really nice job of laying how organizations should
apply a risk-based approach to improve security," said Andrew Wild, chief
security officer of IT security firm Qualys.

Other frameworks do this as well, he pointed out, but the NIST's document
is valuable in its brevity. "Someone can get a high level understanding of
what is required," Wild said.

The document also includes references to other, more in-depth documents
that provide more detailed instruction, such as the widely referenced
Council on Cybersecurity's Critical Security Controls.

Nonetheless, Wild cautioned that the framework will not be a panacea for
security issues. Most security officers already have a solid understanding
of how their systems need to be secured. What they too often lack, Wild
said, are the adequate resources.

Overall, cyber-infrastructure security won't be significantly improved
until executive boards in organizations commit to providing more resources
for risk management cybersecurity, Wild said. "How can the framework make
an improvement if resources aren't provided?"

_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss
For inquiries regarding use or licensing of data, e-mail
        sales () riskbasedsecurity com 

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
YourCISO is an affordable SaaS solution that provides a comprehensive information security program that ensures focus 
on the right security.  If you need security help or want to provide real risk reduction for your clients contact us!