You Don’t Need to Reinvent the Security Wheel

Established standards can guide you.

Every organization with an online presence is in danger of attack, and effective protection against it must be well-planned and thorough. The cloud is an important part of your defenses, but even with it, you are responsible for safeguarding your systems and your data. But the process of building solid security does not mean that you need to think up every element and process yourself.

It takes time to build the best possible defenses, but Rome wasn’t built in a day. Instead of hurriedly cobbling something together, begin with a structure based on reliable and readily available cybersecurity standards. A good place to start is with a framework such as provided by the National Institute of Standards and Technology (NIST).

A premier science and technology laboratory, NIST is an agency of the U.S. Department of Commerce charged with promoting innovation and competitiveness. The NIST Framework provides organization and structure to today’s multiple approaches to cybersecurity by assembling highly effective and widely used standards, guidelines, and best practices without regulatory burdens.

This empowers organizations of any size or level of technical sophistication to impose strong protection for systems and data as well as superior recovery capabilities.

The Framework consists of three parts:

1 – The Framework Core presents industry standards, guidelines, and practices and comprises five key functions:

• Identification
• Protection
• Detection
• Response
• Recovery

2 – Framework Implementation Tiers

Framework Implementation Tiers outline a range of approaches, from the informal and reactive (often the most effective for SMBs) to the most sophisticated and detailed. When assigning Tiers to the various sets of cybersecurity processes, a company must evaluate its current practices, threat levels, regulatory requirements, business objectives, and organizational constraints.

3 – The Framework Profile

The Framework Profile looks into how the standards, guidelines, and practices of a given scenario align with the Framework Core. The Profile considers important issues such as costs, future business plans, ongoing assessment, and both internal and external communications.

The NIST Framework requires communicating to the entire organization the reasoning behind the cybersecurity program, how it works, and how all employees can participate in its implementation.

The body of technical information available through NIST is vast, covering everything from the characteristics of cybersecurity components to remote access to recovery-plan testing. An excellent example of the specifics presented is a NIST standard that all service providers should use. The Advanced Encryption Standard (AES) is employed along with FIPS 140-2 certification to provide the highest level of third-party validation, ensuring that the encryption is virtually invincible. This is a good example of how reliance on an established standard can guarantee top performance.

Another premier framework source is the Center for Internet Security (CIS), a nonprofit organization that helps its members “identify, develop, validate, promote, and sustain best practice solutions for cyber defense.” It is a crowdsourced entity that follows a consensus development model that invites input from a broad range of users in order to better inform its solutions and processes. CIS members include corporations, government agencies, and academic institutions.

CIS goals are clear and practical:

• Leveraging cyber offense to inform cyber defense, focusing on high payoff areas
• Ensuring that security investments are focused on countering the highest threats
• Maximizing the use of automation to enforce security controls, thereby negating human errors
• Using the consensus process to collect the best ideas

CIS Controls and CIS Benchmarks are globally respected standards for cybersecurity. CIS Controls are a group of 20 best practices for defending against malware. These cover every area of cybersecurity, from planning to implementation to testing. CIS Benchmarks encompass frameworks for secure configuration, automated assessment tools and content, security metrics, and applicable software certifications.

Using a framework when developing cybersecurity processes has significant advantages:

• Reduces confusion and eliminates unproductive initiatives.
• Takes advantage of the combined knowledge of many experts and user organizations.
• Sets warning guardrails for potentially expensive and destructive errors.
• Ensures that every important step will be taken.
• Recommends only proven best practices.

The fact remains that even with a solid framework in place, creating strong, nimble, and constantly current cybersecurity capabilities requires the kind of individual guidance. This is the kind of consultancy RenovoData provides. Companies benefit when experienced experts are available to help guide decisions and the know-how to put the whole system together. These are among our greatest strengths.

To discuss how you can benefit from a well-established framework and how it could work best for you, contact us.