Cybersecurity RoadMap

Risk: What could go wrong?

How Industry Security Requirements Drive Cyberthreat Resilience 

• Reputation is a new target for cyber-attacks – all industries
• Criminals value our information – financial, health, critical infrastructure, all industries
• Cyber risk is challenging to understand and address and involves regulations imposed by all industries
• The changing pace of technology increases unknown dependency on third parties and shadow IT
• We cannot trace or control our data
• The role of government and information custody is often misunderstood

Here's a summary of points from this training.

Cybersecurity Mission: Resilience

• What are our critical assets?
• Who is responsible for them?
• Is everyone involved in cyber-resilience? 
• Do they have the knowledge and autonomy to make good decisions?
• Are we prepared for when there is a successful attack? 
• Will there be a tried and tested process to follow, or will a cyber-attack throw our organization into complete chaos?

We’ve been having a continuous compliance conversation

Compliance is a fabric that breaks down over time

There are many threads in compliance fabric

• Industry – health, finance, consumer, education, government – have different objectives and regulating bodies who impose laws in response to the risks surrounding those objectives
• Audits, Examinations, Assessments – SOC 2, ISO27001+Cloud, Privacy, and Processing..., FFIEC Examination, SOX ITGCC, HIPAA/HITECH compliance, PCI DSS - (people show up, the board gets reports, involves public disclosure, can result in criminal charges)
• Guidance or Guideline - Documents that HELP, explain how to do it – in some cases, guidance supports a policy, so it determines “how” we comply.
• Frameworks – COSO, Cobit, ITIL, NIST 800-53, Cyber Security Framework, CIS CSC, gives us longitude, latitude (frames how and what we govern)
• Standards – criteria based best practice, DISA STIGs, CIS Benchmark, SCAP
• Standard are accepted as best practices whereas frameworks are practices that are generally employed
• Standards are specific while frameworks are general
• Mandates, Orders, Laws – You must comply (CFR)
• Families or Domains – people, technologies, and processes that we generally consider related
• Universe – a collection of processes associated with tests and controls, grouped by families or domains – used to organize ASSESSMENTS
• Controls – are processes, what we do to enforce and govern, for example, “manage change”
• Tests – how we measure it happened.  A test can have many sub-items, but in aggregation, the set of measures tell us if the control process is effective.  We tie Policy items to Tests.  Tests are in Universe.
• Policies – what we tell people they must do – usually, they are within ISO27002 ISMS and the soon-to-release ISO/IEC FDIS 27002, measured by the ISO27001 assessment. 
• Policy Items – (system policy) discrete configuration items

(You can open this presentation full screen and it's available for local download. All of our MP4 videos are scanned twice daily.)

What do we want from a fabric?

• When it's hot – let us breathe
• When it's cold – add layers
• Last a long time – holding shape
• Tell the world our story and style – reporting, informing, aligning
• Shrink and Expands – agility, adaptability
• Provide protection – protect our assets, and us (our business, our reputation, our family)

Before we acquire a fabric, let’s examine what we need

• Need begins with (industry) risk
• What are the industries where we see groups of specific types of risk?
• How do industries describe their risks & controls?

Predominantly, industries use NIST SP800-37 Risk Management Framework – RMF

Risk: What could go wrong?

• Reputation is a new target for cyber-attacks – all industries
• Criminals value our information – financial, health, critical infrastructure, all industries
• Cyber risk is challenging to understand and address, the regulation imposed by all industries
• The changing pace of technology increases unknown dependency on third parties and shadow IT
• We cannot trace or control our data
• The role of government and information custody is often misunderstood

Exercise: Identify a risk that is not in your industry.

What behaviors provide most protection?

1. Control Administrative Privileges
2. Limiting Workstation-to-Workstation Communication
3. Antivirus File Reputation Services
4. Anti-Exploitation
5. Host Intrusion Prevention (HIPS) Systems
6. Secure Baseline Configuration
7. Web Domain Name System (DNS) Reputation
8. Take Advantage of Software Improvements
9. Segregated Networks and Functions
10. Application Whitelisting

What are the best tools and resources?  (THIS IS DATED - written in 2016. If you've got tools you'd like featured in this article, reach out to This email address is being protected from spambots. You need JavaScript enabled to view it.)

• Turn in your business email to get links and downloads
• CSF provides a cyber security model
• Use: NIST Framework for Improving Critical Infrastructure Cybersecurity; Annex A
• Determine Alignment to ISMS and NIST 800-53 or CCM or any standard ITGCC program
• Download NIST Assessment Tool http://www.nist.gov/cyberframework/csf_reference_tool.cfm
• Cyber Security Evaluation Tool
• Download and install CSET https://www.us-cert.gov/forms/csetiso
• HITRUST CSF 9.3 Resources – registration required
• Offers manual mapping of controls for implementation of controls assessment of HITECH / HIPAA security and privacy rule using multiple frameworks and standards https://hitrustalliance.net/hitrust-csf/https://hitrustalliance.net/hitrust-csf/

Other Cyber Security Must Reads

• International Organization for Standardization, Risk management – Principles and guidelines, ISO 31000:2009, 2009. http://www.iso.org/iso/home/standards/iso31000.htm 
• International Organization for Standardization/International Electrotechnical Commission, Information technology – Security techniques – Information security risk management, ISO/IEC 27005:2011, 2011. http://www.iso.org/iso/catalogue_detail?csnumber=56742 
• Joint Task Force Transformation Initiative, Managing Information Security Risk: Organization, Mission, and Information System View, NIST Special Publication 800-39, March 2011. http://csrc.nist.gov/publications/nistpubs/800-39/SP800-39-final.pdf 
• U.S. Department of Energy, Electricity Subsector Cybersecurity Risk Management Process, DOE/OE-0003, May 2012. http://energy.gov/sites/prod/files/Cybersecurity%20Risk%20Management%20Process%20Guideline%20%20Final%20-%20May%202012.pdf 

CSF Process requires analysis of attack surface (read more at Secure Host Baselines & Common Security Framework CSF)

All of these industries require asset-level cyber security

All industries expect us to provide:

• Board reports
• Boss reports
• Boss’s boss reports
• Decision support systems
• Security roadmap
• Enable business
• Drive IT Value

As an industry, our sensory system is overwhelmed

We need a fabric

What creates the threads that we can assert?

Ten normative references that totally rock the compliance world

1. Benchmark contains both descriptive information and structural information
2. Group  item that can hold other items
3. Item three types of items: <xccdf:Group>, <xccdf:Rule> and <xccdf:Value>
4. Model suggested scoring model for an <xccdf:Benchmark>
5. Profile element is a named tailoring for an <xccdf:Benchmark>
6. Rule the description for a single item of guidance or constraint. <xccdf:Rule> elements form the basis for testing a target platform for benchmark compliance
7. Status acceptance status of an element with an optional date attribute, which signifies the date of the status change
8. Tailoring element holds one or more <xccdf:Profile> elements-records additional benchmark tailoring
9. TestResult element encapsulates the results of a single application of an <xccdf:Benchmark> to a single target platform
10. Value a named parameter that can be substituted into properties of other elements within the <xccdf:Benchmark>

KEY IT Security and Risk resources

• SANS Top 20 Critical Security Controls V8. https://www.sans.org/critical-security-controls/
• NIST Framework for Improving Critical Infrastructure Cybersecurity, V1.1. http://www.nist.gov/cyberframework/ 
• NIST 800-53 V5. Security and Privacy Controls for Federal Information Systems and Organizations (Right)
• DISA Secure Technical Implementation Guides. Complete STIG List (stigviewer.com) *This is managed by UCF
• ISO/IEC 27002:2013. Information Technology - Security techniques - Code of practice for information security controls. http://www.iso.org/iso/catalogue_detail?csnumber=54533 
• COBIT V5. ISACA. http://www.isaca.org/cobit/pages/default.aspx (Visit Cobit at ISACA. It's up to version 19!)
• Payment Card Industry Data Security Standard V3.2.1 Official PCI Security Standards Council Site - Verify PCI Compliance, Download Data Security and Credit Card Security Standards

Control Correlation Identifiers CCI

• SRG / STIG Library Compilations – DoD Cyber Exchange

  The SRG-STIG Library Compilation .zip files are compilations of DoD Security Requirements Guides (SRGs) and DoD Security Technical Implementation Guides (STIGs), as well as some other content that may be available through the Cyber Exchange website’s STIG pages. Specifically excluded are Security Readiness Review (SRR) Tools (scripts and OVAL Benchmarks), Group policy objects, and draft SRGs and STIGs.

  The Library Compilation .zip files will be updated and released during each SRG-STIG Update Release Cycle to capture all newly updated or released SRGs, STIGs, and Tools. New SRG-STIG content released mid-cycle will be individually downloadable from IASE as released. These SRGs-STIGs will appear in the subsequent release of the Library Compilation.

  See SRG-STIG Library Compilation READ ME for more information to include download/extraction instructions and a FAQ.

  NOTE: While every attempt will be made to provide a complete set of currently in force SRGs, STIGs, and related tools, DISA makes no guarantee as to the completeness of the compilation or the currently in force status of the contents.

  NOTE: While every attempt will be made to publish updated compilation files on the SRG-STIG Quarterly Update Release date, publication may lag due to competing workloads. Updated Compilation files will be published on or as soon as possible the published date. We apologize for any inconvenience this may impose.

  Concerns or questions related to the contents or format of these compilation files should be directed to the DISA STIG Customer Support Desk at This email address is being protected from spambots. You need JavaScript enabled to view it.

• The Control Correlation Identifier (CCI) provides a standard identifier and description for each of the singular, actionable statements that comprise an IA control or IA best practice.
• CCI bridges the gap between high-level policy expressions and low-level technical implementations. CCI allows a security requirement that is expressed in a high-level policy framework to be decomposed and explicitly associated with the low-level security setting(s) that must be assessed to determine compliance with the objectives of that specific security control.
• This ability to trace security requirements from their origin (e.g., regulations, IA frameworks) to their low-level implementation allows organizations to readily demonstrate compliance to multiple IA compliance frameworks.
• CCI also provides a means to objectively roll up and compare related compliance assessment results across disparate technologies.

Open Vulnerability and Assessment Language (OVAL) 

• OVAL® is an information security community effort to standardize how to assess and report machine state of computer systems.
• Tools and services that use OVAL for the three steps of system assessment — representing system information, expressing specific machine states, and reporting the results of an assessment — provide enterprises with accurate, consistent, and actionable information so they may improve their security.

Most of us still lack an effective compliance fabric

• If we constantly fixate on having one standard as an index to all standards, we waste time and are always doing wrong things wrong ways for wrong results
• We have to tie configuration guidelines to standards, and standards to risk scenarios + industry + time. 
• All standards and risks have a shelf life.
• We use our fabric to sense and avert danger – so when bad’s about to happen, we can get goosebumps
• What if the elephant in the room could interpret and report cyber security danger?
• What would we want the elephant to sense?
• How might danger change over time?
• Which framework for risk would make the most sense?
• How might we interpret the elephant’s behavior?
• What if the elephant implemented unified best practices?

Security controls and best practices from NIST, the Defense Information Systems Agency (DISA) and International Organization for Standardization (ISO), the Control Objectives for Information and Related Technology (COBIT) framework, and Payment Card Industry Data Security Standards (PCI DSS).

• access control policy
• continuous monitoring
• boundary protection
• event auditing incident detection and reporting
• device authentication
• user authentication
• data encryption
• vulnerability scanning
• track and monitor all resources

NIST SP 800-37 Guidance for continuous monitoring ( Learn more in Building Cloud Products for Federal Agencies)

Elements essential to a successful organization-wide continuous monitoring program:

• Configuration management and change control – develop processes for organizational information systems, throughout their SDLCs, and with consideration of their operating environments and their role(s) in supporting the organization’s missions and core business processes
• Security impact analyses – develop security impact analysis and conduct analyses to monitor for changes to organizational information systems and their environments of operation for any adverse security impact to systems, mission/business and/or organizational functions which said systems support
• (Ongoing) assessment of system security controls – assessment frequencies based on an organization-wide continuous monitoring strategy and individual system authorization strategies
• Security status monitoring and reporting – communicate accurate and up-to-date security-related information to support ongoing management of information security risks and to enable data-driven risk mitigation decisions with minimal response times and acceptable data latencies; and
• Active involvement of organizational officials.
• Comprehensive ISCM strategy

A comprehensive ISCM strategy encompasses technology, processes, procedures, operating environments, and people.

This strategy includes:

• Understanding of risk tolerance
• Metrics that provide meaningful indications of security status at all organizational tiers
• Continued effectiveness of all security controls
• Verification of compliance with information security requirements
• IT asset management
• Knowledge and control of changes
• Awareness of threats and vulnerabilities
• An ISCM program is established to collect information in accordance with pre-established metrics, utilizing information readily available in part through implemented security controls.

Audit Velocity increases Maturity

• Old approach: Find a flaw, fix a flaw
• Better approach: Find flaws and keep a prioritized list
• Best approach: Align vulnerability metrics into a continual service improvement model
• CSP_Continuous_Monitoring_Strategy_Guide.pdf (fedramp.gov)
• Information security continuous monitoring (ISCM) is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions.
• Please make room for protocol governance