s1 ISC

NIST cybersecurity framework ( csf)

Established to remove barriers to industrial competitiveness and improve access to resources to remote US research capabilities

NIST CSF voluntary framework includes 3 primary components

Csf core, csf tiers, and csf organizations

NIST cybersecurity framework core consists of 6 functions that should be performed concurrently

The GOVERNment should IDENTIFY PROTECTive DETECTives to RESPOND and RECOVER assets.

The four tiers of NIST CSF

Tier 1 (partial), tier 2 (risk informed), tier 3 (repeatable), tier 4 (adaptive)

CSF organizational profiles are

Mechanisms by which NIST recommends companies measure cyber security risk establish a roadmap to minimize risks

NIST 5 step approach to using org profiles

Scope the organizational profile, gather information needed to prepare the organizational profile, create the organizational profile, analyze the gap between the current target profiles and create an action plan and, implement the action plan to update the organizational profile.

NIST Privacy Framework

To protect individuals data as used in data processing applications

Privacy framework core is divided into 8 framework functions

IDENTIFY the GOVERNMENT CONTROLs and COMMUNICATE them to PROTECT the DETECTives who RESPONDed to RECOVER you

SP-500-53

Standard for government entities

Three control implementation approaches

Common (inheritable), system specific, hybrid

The 6 goals of Payment card industry data security standard (pci dss)

1. Build and maintain a secure network and systems 2. Protect account data 3. Maintain a vulnerability management program 4. Implement strong access control measures 5. Regularly monitor and test networks 6. Maintain and information security policy

IG1

Group is for small to medium sized organizations that have limited cybersecurity defenses mechanisms in place

Ig2 (includes IG 1)

This group is for companies that have it staff who support multiple departments that have various risk profiles and typically handle sensitive client data

IG3 (includes ig1 and ig2)

Group is for companies that have security experts in all domains within cybersecurity such as penetration testing, risk management, and application security

Inventory and control of enterprise assets (control 1)

Helps organizations actively track and manage all IT infrastructure physically or virtually within a cloud environment

Inventory and control of software assets (control 2)

Control provides recommendations for organizations to track and actively manage all software applications so that only authorized software is installed on company devices.

Data protection (control 3)

This control helps organizations develop ways to securely manage the entire lifecycle of their data from the initial identification and classification data to it disposal.

Configuration of enterprise assets and software (control 4)

This control helps organizations establish and maintain secure, baseline configurations for their enterprise assets.

Account management (control 5)

This control outlines best practices for companies to manage credentials and authorization for user accounts, privilege user account ,and service accounts for a company hardware and software applications.

Access control management (control 6)

This control expands on account management control five by specifying the type of access that users account should have

Continuous vulnerability management control seven

This control assist organizations and continuously identifying and tracking vulnerabilities within its infrastructure so that it can remediate and eliminate weak points or windows of opportunity for bad actors

Audit log management control eight

This control establishes an enterprise log management process, so the organizations can be alerted and recover from an attack in real time or near real time using log collection in analytical features

Email on web browser protections control nine

This control provides recommendations on how to detect and protect against cyber crime attempted through email or the Internet by directly engaging employees

malware defenses control 10

This control assist companies in preventing the insulation and propagation of malware onto companies, assets and its network

Data recovery control 11

This control establishes data, backup, testing, and restoration processes that allow organizations to effectively recover the company assets to a pre-incident state

Network infrastructure management control, 12

The control establishes procedures and tools for managing and securing companies network infrastructure

Network monitoring in defense control 13

This control establishes processes for monitoring and defending companies that work infrastructure against internal and external security threats

Security awareness and skill training control 14

The control guides organizations in establishing a security awareness and training program to reduce cyber security risk

Service provider management control, 15

This control establishes safeguards that manage the entire life cycle of software that is acquired hosted and developed in House to detect her and resolve cyber security weaknesses before they are Exploited

Incident response management control 17

The control provides a recommendation is necessary to establish an instant response management program to detect respond and prepare for the potential of security attacks

Penetration testing control 18

this control helps organizations test the sophistication of their cyber security defense system in place by simulating actual attacks in an effort to find and exploit weaknesses

COBIT Stands for

Control objects for information and related technologies

COBIT definition

Provide the road map that organizations can use implement best practices for IT governance and management

COBIT Six principles for a governance system

One is provided stakeholder value two is the holistic approach three is a dynamic governance system four as a governance distinct from management five is a tailored to enterprise needs six end to end governance system

COBIT Three principles for a governance framework

One is at its base on a conceptual model two is that is open and flexible and three is that it is aligned to major standards

Evaluate direct and monitor EDM

governance objectives are grouped into this one domain

Management objectives have four domains

Align, plan, and organize APO, build, acquire, and implement BAI, deliver, service, and support DSS, Monitor, evaluate, and assess MEA

COBIT 2019 Core model uses seven components to satisfy management governments objectives

Process, organizational structures, principles, policies, and frameworks, information, culture, ethics, and behavior, people, skills, and competencies, and services, infrastructure, and applications.