CSEC 600 RMF

risk management

to wht extent is it worth spending resources on cybersecurity in exchange for spending less resources if a cyber incident occurs

strategic risks

risks that affect an organizations long term goals and mission, often related to chnages in the business environment, compeittion, or poor strategic planning

operational risks

risks arising from failures in internal processes, systems, or human error, includes IT system failures, supply chain disruptions, or flawed procedures

compliance risks

risks of legal or regulatory sanctions due to non-compliance with laws, policies or standards; often stems from data protection laws like GDPRor industry rules like HIPAA

financial risks

risks that directly impact the financial standing of the organizations, such as fraud, market fluctuations, or invetsment losses due to cyber incidents

reputational risk

risks that harm an organizations public image or trustworthiness, often triggered by data brea hes, unethical behavior, or poor incident handling

intentional cyber attacks

malware, phishing, insider threats

accidental cyber threats

human error, misconfiguration, unaccounted edge cases

hacktivists

intentional threat actor, political and idealogical motivation

intentional threat actors

hacktivists, nation-state actors, organized crime, insider threats, and script kiddies

unintentional threat actors

employees, supply chain, natural disasters

identifying threat vulnerabilities

asset inventory, threat modeling, vulnerability scanning, manual testing, patch management review, configuration reviews

cybersecurity governance

who has authority and responsibility in the organization,

compliance

adherence to laws, regulation, and industry standards

frameworks

formalized documents outlining security recommendations, requirements, or information

NIST CSF

high level framework for overall cybersecurity strategy, core functions: govern, identity, protect, detect, respond, recover

NIST special publications

cybersecurity requirements for federal contractors

NIST 800-53

recommended/required security controls for federal contractos

NIST 800-171

recommended/required security controls for protecting CUI

NIST 800-172

additional security controls for further protecting CUI