Responsible Security and Responsible Disclosure: Why a VDP Matters
No organization has perfect security, so a VDP serves as one layer of many in a mature vulnerability management program. Learn about what a VDP…
Forbes reports that 70% of firms experienced at least one cybersecurity incident in 2017. In the past year alone, Yahoo’s $4.8B takeover by Verizon was nearly derailed by two major data breaches at Yahoo; even the US presidential election may have been impacted by hackers. And the risks are only growing – cars are computers on wheels and planes are computers on wings. Cybersecurity risk has evolved from just personnel information and financial data to control of physical things.
In 2015, the US government notified 3,000 companies that they were attacked. According to PWC’s 2016 annual cybersecurity survey, organizations detected a 38% rise in information security incidents. These dire statistics are getting attention and is increasing the expectations for risk and compliance managers to effectively manage cybersecurity risks.
According to Cisco’s 2017 Cybersecurity report, 69% of senior executives are taking action and re-engineering their approach to cybersecurity. Organizations are incorporating intrusion detection tools, actively monitoring and analyzing information security intelligence, using threat intelligence subscription services, and conducing penetration tests. But how does an organization know it’s working?
A few questions that information risk managers should ask themselves are:
These questions inevitably lead us to the importance of managing an ongoing and increasingly sophisticated threat and vulnerability assessments program. Such a program will provide a pulse on the effectiveness of tactical tools and processes put in place.
In February 2013, the United States President issued an Executive Order (13636) to “Improve Critical Infrastructure Cybersecurity.” This order was translated into a policy – NIST’s Cybersecurity Framework. This Framework is intended to complement existing risk and compliance activities. However, it provides a starting point for organizations to manage cybersecurity risk.
The Framework’s Core is a set of cybersecurity activities, desired objectives, and applicable references. This can form a high-level structure around which companies can identify vulnerabilities, threats, mitigations, monitoring, and improvements specific to their industry, internal processes, and systems. Five continuous and concurrent functions make up the Framework Core.
Identify – Activities to improve the organization’s understanding of business context and resources that may drive cybersecurity risk to systems, assets, data, and capabilities
Protect – Activities to develop safeguards to limit the impact of threat events
Detect – Activities to develop monitoring and detection processes to identify potential threat actors and events
Respond – Activities to support containment of threat events if they occur
Recover – Activities to enables organizations to develop resilience to threats and restore capabilities impaired by a threat event
A critical component of executing on the NIST Cybersecurity Framework is a comprehensive set of mitigations and controls to operationally manage safeguards in place. Security risk managers in the organization define and manage these controls. NIST provides a strong starting point to begin development of these controls and mitigations through the NIST Special Publication 800-53 controls.
In summary, NIST offers risk managers comprehensive frameworks to design and directionally validate the exhaustiveness of their threat and vulnerability assessments programs. As intensity and impact of cyberattacks increase, organizations should focus on monitoring and preempting risk to internal operations and customers through a predictive and exhaustive assessment program.
No organization has perfect security, so a VDP serves as one layer of many in a mature vulnerability management program. Learn about what a VDP…
As regulations change, your company must deploy additional resources to understand the relevant rules in order to develop the appropriate workflows. With the systematic approach…
LogicGate's Senior Information Security Analyst, Anthony Matar, discusses the 3 most common policy management pitfalls and how to avoid them.