In the next six phases, we’ll explore the six (6) key components of a sound cybersecurity foundation, a Cybersecurity Plan, based on the NIST Cybersecurity Framework and we’ll cover industry best practices and solutions like risk management, incident response (IR) planning and managed detection and response (MDR) – tools you can use to buildout an effective, practical threat management strategy.
Essentially Cyber Hygiene is like any kind of hygiene, it’s the daily practice of
taking care of those things that could deteriorate over time if not given the proper
attention, like brushing your teeth twice a day-fundamental practice of
maintaining a healthy security environment. Some of the practices may include
proper inventory of software and hardware assets, continuous scanning of system
vulnerabilities, etc. To increase Cybersecurity Hygiene, our Framework
addresses six (6) functional areas consisting of:
- Govern - What is the Cybersecurity Risk, Management Strategy, Expectations, and Policies established, communicated, and monitored?
- Identify - What processes and assets need protection?
- Protect - What safeguards are available?
- Detect - What techniques can be used to identify incidents?
- Respond - What techniques can be used to contain impacts of incidents and mitigate?
- Recover - What techniques can restore capabilities?
Protecting your organization is an ongoing process, a layered approach, and it requires careful planning. But with the right people, technology, policies, and governance in place, you’re more likely to find and fix vulnerabilities, detect, and thwart threats and avert disaster. Getting there isn’t necessarily easy, but you don’t have to do it alone. Our Cyber Hygiene Roadmap can help you cut through the clutter, complexity, and confusion.
Phase 1: Govern (GV) - What is the Cybersecurity Risk, Management Strategy,
Expectations, and Policies established, communicated, and monitored?
Good governance is a critical aspect of any organization, as it helps to ensure that the organization is accountable, transparent, and responsive to the needs and expectations of its stakeholders. Good governance practices can also improve the efficiency and effectiveness of an organization and contribute to its overall performance and cybersecurity goals. NIST V2.0 has updated the CSF’s core guidance and created a suite of resources to help all organizations achieve their cybersecurity goals, with added emphasis on governance.
Phase 2: Identify (ID) - What processes and assets need protection?
You can’t protect what you can’t see, and the first step in the threat management lifecycle is about making sure you see into every corner of your organization. You’ll identify your assets, their risks and vulnerabilities, their priority levels and, finally, your specific plans to protect them. Before you can begin to make those plans, you must know what apps you’re running and on what devices, how your network is structured, what data you’re using and storing and how your users are accessing it all. You must know the risks associated with each asset and prioritize those assets so you can manage risks accordingly.
Phase 3: Protect (PR) - What safeguards are available?
Protecting your organization is an ongoing and multi-threaded effort. Taking a risk-based approach is key to bringing your routine threat management activities to life, as documented in your Cybersecurity Plan highlighted by cybersecurity policies and procedures.
Phase 4: Detect (DE) - What techniques can be used to identify incidents?
Organizations with even the strongest security controls can be compromised, but the faster a security incident can be identified and contained, the lower the costs associated with it. Bad actors such as ransomware groups can have your systems encrypted within an hour of gaining entry. That’s why detecting incidents as soon as possible is crucial.
Unfortunately, it can take months to detect and contain a breach. According to the 2021 IBM Cost of a Data Breach report, it takes 287 days on average – 212 days to identify a breach and another 75 days to contain it. A breach with a lifecycle over 200 days costs an average of $4.87 million versus $3.61 million for one with a lifecycle of less than 200 days, representing a difference of almost 30%. The differences in impact are substantial when you can detect and contain a threat in minutes versus hours, days or even months. According to recent research, smaller organizations are less likely to detect breaches in a timely manner than larger ones. Regardless of the size of the organization, 80% of breaches are discovered by external parties, a number that clearly indicates the need for organizations to put more emphasis on threat detection and response operations.
Phase 5: Respond (RS) - What techniques can be used to contain impacts of incidents and mitigate?
When a breach happens, it’s critical to have an incident response plan in place that can immediately guide you through each stage of response. During an incident is not the time for determining your policy on paying a ransom or identifying your key stakeholders. That’s what your incident response plan, discussed in Phase 1, is for. Your incident response plan is not a one-and-done exercise. It’s a living document that must be tested and updated regularly. Each person must understand their role and responsibilities in order for your organization to respond
effectively. It’s also not a one-size-fits-all document. Your planned response to ransomware will be different than your response to a data breach, which will be different than your response to a lost or stolen device. Your incident response plan should include different playbooks to reflect different potential risks and scenarios. It should also reflect different potential threat vectors. Malicious data breaches occur through a wide range of threat vectors, including compromised credentials, cloud misconfigurations, vulnerabilities in third-party software and phishing. In fact,
according to IBM research, those vectors account for nearly 75% of all malicious data breaches.
It often makes sense for an organization to seek outside expertise at this point in order to minimize the damage of an attack. Having access to SOC and incident response capabilities can dramatically shorten your mitigation and recovery time. Ideally, you’ve engaged an MDR provider that can move seamlessly into incident response when the time comes.
Phase 6: Recover (RC) - What techniques can restore capabilities?
The goal of recovery is to move from the immediate aftermath of an incident to full restoration of normal systems and operations,” says the National Cybersecurity Alliance. Like all the other components of the threat management strategy, it requires thoughtful planning to fully restore normal systems and operations. Recovery often begins immediately on the heels of – or overlaps with incident response.
About the MCCoE
The Missouri Cybersecurity Center of Excellence (MCCoE) is a non-profit (501.c.3), Public-Private Partnership between Academia, Industry, Non-Profits and Government, security operations center that brings together academia, small to medium sized businesses, government agencies, and the community. The MCCoE provides security services for businesses and agencies utilizing the skills and
knowledge of the key cybersecurity professionals, professors, and students. By providing a rich and interactive learning environment, we build the next generation of cybersecurity professionals, connect the right people to the right careers, and close the gap in demand for these professionals in the State of Missouri regional workplace. By capitalizing on Missouri’s unique strengths in this expanding and future-oriented field of cybersecurity, the MCCoE, based in Springfield, aims to create “career ready” students while growing the regional economy by providing Cybersecurity Services to the regional community strategically teamed with the regional colleges and universities to provide hands-on training, certifications and real-work experiences and accelerated innovation, while creating workforce development combined with a coordinated and collaborative cybersecurity strategy to strengthen our Region, our State, and our Nation.
