LTN Cybersecurity Feature

 

The news of continued cyberattacks, suspected cyberattacks, ongoing state-sponsored influence operations, or any other number of buzzwords can leave security folks feeling overwhelmed and hopeless. Particularly for those of us who have spent time on the Blue Team (read: defenders), there's more than a kernel of truth in the old adage that the attacker must be right only once, and defenders must be right every time.

But that doesn't tell the whole story—there are techniques to slow attackers, detect attacks before they exfiltrate data, limit exposure, etc. Defense in Depth and Diversity of Defense are both very real techniques, but like many cybersecurity solutions, they require a large investment in time, money, and effort to be properly deployed and maintained. In fact, this is the single largest challenge for those tasked with defending high value networks and assets: Even with a large number of resources, the landscape seems so large, the risks so great, and opportunities for exploitation lurk around every corner. Where do you start—particularly when you've already got some security measures in place?

Building the Plane While Flying It

In a perfect world, we could build our security and compliance efforts from the ground up to align perfectly with one of the recognized standards in the space, such as the National Institute of Standards and Technology's Cybersecurity Framework (NIST CSF) or the Center for Internet Security's Critical Security Controls. But we aren't starting from zero—most of us have at least some security operations, tools, or infrastructure in place. How do we make the most of previous investments, avoid the sunk cost fallacy, and make meaningful improvements to our security posture? Here are three steps to take to get you started on your journey to security maturity:

1. Situate Decisions in Your Own Context

It can be tempting to simply sit in front of a body of controls and start from the top, thinking you'll just implement them as listed and be done with the project—even if it takes years, you'll be making progress towards an industry-accepted standard. That, however, is not the best way to utilize these frameworks. Instead, consider the high level guidance (category-level for NIST or control-level for CIS) against your own risks and existing posture. Perhaps you've already got decent policies, procedures, people, and tools in place around asset management, and your time would be better spent focusing on vulnerability management or audit logs.

Many organizations prefer to take a “baseline” approach before a large implementation effort, also commonly called a “gap analysis,” looking at the current state of the organization with regards to the chosen framework as a way to prioritize efforts. Tools on the market can help provide that level of baseline compliance visibility, while also tailoring remediation efforts to those areas with the highest return on investment. Only you can make the final decision for your environment, and it must balance not only constraints (human capital, cost, level of effort, etc.), but also your current risk posture (baseline, gap analysis, etc.) as you chart the best path forward.

2. Start at the High Level Description, Decompose to Controls

If you choose one of the security frameworks mentioned above, you'll be able to take advantage of the fact that they offer security controls framed in natural language and an approachable level.

For example, both the NIST CSF and CIS Top 20 start with inventory and asset management. NIST offers the Asset Management Category, focusing on “[t]he data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes,” ensuring they “are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy.” CIS addresses Inventory and Control of Hardware Assets, noting you should “Actively manage (inventory, track, and correct) all hardware devices on the network so that only authorized devices are given access, and unauthorized and unmanaged devices are found and prevented from gaining access.” Both frameworks then offer subcategories or subcontrols to help you go from the “what” of asset management to the “how” one step at a time. Before you get to this level, make sure that you've considered the highest level approach in the context of your other efforts, as detailed in Step 1.

3. Integrate Efforts, Disseminate Information

Security, like business, doesn't happen in a vacuum. The process of maturing your organization will likely be a bit of a bumpy ride. You'll have some wins, and some projects that go well, but you will also undoubtedly run into challenges, discover additional areas that need remediation, need to shuffle priorities, and make difficult decisions with limited information. Such is the nature of both business and security, which is something practitioners can take advantage of to ensure they get the support they need to keep pressing forward.

As much as possible, try to frame your efforts in relationship to the business, or terms that are not specific to cybersecurity, such as “risk” or “trust.” Integrate efforts across the organization, quantifying projects in the potential for mitigation or cost savings, not just hard dollars or staff time needed to spend on any given project. Language that executives tend to pay attention to are often framed in aspects such as:

  • Will your efforts increase resiliency?
  • Better support new offerings from the business side?
  • Create efficiencies that will reduce cost over time?

These are all things that you can highlight along with your cost and progress updates to help leadership understand exactly how your cybersecurity efforts are an investment beyond simply table-stakes, but one that's going to pay dividends.

Embrace the Challenges

Finally, there's a challenge in growing a security practice that doesn't get enough consideration. As you start out, you're going to discover additional areas of vulnerability or risk. Perhaps you increase your vulnerability management capabilities and discover a large amount of previously unknown vulnerabilities that require mitigation. Perhaps your asset management project turns up a significant amount of rogue assets. Maybe you up your auditing game and find some logs that indicate compromise or other negative behavior. Don't bury these reports, mask the data, or try to minimize the optics of the situation. These risks were present in your enterprise before you started, only you had no idea they were there. Now, through your diligent efforts and helpful tools like security frameworks, you've gained visibility into the risks and can begin to address them in a way that makes sense.

One parting word for the practitioners, whose day-to-day efforts can be incredibly taxing: don't shy away from the process, embrace whatever you may find along the way, stay flexible and keep an open mind, and try to enjoy the ride—cybersecurity is one of the most interesting professional fields out there, and we're lucky to be able to work in it.

 

Shay Colson joined Duff & Phelps from the US Department of the Treasury to lead the Assessment Team for CyberClarity360. He has over a decade of experience in cybersecurity and information assurance, with a focus on designing and building secure systems. In his role with the US Department of the Treasury, Shay led vulnerability identification and technical security efforts, including serving as Security Lead for Treasury's cloud-based Integrated Talent Management Platform. Shay's expertise was exercised to identify, deliver and facilitate cybersecurity and risk management strategies that improve security posture.