NIST, Data Privacy, Center for Internet Security

National Institute of Standards and Technology Frameworks (NIST) is an organization which…

recommends how organization systematically controls the hardware and software so that data can be properly: Transmitted, Modified, Accessed , and Stored (securely and efficiently)

NIST Cybersecurity Framework (CSF) contains three components

CSF Core, CSF Tiers, and CSF Organizational Profiles

CSF Core includes these functions

Govern, Identify, Protect, Detect, Respond, and Recover

CSF Core: Govern

Oversees the other five functions

CSF Core: Identify

Find risks related to cybersecurity

CSF Core: Protect

Prevent or reduce the likelihood that an adverse cybersecurity event occurs

CSF Core: Detect

Timely discovery of cybersecurity attacks

CSF Core: Respond

Contain the effects of cybersecurity incidents

CSF Core: Recover

Returning back to normal operations

CSF Tiers includes…

Tier 1 Partial, Tier 2 Risk-Informed, Tier 3 Repeatable, and Tier 4 Adaptive

Tier 1: Partial

Usually for very small companies

Tier 2: Risk Informed

The organization is aware and mostly focuses on specific risks. Usually not sophisticated and organized.

Tier 3: Repeatable

Organization-wide approach with written, formal practices

Tier 4: Adaptive

Organization-wide with continuous monitoring and improvement

CSF Organizational Profiles includes these profiles…

Current profile, Target profile, and Community profile

Current Profile

specifies the current status of an organization's cybersecurity

Target Profile

is the level of cybersecurity the organization is striving for

Community Profile

is industry standards that can be adopted by organizations

NIST Privacy Framework includes…

Identify, Govern, Control, Communicate, and Protect

NIST SP* 800-53 Security and Privacy Controls for Information Systems and Organization

provides a comprehensie cataglog (20 subdivisions) of pecutiy and privacy controls

Health Insurance Portability and Accountability Act (HIPAA)

provides privacy for health-related data

HIPPA's privacy rule permits that entities can disclose personal health information without authorization to:

• You, the individual

• For treatment, payment and healthcare operations

• For incidents that fit within disclosure agreements you previously agreed 

• After giving the individual the opportunity to agree or object

• Redacted dataset for research or public health 

• For public interest covered under laws

For treatment, payment and healthcare operations

For incidents that fit within disclosure agreements you previously agreed

After giving the individual the opportunity to agree or object

Redacted dataset for research or public health

For public interest covered under laws

Health Information Technology for Economic and Clinical Health (HITECH)

An amendment of HIPAA that bridged the transition from paper to electronic documentation

Payment Card Industry Data Security Council (PCI DSS)

Protects cashless transactions

Center for Internet Security (CIS)

cybersecurity guidelines, standards, and community-driven resources

CIS Design Principles are…

Context: scope and practical applicability

Coexistence: alignment with evolving industry standards and frameworks

Consistency: similarities across IT areas

CIS Implementation Groups are…

IG1 (basic), IG2 (mid-size), and IG3 (significant)

IG1 (basic)

Small or medium-sized organizations that have limited cybersecurity and nonsensitive data

IG2

Mid-sized companies with IT staff that handles sensitive data

IG3

Organizations have security experts and snesitive data is subject to compliance and regulatory oversight. Attacks could cause significant damage to reputation and community.

CIS Control 01: Inventory and Control of Enterprise Assets

Organization actively tracks and manages all IT assets connected to a company's IT infrastructure.

CIS Control 02: Inventory and Control of Software Assets

Track and actively manage all software applications so only authorized software applications is installed on company devices.

CIS Control 03: Data Protection

Securely manage the life cycle of their data from initial identification and classification data to disposal.

CIS Control 04: Secure Configuration of Enterprise Assets and Software

Establish and maintain secure baseline configurations for their enterprise assets including servers, networks, mobile devises, etc.

CIS Control 05: Account Management

Manage credentials and authorization for user accounts, privileges user accounts, and service accounts for hardware and software.

CIS Control 06: Access Control Management

Specifies the type of access that user accounts should have.

-Gve the least amount of privileges to do the job

-Users only have access to systems and services to perform their job

-Give and revoke access to users when needed

CIS Control 07: Continuous Vulnerability Management

Continuously identifying and tracking vulnerabilities within its infrastructure to remediate and eliminate weak points or windows of opportunity for bad actors.

CIS Control 08: Audit Log Management

Establish enterprise log management process so the organization is alerted and recovers from a real time attack using log collection and analytic software.

CIS Control 09: Email and Web Browser Protections

Detect and protect against cybercrime attempted through email or the internet by directly engaging employees.

CIS Control 10: Malware Defenses

The prevention of the installation of propagation of malware onto company assets and networks.

CIS Control 11: Data Recovery

Data backup testing and restoration processes that allow organizations to recover company assets and to a pre-incident state.

CIS Control 12: Network Infrastructure Management

Procedures and tools for managing and securing a company's network infrastructure.

CIS Control 13: Network Monitoring and Defense

Monitoring and defending a company's network infrastructure against internal and external security threats.

CIS Control 14: Security Awareness and Skills Training

Establishment of security awareness and training program to reduce cybersecurity risk.

CIS Control 15: Service Provider Management

Evaluate third-party service providers that have access to sensitive data or are responsible for managing some or all of a company's IT functions.

CIS Control 16: Application Software Security

Safeguards that manage the entire lifecycle of software that is acquired, hosted, or developed in-house to detect, deter, and resolve cybersecurity weaknesses before they are exploited.

CIS Control 17: Incident Response Management

Establish an incident response management program to detect, respond, and prepare for potential cybersecurity attacks.

CIS Control 18: Penetration Testing

Test the sophistication of their cybersecurity defence system in place by simulating actual attacks in an effort to find and exploit weaknesses.