Perhaps the most frustrating thing about cybersecurity is that there is no magic bullet, no single tool or service, that can prevent every data breach. Every security professional will say you need a multilayered security strategy with a combination of advanced tools, services and expertise. And that’s still not enough to stop every breach.
To make matters worse, organizations can easily become overwhelmed by the process of choosing and prioritizing the right security controls. Increasingly stringent data privacy regulations add a whole new layer of complexity to the process. To overcome this complexity and reduce the risk of a breach, more and more organizations are implementing an IT security framework.
What Is an IT Security Framework?
An IT security framework refers to the documented processes, policies, and procedures for implementing, managing and maintaining IT security tools and services. It can be customized for specific industries and organizations, as well as specific security and compliance challenges. The idea is to make it easier to define and prioritize tasks involved in keeping an organization secure.
The NIST Cybersecurity Framework
The National Institute of Standards and Technology (NIST) Cybersecurity Framework is the direct result of an executive order from President Obama in 2014 to develop voluntary guidance for improving critical infrastructure cybersecurity. The framework is based on existing standards, guidelines and best practices for identifying, detecting and responding to cyberattacks. It is now a requirement for all federal agencies.
The early focus was on industries vital to national and economic security, including energy, banking, communications and defense. However, small and large organizations across industry, as well as government agencies at all levels, have voluntarily adopted the NIST Cybersecurity Framework. It is now considered a must-have tool for reducing risk and improving cybersecurity communication, both internally and with external stakeholders, such as vendors and business partners.
Key Components of the NIST Cybersecurity Framework
There are three key components of the framework. The Framework Core is the set of activities required to achieve certain cybersecurity outcomes. It includes five key functions — identification, detection, protection, response and recovery. For each function, there are multiple categories of tasks to carry out and challenges to address.
The second component is Framework Implementation Tiers, which tell organizations where they stand from a cybersecurity perspective and how far they need to go to comply with the framework’s guidelines. The third component is Framework Profiles, which help organizations identify and address weaknesses in their cybersecurity strategy. Profiles are also used to build alignment between business goals, risk appetite, budget and desired outcomes identified in the Core. As security holes are plugged, you move to a higher Implementation Tier.
Version 1.1 of the NIST Cybersecurity Framework, released in April 2018, includes updates on authentication and identity, self-assessment of cybersecurity risk, cybersecurity management within the supply chain, and vulnerability disclosure. The framework will evolve to keep up with current threats, technology and industry requirements.
Cerium Can Help with Implementation
Although the NIST Cybersecurity Framework is designed to simplify cybersecurity, implementation can be a complicated undertaking. Cerium understands the finer details of the framework’s requirements and how to meet the standards in a cost-efficient manner. Let us help you assess the current state of cybersecurity across your organization and develop a plan for implementing the NIST Cybersecurity Framework.
