As the security landscape evolves, matures and becomes more complex, organizations need a trusted framework they can easily adopt and integrate into their existing security ecosystem. With all the tools available in the market today for improving your company’s cybersecurity, it’s easier than ever to get started with security protocols.There’s a caveat, though: those tools don’t provide everything you need to develop a comprehensive strategy. The analysis paralysis is real—it’s so tough to know where to start when adopting a trusted cybersecurity framework that best fits your organization’s needs. Huntress Sales Engineer II Todd Painter and industry expert Wes Spencer teamed up in April 2022 to discuss deNISTifying (see what we did there?) cybersecurity by leveraging the effective NIST cybersecurity framework. We’ll cover some of the topics and information they discussed during the live webinar.Want to dive deeper into the NIST cybersecurity framework? We break it down even further in our blog Breaking Down the NIST Cybersecurity Framework.A total of 23 categories are spread across these five functions, covering cyber, physical and personnel and focusing on business outcomes. These categories then branch into 108 subcategories, which can be overwhelming to navigate. If you don’t know where to start, don’t stress—look to CIS Controls v8.
Guest blog courtesy of Huntress. Read more Huntress guest blogs here. Regularly contributed guest blogs are part of MSSP Alert’s sponsorship program.
The NIST Cybersecurity Framework
The National Institute of Standards and Technology (NIST) has developed a series of documents known as the Framework for Improving Critical Infrastructure Cybersecurity. By following the NIST cybersecurity framework, you’ll ensure that your money is spent on the right areas to build an effective defense strategy. The Five NIST PillarsFive functional pillars comprise the NIST cybersecurity framework: Identify, Protect, Detect, Respond and Recover.- Identify: Identifying your assets is the first step in adopting this framework, as it helps you build a solid foundation. After all, how can you protect your assets if you don't know what's in your (or your partner's) environment? Often, people think the term "assets" only refers to devices, but it also refers to your users, data, application and vendors. When identifying your asset inventory, you'll also need to determine your governance, risk and compliance (GRC) status and scan for vulnerabilities and risks.
- Protect: Defending your assets against potential threats is perhaps the most critical aspect of cybersecurity. The key is to determine how much protection is necessary to contain or limit the effects of a cybersecurity incident. You’ll start by reviewing management, authentication and access control followed by awareness and training, data security, information protection, maintenance and protective technology. While focusing primarily on technical controls here, don’t discount the importance of physical security!
- Detect: Detection is much more than just alerting to cyberattacks. Following the recommendations in this NIST pillar will allow you to detect all cybersecurity events including newly installed software or apps, failed login attempts and new devices or users. Through establishing strong detection capabilities, you’ll look at anomalies and events, continuous security monitoring and detection processes.
- Respond: This pillar addresses your ability to contain the impact of a cyberattack, with categories including response planning, communication, analysis, mitigation and improvement. Ensure your team can respond to alerts from detection tools and that each person knows their roles and responsibilities in case of an incident. Reviewing all incidents retroactively and incorporating lessons learned is the final step in an ongoing incident response plan.
- Recover: The final framework pillar covers your recovery planning, improvements and communications. Your business needs will help determine your data priorities, so if and when an incident occurs, you can begin restoring data right away. Don’t forget to test your backups and practice ahead of time by using tabletop exercises to help you prepare for a cyberattack!
