Written by:
Chantel Pszenny Why You Should be Following the NIST CSF for Data Security
An attack by hackers can be disastrous for any business. It could result in losses and costly legal battles if attackers gain access to sensitive information. Even worse, companies may have to pay huge fines, which average $4.24 million, according to IBM and Ponemon, just because they weren’t adequately prepared to deal with the attacks.
A well-implemented cybersecurity program can give you peace of mind by reducing the likelihood of a successful cyberattack against your systems and minimizing the impact if one happens.
Security experts agree that following the NIST Cybersecurity Framework (CSF) can help secure your organization against cyberattacks and even qualify you for Safe Harbor . In fact, some US jurisdictions have adopted laws requiring compliance with the framework. These requirements include mandatory security training, periodic testing, regular penetration tests, and regular updates to software patches. However, there are currently no federal regulations mandating these protections.
This will be a place to link to the whitepaper which will include an explanation of safe harbor.
What is The NIST Cybersecurity Framework (CSF)
The NIST CSF is a set of guidelines and best practices for managing cybersecurity risks. It is organized around five core functions: identify, protect, detect, respond, and recover. Each function outlines appropriate cybersecurity capabilities, projects, processes, and daily activities that organizations should consider to reduce cyber risks.
Identify
Before you can go about creating an effective cybersecurity architecture, it is crucial to understand what needs protecting to create an organizational cyber risk profile. This profile is comprised of information covering every aspect of your organization, including:
- Data – Information on data covers all information held by or controlled by the organization, even if it is managed or stored by other parties such as a SaaS provider.
- Physical Assets – All physical resources such as servers, network devices, and endpoints along with information about where they are located and how they are protected.
- People – The collection of all individuals with access to your digital resources and information about their roles and responsibilities.
- Capabilities – Information about your organization’s skills and abilities, ranging from development to incident response.
Data is one of the most important aspects of your infrastructure that must be identified and analyzed. Knowing where the data exists, what type of information it is, and whether it is controlled by any legal, regulatory, or compliance requirements. Meeting these mandates are crucial to not only protecting your data but mitigating the costs and penalties that come with non-compliance.
The holistic inventory of assets, capabilities, and requirements is just the start of identifying and defining the scope of the cybersecurity program. It helps to highlight where the organizational “crown jewels” reside and where protections might be lacking. With this information, you can develop a cyber risk profile that encompasses all of your assets and identifies your general exposure helping better align your organizational cybersecurity investment with business objectives.
Protect
The Protect functionality is the proactive defense section of the framework. It helps establish policies, procedures, and practices to stop cyber threats and incidents. Data security controls that are part of the Protect functionality focus on preventing inappropriate access, modification, or deletion of data.
With the Protect part of the framework, an organization defines and communicates the policies and procedures that will protect its data. Data security applies not only to just the data but the entire ecosystem that the data resides within. So even controls such as firewall policies that limit access to internal resources are part of the data protection functionality as much as access controls on the data are.
Protecting your infrastructure takes a set of controls that include:
- Identity and access management
- Encryption
- System and network hardening
- Logging
- Change management processes
- Staff training
Creating effective security controls to protect your data builds directly on the information discovered in the Identify phase of the framework. The controls must be tailored to your organization’s needs using this information to make them effective.
Detect
Defending your data and infrastructure takes more than just implementing controls and hoping for the best. The Detect function of the framework provides visibility into what is happening, helping to identify when cyber security incidents or anomalies occur. With Detect functionality, organizations can determine when problems happen and have data to support that the business is operating as it should.
Controls that fall in the detection category ingest information that the Protect controls generate to create visibility and insight into your daily operations. Detect controls may be as basic as dashboards and reporting that amalgamate data to generate charts and allow searching of data for information. More advanced Detect controls may integrate machine learning to compile enormous volumes of data to create actionable insights for threat and anomaly detection.
When incidents are identified, Detect functions are also crucial for organizations to determine what caused the incident so they can take steps to close exposures and avoid it in the future.
Respond
The Respond functionality is the natural extension of the Detect part of the framework. Once an incident or anomaly has been identified, steps need to be taken to investigate the problem further and stop any attack.By rapidly detecting and responding to cyber threats, organizations minimize the impact of these events, limiting the damage or exposure of their data.
The ways organizations respond to cyber events vary. Minor events may require little more than the generation of an alert and an engineer following up. More significant events, such as a widespread breach, may lead to an organizational response involving multiple teams and following a pre-defined incident-response plan that outlines communication chains and steps of response.
One of the biggest challenges in responding to threats is dealing with the human factor. Humans take time to analyze information and may have delays from other work tasks or distractions such as meetings. More advanced controls in the Respond portion of the framework leverage automation to eliminate inefficiencies that come with a person responding to a threat. These controls can include automated scripts that proactively eliminate access to sensitive data when questionable access is discovered from an external attacker or malware activity.
Recover
The Recover aspect of the framework provides guidance to organizations in recovering from cyber incidents. This part of the framework includes all activities and plans intended to restore capabilities, services, or data that an incident impacts. The Recover phase of the framework addresses the technical and business side of responding to cybersecurity events.
When planning Recover controls, organizations need to determine how timely their recovery efforts need to be. This is where the business needs that were discovered in the Identify phase of the framework come into play. Not every component of the organization needs to be brought back up within seconds, as not everything is mission-critical. The same goes for data, where sometimes a little data loss is acceptable because it is easily recreated, such as the last few minutes of a document being typed that was not saved before a computer reset due to a power outage.
The level and speed of recovery play a role in how complicated, and costly recovery solutions are to implement and maintain. Recovery controls like a tape backup are relatively inexpensive, yet they are slow to restore and may contain backups that are days old. Alternatively, cloud-based backup solutions may have near-real-time data and almost instantaneous recovery, but this level of service comes at a price. Slower recovery times or longer periods between saved data decrease costs but create gaps in what can be restored.
When planning the Recovery phase of the framework, companies need to consider their customer needs as well as regulatory and compliance requirements for restoring data and normal operations.
Why are frameworks important?
Building a framework is crucial for helping organizations address every area of their cybersecurity defense. A framework gives them the foundation to build their policies, procedures, and administrative activities related to their IT security operations without missing any steps.
Using the NIST CSF, organizations can align their internal controls with that of external regulations to ensure they have created a holistic cybersecurity program. It helps a company show regulatory compliance without having to re-work the entire infrastructure but instead mapping it to core functionalities.
The NIST CSF takes companies through the entire lifecycle of protecting their data from determining what needs protecting through keeping it secure throughout its use and storage. By comparing their controls to the NIST CSF, companies can determine gaps in their cybersecurity program and identify areas to make improvements.
To simplify this process, organizations can streamline their cybersecurity defense by utilizing a solution that includes all aspects of the NIST CSF in its design. Contact Sotero today to learn about their complete Data Security Platform, which includes controls spanning every aspect of the NIST CSF.