Category: #IT/CYBER/TECHNOLOGY

The National Institute of Standards and Technology (NIST) Cybersecurity Framework, also known as the Framework for Improving Critical Infrastructure Cybersecurity and commonly referred to as CSF, is top of mind for many organizations.

Whether driven by the May 2017 Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, the need for a common framework between business partners or as a way to measure best practices, many organizations are considering adopting NIST’s framework as a key component of their cybersecurity strategy.

Initially designed by NIST to protect critical infrastructure, the framework is seeing much wider adoption across industries and organizations of various types and sizes. The CSF provides guidance and was built to be customized by organizations to meet their unique business and mission goals.

If you are embarking on implementing CSF, some areas to consider:

• CSF does not prescribe control “requirements.” The framework only provides a very high-level requisite. While this allows organizations to perform a security assessment against CSF, the depth of the assessment is open to organizational interpretation and preference. This can lead to an assessment that leaves weaknesses undetected, giving the organization a false sense of security posture and/or risk exposure.
• CSF does not make NIST SP 800-53 easier. If organizations use the NIST SP 800-53 requirements within the CSF framework, they must address the NIST SP 800-53 requirements per CSF mapping. This is not an easy task and generally requires additional focus.
• CSF control categories … to what end? Control categories (IRM, RM, and EP) provided with CSF are available, but it is up to the implementing organization to determine the alignment for each control and how it applies to their risks. It is not terribly clear how these categories improve the risk assessment results.
• CSF control tiers are not a maturity model. The CSF control tiers provided – partial, risk informed, repeatable, and adaptive – can be assigned to assessed controls. When used in aggregate, these tiers can provide an indication of the implementation level of the organization’s controls. However, if you are looking for a prescription, you might find that you are on your own. For example, CSF maintains that these tiers are not to be confused with a maturity model, so it’s up to you to decide if a ‘partial’ rating is (or is not) good enough for a particular risk.

True to any successful risk management framework, CSF or not, a suitable implementation requires a determination of business impact, risk appetite/tolerance and actual threat vectors, among other key variables. Proper knowledge and true understanding of one’s organizational risks is required when implementing CSF (or any risk management framework for that matter). By going about CSF the wrong way, your end results may belie the true state of your organization’s risk, resulting in false confidence in your current program and potentially misguided investments in resources.

Here are five practical tips to effectively implementing CSF:

1. Start by understanding your organizational risks.
2. Define your risk appetite (how much) and risk tolerance (acceptable variance).
3. Choose the CSF tier that best matches your business and mission (most likely you will end up with several tiers within the same organization).
4. Map existing frameworks (FISMA, ISO, COBIT) in your environment to CSF based on your business model.
5. Perform initial gap analysis, then use the findings to decide your CSF strategy.

It is best to plan on integrating CSF into your business as a long-term strategy. CSF is not a one-time, quick checklist, so best to allocate the proper resources to ensure a successful implementation for long-term, effective risk management.

Baan Alsinawi, President and founder of TalaTek

[ISACA Now Blog]

In the infancy of any technology, there are going to be teachable moments. Prehistoric man’s mastery of fire didn’t come without a few scorched fingers and the occasional multi-acre conflagration. As a species, our taming of fire and combustion enabled innovations in everything from cooking to metallurgy to transportation, to an array of other endeavors. Those innovations, however, required a continuous process for humans to learn and establish capabilities to control fire, to use it appropriately, and to make it work for humanity’s benefit.

What the discovery of fire meant to ancient humankind, the Internet is to our modern world: a reshaping force that has reconfigured the ways in which we interact and innovate. And—like our forebearers—we are still singeing our hands a bit as we learn to operate appropriately in our evolving digital society. No matter whether we are enterprises or individuals, we must continue to develop and mature our capabilities to embrace and cope with new technologies and the resulting data that offer so much positive potential.

Data is not the new “oil” anymore. Data is the new “air.” It has become more than economic fuel; it is a catalyst of innovation, of disruption, and of possibilities. However, it’s never a guarantee that all innovations, disruptions and possibilities will be positive ones. Creating fire was one of early humanity’s greatest accomplishments. It also made arson possible. We still need to learn how to harness data and the Internet for positive benefit—as well as to manage and mitigate its risks. In the data we generate, just as there is great value, there also is great risk. We need to understand both and plot our digital pathways accordingly.

Facebook CEO Mark Zuckerberg’s recent moments on Capitol Hill made our need to digitally evolve even more stark. His testimony made the spotlight already focused on data and privacy even brighter. If nothing else was accomplished by his interactions with Congress, he has surfaced important and thought-provoking issues worthy of continued discussion—discussion that needs the active participation of policymakers, regulators, industry executives, academic leaders and individual citizens concerned about the use of their personal data.

Zuckerberg’s appearance in Washington, DC came in the aftermath of a data scandal involving a UK-based political data firm that improperly accessed data of millions of Facebook users. Pointing a finger at Facebook and asking, “How did this happen?” may feel cathartic, but it misses the larger point. This happened because the digital world in which we are now living continues to evolve faster than we have developed internationally accepted standards. This happened because, absent of such standards, evolution within the global regulatory and public policy realm has been unable to keep pace with the rapid advancement of technology.

During his testimony, Zuckerberg admitted mistakes, accepted responsibility, and promised to do better—and then was grilled about many of those mistakes and the path forward. While Facebook has pledged expanded efforts to protect its users’ data, including giving users a better understanding of which apps can access their data and providing developers less access to data without users’ expressed consent, the revised approach going forward should not be Facebook’s responsibility alone. We, as individuals, have to accept some responsibility, too. In an odd sort of way, people have become data-driven companies in their own right. We must be proactive in the protection of our personal information, profiles, data and privacy rights.

The urgent need for sound data protection has reached new heights globally thanks to the arrival of the long-anticipated General Data Protection Regulation (GDPR), which is now in effect. ISACA research conducted in the weeks leading up to the deadlineshows that prioritizing GDPR compliance among other business priorities is among the leading challenges that organizations face. While balancing enterprise priorities amid a disruptive and fast-evolving technology landscape is no easy task, protecting customers’ personal information – whether mandated by GDPR or otherwise – must be a priority, and therefore not relegated to being treated as a secondary consideration.

Data is the new air, and leveraging its positive potential is essential to catalyze innovation, progress, and  to create new value. To inspire assurance and confidence that the appropriate data protection efforts are in place, implementation of more rigorous and robust information/data governance is not an option; it has become a must. We may also need consensus-based standards to shape the right governance environment, ultimately making it easier to comply with any new policies and regulations that will come forward in the future. Without these conditions in place and lacking a collective commitment to collaboration, breathing this new air will become far more difficult.

Editor’s note: This article originally appeared in CSO.

Matt Loeb, CGEIT, CAE, FASAE, Chief Executive Officer, ISACA

[ISACA Now Blog]

The European Cybersecurity Act, proposed in 2017 by the European Commission, is the most recent of several policy documents adopted and/or proposed by governments around the world, each with the intent (among other objectives) to bring clarity to cybersecurity certifications for various products and services.

The reason why cybersecurity, and most recently privacy, certifications are so important is pretty obvious: They represent a vehicle of trust and serve the purpose of providing assurance about the level of cybersecurity a solution could provide. They represent, at least in theory, a simple mechanism through which organizations and individuals can make quick, risk-based decisions without the need to fully understand the technical specifications of the service or product they are purchasing.

What’s in a certification?

Most of us struggle to keep pace with technological innovations, and so we often find ourselves buying services and products without sufficient levels of education and awareness of the potential side effects these technologies can bring. We don’t fully understand the possible implications of adopting a new service, and sometimes we don’t even ask ourselves the most basic questions about the inherent risks of certain technologies.

In this landscape, certifications, compliance audits, trust marks and seals are mechanisms that help improve market conditions by providing a high-level representation of the level of cybersecurity a solution could offer.

Certifications are typically performed by a trusted third party (an auditor or a lab) who evaluates and assesses a solution against a set of requirements and criteria that are in turn part of a set of standards, best practices, or regulations. In the case of a positive assessment, the evaluator issues a certification or statement of compliance that is typically valid for a set length of time.

One of the problems with certifications under the current market condition is that they have a tendency to proliferate, which is to say that for the same product or service more than one certification exists. The example of cloud services is pretty illustrative of this issue. More than 20 different schemes exist to certify the level of security of cloud services, ranging from international standards to national accreditation systems to sectorial attestation of compliance.

Such a proliferation of certifications can serve to produce the exact opposite result that a certification was built for. Rather than supporting and streamlining the decision-making process, they could create confusion, and rather than increasing trust, they favor uncertainty. It should be noted, however, that such a proliferation isn’t always a bad thing. Sometimes, it’s the result of the need to accommodate important nuances of various security requirements.

Crafting the ideal certification

CSA has been a leader in cloud assurance, transparency and compliance for many years now, supporting the effort to improve the certification landscape. Our goal has been—and still is—to make the cloud and IoT technology environment more secure, transparent, trustworthy, effective and efficient by developing innovative solutions for compliance and certification.

It’s in this context that we are surveying our community and the market at-large to understand what both subject matter experts and laypersons see as the essential features and characteristics of the ideal certification scheme or meta-framework.

Our call to action?

Tell us—in a paragraph, a sentence or a word—what you think a cybersecurity and privacy certification should look like. Tell us what the scope should be (security/privacy, product /processes /people, cloud/IoT, global/regional/national), what’s the level of assurance offered, which guarantees and liabilities are expected, what’s the tradeoff between cost and value, how it should be proposed/communicated to be understood and valuable for the community at large.

Tell us, but do it before July 2 because that’s when the survey closes.

Daniele Catteddu, CTO, Cloud Security Alliance

[Cloud Security Alliance Blog]

SEATTLE, WA and LONDON – JUNE 5, 2018 – InfoSecurity Europe Conference – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, today released the CSA Code of Conduct (CoC) Self-Assessment. An essential tool for those charged with General Data Privacy Requirements (GDPR) compliance, the CSA CoC Self-Assessment provides a transparent means for standardizing compliance initiatives.

“The CSA Code of Conduct for GDPR Compliance is a comprehensive and complete resource for supporting cloud providers’ compliance and fostering accountability and transparency in the market. Today, with the release of the CSA CoC Self Assessment, we are offering cloud service providers the opportunity to openly demonstrate to business partners and regulators evidence of their adherence to the GDPR requirements. The CSA CoC Self Assessment acts as the assurance and transparency component of the STAR Program,” said Daniele Catteddu, CSA Chief Technology Officer, lead outside counsel and Privacy Level Agreement (PLA) Working Group co-chair. “We believe it will go a long way toward providing the industry with a standard for accurate compliance with the GDPR.”

“The release of the CSA CoC Self Assessment serves two purposes,” said Paolo Balboni, European ICT, privacy and data protection lawyer, and co-chair of the PLA Working Group. “First, to afford cloud service providers (CSP) a means to demonstrate, in a structured way, the level of personal data protection they offer, and second, to provide cloud customers and potential customers a tool to evaluate and compare the level of personal data protection offered by various CSPs. And while the CSA CoC Self-Assessment is not verified by a qualified third-party, it does offer transparency regarding the level of protection offered by a cloud service provider.”

CSPs and cloud customers that would like to adhere to the CSA CoC for GDPR should submit the CoC Statement of Adherence and PLA Code of Practice (CoP) Template – Annex 1 using the STAR submission form found here. CSA will then verify that a “good faith” effort has been made to thoroughly address the entire Code of Conduct and then will publish the Self Assessment on STAR. The applicant will receive a self-attestation compliance mark once all the necessary conditions are satisfied.

Those interested in learning more about the CSA Code of Conduct for GDPR Compliance should visit the CSA GDPR Resource Center, a community-driven website with tools and resources to help educate cloud service providers and enterprises on the new European data protection regulation.

The CSA PLA Working Group is comprised of independent privacy and data protection subject matter experts, privacy officers, and representatives from data protection authorities. It was formed in 2012 to help transpose the Art. 29 WP and EU National Data Protection Regulators’ recommendations on cloud computing into an easy-to-use outline for CSPs to follow when disclosing personal data-handling practices. The scope and objective of the PLA initiative were previously presented to the European Parliament as part of discussions on the potential effect of the proposed General Data Protection Regulation on cloud computing. Since then, the PLA Working Group engages in defining a structured method for communicating the level of privacy that a CSP agrees to maintain.

About Cloud Security Alliance

The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. CSA harnesses the subject matter expertise of industry practitioners, associations, governments, and its corporate and individual members to offer cloud security- specific research, education, certification, events and products. CSA’s activities, knowledge and extensive network benefit the entire community impacted by cloud — from providers and customers, to governments, entrepreneurs and the assurance industry — and provide a forum through which diverse parties can work together to create and maintain a trusted cloud ecosystem.

Media Contact

Kari Walker for the CSA
ZAG Communications
703.928.9996
kari@zagcommunications.com

[Cloud Security Alliance Research News]

Many analyses of cybersecurity include consideration of the field’s constant state of flux and change. As the battlefield of the internet evolves, typically, so do the attack strategies, weapons, defense mechanisms and actors. However, according to ISACA’s 2018 State of Cybersecurity research, two elements that remain relatively constant are the types of attackers and the type of attack leveraged.

Specifically, based upon the input of respondents, the report noted that while attacks are increasing, outside of certain niche variants, the types of attacks have remained constant, with monetary theft as the main aim of most attackers. These trends identify that while certain cybersecurity considerations change, proven attackers, victims and attack processes will never go out of style.

Deeper examination of the report provides a greater understanding of the static trend of attack types by malicious actors. Survey respondents indicate that the three main attack mechanisms leveraged against their organizations are phishing, malware and social engineering. When compared to the 2017 report, this trend remains mostly static, with minimal variation.  Additionally, the cybercriminal attacker profile remained steady as the attacker type.

While the main attack vectors and actors remain primarily static, the number of attacks are increasing dramatically, with the majority of respondents indicating that the number of attacks they are experiencing are increasing year over year. This trend could be due to multiple considerations. For example, as artificial intelligence (AI) enables business processes, malicious agents can also leverage AI to streamline attacks. This increase in efficiency allows an attacker to conduct more attacks with less infrastructure. Additionally, greater accessibility to the growing dark web allows attackers to work together more easily than in the past.

Though attackers might leverage certain tools to increase their operational efficiency, and thus their attack capability, others have found themselves largely relegated to the dustbin. Specifically, the report identified a substantive decrease, nearly 20%, in ransomware attacks. This might seem shocking considering high-profile ransomware incidents such as the one that recently hit the city of Atlanta in the United States, wherein many city operations remained crippled for more than a week. However, deeper analysis identifies that most organizations now have a response plan inclusive of a potential ransomware attack and are less willing to pay the ransom requested by attackers.

The decrease in ransomware attacks, coupled with the steady state of phishing, malware and social engineering, hint at one of the basic truisms of cybersecurity – the greatest weakness in organizations is often its individuals. When considering ransomware response, it’s easy to identify that proper backup policies and procedures can render an organization relatively ransomware-proof. If an attack occurs, cybersecurity response teams can commence mitigation by rolling out the most recent proven backup image to the impacted machines while hardening them from subsequent attack. This action is relatively independent of individual sentiment and discernment. However, phishing and social engineering are still reliant, primarily, upon the discernment of an individual expected to implement proper cybersecurity hygiene in his or her daily activities.

Although attacks are on the rise, it is important to remember that efforts to combat them are increasing as well. Indeed, based upon analysis of the report, the defense mechanisms and policies established by organizations can act as indicators as to why ransomware attacks are declining. Yet, while certain niche attacks might change over time, proven attack tools, such as phishing, social engineering, and malware, are here for the long-haul. As long as individuals do not practice appropriate cybersecurity hygiene, they will remain the main attack methods for malicious actors who are attempting to defraud organizations.

Frank Downs, Director and SME, Cyber Security Practice, ISACA

[ISACA Now Blog]