How to Augment a Cybersecurity Compliance Effort in Three Key Steps
Even with a large number of resources, the landscape seems so large and the risks so great. Where do you start, particularly when you already have some measures in place?
August 13, 2018 at 08:00 AM
7 minute read
The news of continued cyberattacks, suspected cyberattacks, ongoing state-sponsored influence operations, or any other number of buzzwords can leave security folks feeling overwhelmed and hopeless. Particularly for those of us who have spent time on the Blue Team (read: defenders), there's more than a kernel of truth in the old adage that the attacker must be right only once, and defenders must be right every time.
But that doesn't tell the whole story—there are techniques to slow attackers, detect attacks before they exfiltrate data, limit exposure, etc. Defense in Depth and Diversity of Defense are both very real techniques, but like many cybersecurity solutions, they require a large investment in time, money, and effort to be properly deployed and maintained. In fact, this is the single largest challenge for those tasked with defending high value networks and assets: Even with a large number of resources, the landscape seems so large, the risks so great, and opportunities for exploitation lurk around every corner. Where do you start—particularly when you've already got some security measures in place?
|Building the Plane While Flying It
In a perfect world, we could build our security and compliance efforts from the ground up to align perfectly with one of the recognized standards in the space, such as the National Institute of Standards and Technology's Cybersecurity Framework (NIST CSF) or the Center for Internet Security's Critical Security Controls. But we aren't starting from zero—most of us have at least some security operations, tools, or infrastructure in place. How do we make the most of previous investments, avoid the sunk cost fallacy, and make meaningful improvements to our security posture? Here are three steps to take to get you started on your journey to security maturity:
1. Situate Decisions in Your Own Context
It can be tempting to simply sit in front of a body of controls and start from the top, thinking you'll just implement them as listed and be done with the project—even if it takes years, you'll be making progress towards an industry-accepted standard. That, however, is not the best way to utilize these frameworks. Instead, consider the high level guidance (category-level for NIST or control-level for CIS) against your own risks and existing posture. Perhaps you've already got decent policies, procedures, people, and tools in place around asset management, and your time would be better spent focusing on vulnerability management or audit logs.
Many organizations prefer to take a “baseline” approach before a large implementation effort, also commonly called a “gap analysis,” looking at the current state of the organization with regards to the chosen framework as a way to prioritize efforts. Tools on the market can help provide that level of baseline compliance visibility, while also tailoring remediation efforts to those areas with the highest return on investment. Only you can make the final decision for your environment, and it must balance not only constraints (human capital, cost, level of effort, etc.), but also your current risk posture (baseline, gap analysis, etc.) as you chart the best path forward.
2. Start at the High Level Description, Decompose to Controls
If you choose one of the security frameworks mentioned above, you'll be able to take advantage of the fact that they offer security controls framed in natural language and an approachable level.
For example, both the NIST CSF and CIS Top 20 start with inventory and asset management. NIST offers the Asset Management Category, focusing on “[t]he data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes,” ensuring they “are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy.” CIS addresses Inventory and Control of Hardware Assets, noting you should “Actively manage (inventory, track, and correct) all hardware devices on the network so that only authorized devices are given access, and unauthorized and unmanaged devices are found and prevented from gaining access.” Both frameworks then offer subcategories or subcontrols to help you go from the “what” of asset management to the “how” one step at a time. Before you get to this level, make sure that you've considered the highest level approach in the context of your other efforts, as detailed in Step 1.
3. Integrate Efforts, Disseminate Information
Security, like business, doesn't happen in a vacuum. The process of maturing your organization will likely be a bit of a bumpy ride. You'll have some wins, and some projects that go well, but you will also undoubtedly run into challenges, discover additional areas that need remediation, need to shuffle priorities, and make difficult decisions with limited information. Such is the nature of both business and security, which is something practitioners can take advantage of to ensure they get the support they need to keep pressing forward.
As much as possible, try to frame your efforts in relationship to the business, or terms that are not specific to cybersecurity, such as “risk” or “trust.” Integrate efforts across the organization, quantifying projects in the potential for mitigation or cost savings, not just hard dollars or staff time needed to spend on any given project. Language that executives tend to pay attention to are often framed in aspects such as:
- Will your efforts increase resiliency?
- Better support new offerings from the business side?
- Create efficiencies that will reduce cost over time?
These are all things that you can highlight along with your cost and progress updates to help leadership understand exactly how your cybersecurity efforts are an investment beyond simply table-stakes, but one that's going to pay dividends.
|Embrace the Challenges
Finally, there's a challenge in growing a security practice that doesn't get enough consideration. As you start out, you're going to discover additional areas of vulnerability or risk. Perhaps you increase your vulnerability management capabilities and discover a large amount of previously unknown vulnerabilities that require mitigation. Perhaps your asset management project turns up a significant amount of rogue assets. Maybe you up your auditing game and find some logs that indicate compromise or other negative behavior. Don't bury these reports, mask the data, or try to minimize the optics of the situation. These risks were present in your enterprise before you started, only you had no idea they were there. Now, through your diligent efforts and helpful tools like security frameworks, you've gained visibility into the risks and can begin to address them in a way that makes sense.
One parting word for the practitioners, whose day-to-day efforts can be incredibly taxing: don't shy away from the process, embrace whatever you may find along the way, stay flexible and keep an open mind, and try to enjoy the ride—cybersecurity is one of the most interesting professional fields out there, and we're lucky to be able to work in it.
Shay Colson joined Duff & Phelps from the US Department of the Treasury to lead the Assessment Team for CyberClarity360. He has over a decade of experience in cybersecurity and information assurance, with a focus on designing and building secure systems. In his role with the US Department of the Treasury, Shay led vulnerability identification and technical security efforts, including serving as Security Lead for Treasury's cloud-based Integrated Talent Management Platform. Shay's expertise was exercised to identify, deliver and facilitate cybersecurity and risk management strategies that improve security posture.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllTrending Stories
- 1Call for Nominations: Elite Trial Lawyers 2025
- 2Senate Judiciary Dems Release Report on Supreme Court Ethics
- 3Senate Confirms Last 2 of Biden's California Judicial Nominees
- 4Morrison & Foerster Doles Out Year-End and Special Bonuses, Raises Base Compensation for Associates
- 5Tom Girardi to Surrender to Federal Authorities on Jan. 7
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250