Exploring Security Frameworks: Part 1

0:00So as we jump into our discussion on security frameworks, I think it's really important to answer the question, why do security frameworks really matter? And the short answer to that is security frameworks give us the playbook for how we're going to implement security in our environment. And this is really important because modern IT environments are increasingly complex and interconnected. These are going to span things like on premise systems, cloud services, mobile endpoints, and third party integrations.

0:40So there's a lot of different things that we have to get working together and without a coherent plan, organizations are going to struggle to defend against an increasingly diverse range of threats. Now, the question becomes, given this challenge of how we approach these different threats, we have to have, like we said, a really good game plan. So how is it that we're going to address this with a security framework? How does this help?

1:10Well, the first thing we're going to do is we're going to establish baseline controls. And this is going to include covering things such as, how are we going to secure our data? How are we going to secure our devices? And that's not just things like PCs and servers, but of course, all of our networking equipment. And as we move into smart devices, those need to be protected as well. We need to make sure that they're secured. Even things like printers could be compromised. And of course, that is also going to include the network itself.

1:44And again, that's really talking about things like our routers, our switches, providing things like firewalls, intrusion prevention systems, and so on. Next, we're going to provide the methodologies that we're going to use for assessing the risk and prioritizing our mitigation efforts. Again, this is basically setting out what our plan is going to be, not only to prevent things from happening, but also how do we handle things if they do happen?

2:14So again, that's where the mitigation comes into play. We can also use our security framework to enable compliance. And this could be to any number of standards. There are industry standards, and there are governmental standards that we may have to comply with depending what this exact company does. So for example, if your company does something medically related, particularly if they're dealing with patient records and patient information, there are HIPAA laws that we have to abide by in the United States and other countries around the world have their own privacy laws as well.

2:52Also, if you deal with financials, there are a lot of regulations from the government around financial security and such, handling credit card information, things along those lines. So there's a lot of standards out there that we have to make sure that we're in compliance with either government regulation or again, just private sector standards, that we want to make sure we meet to give our customers that peace of mind, that our network and our environment is secure. We also of course need to have support for the incident response planning.

3:25What do we do in response to something that actually does occur? How do we mitigate that? And how do we moving forward? Make sure that doesn't happen again. So that's going to involve ongoing security assurances as well to make sure that any problems that do occur don't happen moving forward. Now, like most things, security frameworks are going to have some key components that we want to be aware of as we move forward. Here we have a list of them all.

3:56Let's go over each one individually. So first, we have our policies and procedures, policies and procedures, define the rules, the responsibilities, actions that must be taken to protect sensitive information and systems. This is going to cover things such as data classification, access control, incident response, and a whole lot more. Then we have risk management. This is going to cover the methodologies for identifying vulnerabilities, assessing potential threats and determining the potential impact of security incidents.

4:33What's going to happen if we do have some sort of an issue in our environment? And of course, one of our other goals is going to make sure that these things actually don't happen. So that's where security controls come into play. These are going to be specific measures and mechanisms that we're going to implement to safeguard our IT systems. This can include all sorts of things such as firewalls, encryption, intrusion prevention systems, access control policies, and even security training, physical control surveillance.

5:07So camera systems, access badges, all sorts of things. There's a lot of things that fall under security controls, but these are all the things that we have in place to try to ensure that we don't have to deal with the risks. There's always going to be risks, of course, but we want to make sure that we mitigate that as much as possible. Next up is compliance. And again, we've sort of already discussed this, but again, the main idea here is we have to meet regulatory requirements. And industry standards.

5:38And again, that might just be industry standards. It can also, of course, be government regulations as we sort of already discussed there. The other thing we have to do is have continuous monitoring. We have to understand what's going on in our environment. So we have to continually monitor and assess our currently implemented security measures. We need to review our structure, do audits to make sure that everything is as we expect it to be and that our environment is being protected as it should be.

6:09And we have to keep up with any ongoing or new threats and vulnerabilities. Now, of course, no matter how careful we are, there can still be an incident. So, of course, the whole idea behind incident response is we have to be prepared to effectively manage and mitigate the impact of any security breaches . So there has to be a plan. We don't want to wait till something happens and then go, Oh, my goodness. What do we do now? We should already know what we're going to do in response to different instances.

6:43So that, of course, is going to involve trying to think things through and figure out what are the potential things that could go wrong. Now, again, if possible, we want to then mitigate that. So we might want to revisit our policies and procedures to see if there's something we can do to prevent any thought of instance. But we do still need to make sure we have an incident response plan in place in case something that we didn't think of actually does happen. Of course, I think one of the biggest and most important things to talk about with the security framework is training and awareness.

7:19This one really is key. Because if I'm being completely honest in all of the security testing that I've ever done and penetration testing that I performed. Some of the weakest areas in most corporations are the employees, the humans, and it's because of training and awareness. So for me personally, I think this is one of the most important things because those of us trained for security. We really understand all the rest of these things.

7:49We're going to do our best on all of these other aspects. But that doesn't help us if the security guard escorts a stranger into the server room and gives them full access. And I have had that happen. I personally have done penetration testing at a company where I have gone to what was supposed to be a secure and at the time closed facility. The way I got in, I busted in the front door, ran right up to the security guard. I said, listen, we're having a breach. We have to get to the email server immediately to stop this from spreading to the entire company.

8:22They called me in on my way home from dinner. I've got to get into the server room now and stop this threat. And I had the security guard actually badge me in to their server room. So I can tell you the first thing on my security analysis that I turned into the company was I'm standing in your server room. It's that simple. Never should have happened. They didn't ask for ID. He didn't ask for anything. Now, that's just an example of what I'm talking about where that guard was clearly lacking training and awareness.

8:55They should have known never to let anybody into that building under any circumstances without proper authorization. Again, I didn't have ID. I didn't have anything. And I was standing right in their server room. And as I'm sure most of you are aware, having physical access to something is the first step in getting full access to it. And one last thing that we want our security framework to handle is going to be vendor management. We are going to have third party vendors involved in our network.

9:25So we want our security framework to address third party vendor relationships. It should have guidelines for evaluating the security practices of the different vendors and ensuring that their products and service meet the organization's security requirements. We want to make sure that we're not bringing in a third party product that is then going to introduce a vulnerability point into our network. [ raise your hand ]

0:00So now that we understand the basics of the security framework and how it's again going to act as a playbook for how we run the security in our environment, let's talk about some of the common frameworks. Now there's a lot out there. We're going to be focusing here on three of the biggest ones. The first one is the NIST, or the National Institute of Standards and Technologies. NIST produces something called the Cybersecurity Framework or the CSF.

0:34They also produce a lot of special publications. These are called things like SP800-53. There's of course a bunch of them. This is just an example. But these resources help both public and private sector organizations structure their cybersecurity program around our core functions. What are those core functions? There's identify, protect, detect, respond, recover, and govern.

1:06Now we are going to be covering each of these frameworks in much more detail in the upcoming lessons. So we're not going to focus on the details of each one of these things right now, but these are the basic core values that are supplied by the NIST CSF. Another function of the NIST is to emphasize risk-based decision making. It's also widely regarded for its depth and adaptability to be put into place in many different environments.

1:40So NIST CSF is a very, very common security framework. Another common security framework that we want to look at is the CISA or the Cybersecurity and Infrastructure Security Agency. This is actually part of the US Department of Homeland Security, so this is a government agency and it is responsible for protecting critical infrastructure. It actually publishes different guidances, toolkits, best practices that we should use in our environments.

2:15And again, they may be more aimed towards government infrastructure, however they can apply to the private sector just as much. One of the aims of the CISA is to improve resilience. That's one of their main focuses. And as such, this makes it very, very helpful in things like operational security, helping with incident management. Again, what do we do if something does occur and public-private threat coordination? In other words, handling things that happen between government agencies and the private sector.

2:49So those are the main focuses of the CISA. Again, we'll be covering this in more detail coming up. And finally, we have the DISA or the Defense Information System Agency. This one is really oversight for the US Department of Defense or the DOD. So this is the agency that's pretty much in charge of how the Department of Defense runs their networks. They produce sort of two major things that we want to be aware of.

3:21The first one is the Security Technical Implementation Guidelines or the STIGs. These are implementation guides, again, telling us how we should do certain things. We also have, of course, the Security Requirements Guide or the Sargis. And these pretty much tell us what the STIGs should do. So one of them is the Requirements Guide, of course. And the other one is how we actually implement things to meet those requirements.

3:55Now again, this is really for government defense contexts, but it's also not necessarily bad to look at the practices for the private sector. This framework also helps to ensure compliance, again, with the Security Requirements Guides, the interoperability, so things, of course, will still work together, and mission assurance to make sure that everything happens the way it's supposed to. Now this is a very prescriptive framework, which means there's not a whole lot of flexibility here is that it ensures the compliance, the interoperability, and the mission assurance in a high security environment.

4:35And finally, let's talk a little bit about how we would actually apply some of these frameworks in actual practice. The first thing to understand, organizations are going to choose which frameworks they're going to use. And again, they could take aspects from different frameworks or choose to implement all of them. This is, of course, entirely up to the organization, but it's going to be based sort of on two major things. First is their industry. As I mentioned before, depending on what industry this organization is involved with, things like financial, medical, military, or DOD contracts, they may have to abide by certain security frameworks.

5:19There are going to be regulations that they have to abide by depending on their industry. And another part of this is what's their actual risk profile. What this is referring to is the risk that a company is willing to take in contrast to the security mechanisms that they want to implement. Remember, it's all coming down to money at the end of the day. Implementing security frameworks is expensive. We have to buy additional hardware. We have to implement practices.

5:50We have to invest in training. I mean, there's a lot of things involved in implementing a security framework. And depending on what that company does, it may or may not be worth that financial investment. I don't think that a barber shop down on the corner called Bob's Haircuts is going to worry too much about implementing security on their network to the point of a DOD contractor. They don't have that much to protect. What's the worst that's going to happen? Somebody's going to break into their network and get a list of their customers or their customers' addresses.

6:25It's not a high-risk environment. So companies have to balance what is the risk of being compromised and what does that company have to lose as opposed to the cost it's going to take to protect it to a higher level. Now, there's always, of course, some risk. But the more security we implement, the lower the risk becomes. So again, that's the trade-off and the organization has to make that choice. That's where they're going to have to choose how much security they want to implement in their environment.

6:59Now, there are some principles of security that are universal, meaning that all companies are probably going to want to do this. They're going to want to have some sort of structured planning. What's going to happen if there's a compromise? Now, again, maybe Bob's Haircuts doesn't care a whole lot, but they should have something in place. If we get compromised and somebody gets a list of all of our customers and their addresses, maybe what we should do is send out an email or a mailer to all of our customers saying, "Look, we've been compromised.

7:30Watch out for compromises of your personal information. Also, if somebody else tries to get you to go to their shop and poach you as a customer, you know, don't fall for it. We still offer the best haircuts out there." But there needs to be some sort of planning as to what's going to happen and, of course, planning to prevent it as we've discussed. We also want to have some form of measurable control implementation. How do we handle our security? How do we control our security? How do we monitor our security?

8:01We need to know that a security breach occurred before we can implement our mitigation plan. And, of course, we always want to have continuous improvement. This can be anything from constantly updating all of our software, our firmware , our security mechanisms, implementing new things. We want to make sure our security cameras can actually get clear pictures of things. You know, older security cameras, things were often blurry, fuzzy. They call them potato cams, whereas very hard to see what's going on. So we should always be updating things to the latest standards.

8:32And again, that can be anything from patches on operating systems, patches on routers and switches, ensuring that the network equipment isn't compromised, updating signatures for things like antivirus, our intrusion prevention systems, all sorts of things need to be done need to be continuously updated and maintained. And we always want to look for ways to improve as well. Part of our job as a security officer is to constantly look for vulnerabilities , constantly try to think of ways that people could try to compromise our environment and then mitigate those by implementing some form of a security mechanism.

9:11Something else we want to watch for when we're applying our frameworks is to make sure that they actually help align our daily operations with some form of a long-term strategy. And this could include things like building out a cloud policy. Keep in mind that cloud is relatively new in the IT sphere. Now it's not that new overall anymore, but more and more companies are moving towards cloud and cloud is new to a lot of companies.

9:41Some companies have stayed away from the cloud and now they're finally migrating to it. But one way or another, we probably need to at some points start talking about cloud policies for an organization. We also want to make sure that we're deploying secure endpoints. We need to make sure our workstations and servers and so on are not vulnerability points. And also as part of our daily operations and long-term strategy, we do need to be responding to threats to our environment. We need to make sure threats that we've seen coming because again we should constantly be doing analysis or maybe just new threats that have emerged in the industry due to a newly discovered vulnerability.

10:23So either way, we need to be constantly keeping up and making sure that our security framework is assisting not only our daily operations but also helping us implement a long -term strategy. [BLANK_AUDIO]

0:00So let's begin here by talking about the three main components of the NIST CSF. The first of those components is the core. And really the core is the heart of the framework. What exactly does that mean? Well, the core organizes our cybersecurity activities into six high-level functions, which are then further divided into categories and subcategories.

0:32So the main idea behind the core is organization. We're trying to organize what it is we're trying to do. As we said, there are in fact six separate functions here in the core. And as such, there's a lot to discuss around the core itself. So we're going to actually do that in a separate lesson rather than trying to approach it here. The second component is the implementation tiers. The implementation tiers represent how an organization views their cybersecurity risk.

1:10Where do they think they currently are? Where are they headed? What are they trying to do? These tiers represent the processes that are in place to manage that risk. And it sort of tells us where we are in that process, basically going from we don't really have much of a security structure all the way up to we are fully implemented. There are four tiers that represent this. So we go from tier one to tier four, and we will break down these four tiers and what they relate to coming up in just the moment.

1:44The third and final component is the framework profile. The idea behind the framework profile is we're going to take the core functions , which are again, what we were referring to up here, these six core functions that we haven't broken down in detail just yet. But the idea behind the profile is we want to define how those core functions are going to align with our current business requirements. Again, it's good to have a lot of security, but it does have to align with our business requirements.

2:19What our risk tolerance is and what resources we have available. And remember that risk tolerance and resources often go hand in hand because it takes resources to be able to have a low risk tolerance. So the profile is defining how the core functions are going to work within our business requirements, risk tolerance, and our available resources. So if you think about it, that really means that this serves as a customization layer between the full security framework and what we've chosen to implement in our own environment.

2:59So as I said, we're going to jump into the core in much more detail coming up. But for now, let's move on and talk in a little more detail about these other two components and let's start with the implementation tiers. As we mentioned, there are four implementation tiers. The first one is tier one. And this one is called partial. This basically means that the corporation is currently using like what we call ad hoc cybersecurity, meaning they've maybe sort of implemented a firewall and maybe they're requiring secure passwords for their users.

3:38So they've got some security going on, but it's not really a coherent plan. There are no actual formal processes on how we're implementing our security. Again, it's not saying that there is no security. That's why it's called partial. But there's really no structured process. And we really sort of have limited awareness as far as what's going on in our environment because we don't have anything fully implemented. The second tier is defined as risk informed.

4:11This means that we've actually done a little bit of research. We've looked into our environment and we've identified the areas in our network that do present a formidable risk. So we know what needs to be protected. And at this point, we're going to do an initial policy development. We're going to start putting together the pieces that we want to have in our overall cybersecurity practice. However, at this tier, we still have inconsistent enforcement.

4:43So we're not standard on our security across the board. Again, we're definitely better off than tier one, but we're still not where we really want to be. Number three, which is called repeatable, this is where we finally have a formalized process. We know what our security is supposed to be. Hopefully, we have actually implemented that. That's the idea behind tier three. And we're performing regular audits to make sure that that formalized process is actually being implemented in our environment.

5:18Also, we're doing ongoing training. Making sure that not only is our staff and our security team properly trained, but also all of the end users and employees. Again, remember, everybody has to be trained from a cybersecurity perspective. And then finally, we have tier four, which arguably is where we want to be. So this is where we're adaptive. And we now have a dynamic posture. This means that we're in a really good position to modify our security posture.

5:53If new risks come along, we have a lot of threat intelligence. We're watching what's going on in the industry, continuously monitoring our posture and adapt to emerging threats. And we have a very integrated strategy. Cyber security at this point is integrated into the organization's overall risk management strategy. So again, these are referred to as the maturity tiers. A lot of organizations, of course, started tier one. And our goal is to get to tier four.

6:25So this is the idea behind the different implementation tiers. Now let's talk about those profiles. So generally, they're going to be two key profiles used. The first one is the current profile, pretty self explanatory, I think. But this is the organization's existing cybersecurity posture. What's already in place and what do they currently have implemented in their environment? So our main focus here is going to be looking at existing protections and, most importantly, where gaps may exist in that current profile.

7:03So that's the idea is we want this to help us identify where those gaps are. And given the gaps, we then look at our target profile. This is the desired state. This is where we want to end up. So basically, this is what we want to be the before. And this should be the after. And we have to understand that the target profile really needs to be based on the business goals, the compliance needs, and/or the risk thresholds.

7:35So we really have to make sure that the target profile is what the company is after and trying to accomplish in their environment. So how are these profiles actually used then? Well, the main idea is it's supposed to help or aid the organization, do things like conduct that gap analysis. We want to know where the weaknesses are in our network. So we want to know what the gap is between our current and our target states. And once we know that, we can then start to prioritize the different actions and, like we said, this costs money.

8:10So investments that we want to make in order to get to that target profile. Another benefit here is it will make sure that we're aligning our strategy with our risk management. Again, why is this important? We need to make sure that when we're implementing security, that we're doing it in such a way that it matches up with what the company actually needs and wants. And as part of that process, we are also going to have to facilitate communication.

8:43We have to bring everybody into alignment with what we're trying to accomplish. And this is going to involve the technical teams, the executive teams. We have to make sure that everybody's on the same page with what we're trying to accomplish. And that's exactly what a profile is going to accomplish. Now moving away a little bit from the components, let's talk about some of the benefits of using the CSF. Well one of the big benefits is it's flexible and scalable. Some of the other models we're going to look at are not so flexible and scalable.

9:16But this can be adopted by organizations really of any size or maturity level as far as their security stance. This can be applied across different industries. Again, this can be applied in both the private and the public sector. This is very, very risk focused. How many times through this whole discussion do we talk about risk management? We're going to encourage prioritization based on impact and the likelihood of something happening. It's also important by the way that we use a common language.

9:49And this is sort of going back to that, getting the teams together. We need to make sure that the technical teams and the administrative teams are actually talking about the same thing. Of course, quite common for that not to be the case. We need to make sure everybody's together on what we're trying to accomplish. And of course, one of the other big benefits here is it's going to improve resilience. We want to build a proactive and dynamic security posture that's going to work well for the company. And finally, let's wrap up with some of the steps we would need to apply the N IST framework.

10:25So the first thing we want to do is create our current profile so that we know where we currently are as we're beginning our journey. The next step, of course, would be to create the target profile. Where do we want to go? Where do we want to end up when this whole thing's finished? Then we want to compare those two things. We want to create that gap analysis so that we know the difference between our current and our target environment. Once we know the difference is, we then have to prioritize our actions.

10:59What do we do first? What resources do we need? Do we have those resources? So we need to prioritize everything we're going to do to get to the target profile. And of course, another important part of applying the NIST framework is measuring our progress as we go. Not only of course, for our benefit, but generally speaking, managers and those people in the executive suites may want to know exactly what's going on. Remember that the framework is most effective when it's integrated with our enterprise risk management strategies and it's revisited periodically.

11:37[BLANK_AUDIO]

0:00So now let's take a little bit of a closer look at those six core functions of the NIST model. First on the top of the list is govern. Govern is simply defined as the policies, the procedures, the management practices, all that guide the organization's cybersecurity program. So in other words, this is sort of like the oversight. And the oversight here is going to be in charge of watching things like risk management, making sure that our risk is within the tolerances that we've decided as a company we're willing to accept.

0:42Also that we are in compliance with any and all necessary, either governmental or industry standard security practices and that our own security policies are in fact being implemented and followed as they should be. Next up, we have identify. The identify function is where we're supposed to develop that understanding of the current business context, assets, data and the current risks.

1:15So in order to accomplish that, we're going to be taking a look at identifying things like, again, the available assets. So what do we have available? What can we use? Then we have our business environment. What are we trying to accomplish? What does the business do? We're trying to identify again, maybe any security policies that need to be ad hered to for that particular business. Again, maybe medical or financial. This is also where we want to do a risk assessment. Figuring out what are the possible risks and what our susceptibility to those risks would be.

1:51And don't forget that part of those risks could be our supply chain. A lot of corporations need to be able to get products to make product. So if something happens with a supply chain, then they can't make those products. And that's going to fall under our security umbrella as well, making sure that things like business partner relationships are secure and things like that. From a business perspective, that's not really our problem. But from a security perspective, we need to make sure that connections with, again, things like business partners and so on are secure and needed for the business.

2:27Next up is protect. In protect, this is where we're going to actually develop and implement the safeguards that we're going to use to try to limit the impact of any cyber security event. So this is going to involve things like identity management and access control, making sure that only the right people have access to the right things. And usually we want to go with the concept of least privilege. So people have the least amount of privilege they need to do their job to the least number of assets that they need access to.

3:02Part of this also is going to be awareness and training. I've mentioned this a few times now, but we have to make sure that everybody in the corporation understands security procedures. We also have to do things like secure our data. This could involve things like encryption, data backup, things along those lines. So that's going to fall under things like information protection processes and procedures. How do we do that? When do we run backups, for example? Where are the offsite backups stored?

3:32All of these things have to be documented and we have to have a process. We also need to make sure we're doing proper maintenance. So again, this is going to be things like updating antivirus software, updating anti malware software, ensuring that the intrusion prevention system has the latest signatures, making sure operating systems get the patches they need. This is of course a very long list of things. I'm just filling out some examples, but part of the protect process is making sure that the devices themselves are protected and having protective technology itself.

4:05And again, that could be part of the intrusion prevention system. Also things like firewalls VPNs to protect wide area links. So a lot of things fall under protective technology, but a lot of different things we're going to implement under the protect umbrella. Next is the tech. The idea behind detect is we have to have ways to identify any cyber security incidents. Number one, we have to know that something actually happened.

4:36So we want to keep track of anomalies and events. Anomalies could just indicate that an event is going to happen or the anomaly itself could indicate that an event is happening. Event could be again, current and ongoing, or it could be something even that happened in the past. We still want to be aware of it if we can. So this is going to involve constantly monitoring our security environment. Now, keep in mind that this is not going to be very feasible for a human to be continuously monitoring all of our security software.

5:10And it's a little bit beyond the scope of what we're talking about right this moment, but there's a lot of software out there that can work as a call. And then we're going to talk about what we're going to do. And then we're going to talk about what we're going to do. And then we're going to talk about what we're going to do. And then we're going to talk about what we're going to do. And then we're going to talk about what we're going to do. And then we're going to talk about what we're going to do. And then we're going to talk about what we're going to do. And then we're going to talk about what we're going to do. And then we're going to talk about what we're going to do. And then we're going to talk about what we're going to do.

5:40And then we're going to talk about what we're going to do. And then we're going to talk about what we're talking about that's then going to trigger some sort of an event, maybe send an email telling us things are going wrong, or some sort of notification process. Once we've detected something though of course, we're also going to have to respond. So the response is of course going to be taking action of some sort after that sort of the key here, a detected incident happened. And then we have our incident response plan and that's exactly what this is.

6:11This is our response planning. What do we do after something happened. Now this is going to involve a lot of communication. We have to communicate with the affected stakeholders. We have to analyze what happened. We have to have good analysis in order to communicate to those stakeholders what actually occurred. We have to figure out what to do about it. What's our mitigation. How do we recover from whatever happened. So that might mean restoring from backup. That might mean contacting customers.

6:42There's a lot of different things that could fall under the mitigation process. But we need to have some plan in place of what we're going to actually do. And finally, we want to try to make sure that events don't occur again in the future. So how do we actually improve our environment to make sure these things don't happen again. And finally, although I sort of threw it in under mitigation there, we have recover itself, which is again, after we've implemented things we need to be able to restore our capabilities.

7:13What is it going to take to get the environment back online after an incident occurred. So how do we recover from something that happened. And this is going to definitely involve a recovery plan. And this, of course, is a huge topic. We can talk about everything from just having backups, having redundant hard drives, having redundant network equipment, maybe just redundant supervisor engines and our switches, having power backup, having HVAC backup. Connecting our data center to separate power grids. All of these things are part of plans to get things to recover if things happen.

7:51And it could go all the way up to having a full offsite data center or a disaster recovery site where we can bring things back online. And once again, we sort of throw improvements in here as well. Part of the recovery process is to implement improvements. So hopefully this doesn't happen again. And of course, part of all of this as well, like always is good communication. Everybody needs to be on the same page. Everybody needs to know what we're trying to accomplish with our recovery process.

8:22Keep in mind that these core functions, they do not have to be accomplished in a linear fashion. They can operate concurrently and continuously to form an operational culture of cybersecurity risk management. So that concludes everything that we're going to discuss here in part one of this multi part skill. So I would encourage you to go ahead and take the challenge. And then after you've completed that challenge to go ahead and move on to part two of this skill.

8:55And I'll see you in part two of this skill. Thank you.

0:00So, for this challenge, we're asked to jump in and answer a few questions about the contents of this skill to ensure our proper understanding. So let's go ahead and jump in here with the first question. Which NIST CSF function focuses on restoring services after a cybersecurity event? And of course, the key to this is going to be right here with the restoring.

0:31Which of these is going to involve restoring? So the first answer here is recover. Well, recover is generally going to involve restoring services. So that's probably a good answer. Let's just verify the others real quick. Protect is actually something that comes into play before we lose services. Identify happens way at the beginning when we're trying to figure out what to protect Respond is actually very close, but that's actually the step right before we're actually trying to restore services.

1:05So again, this is going to basically leave us with recover as the correct answer. Second question, which organization is responsible for publishing cybersecurity standards for DOD systems? So again, let's go down our list. Our first answer, CISA, this is one of the organizations we spoke of, but not specifically for DOD systems. That's from the Department of Homeland Security.

1:35NIST, again, this is also one of the organizations we discussed, but not related to the DOD. NSA is not even one of the agencies we discussed, although that is one of our agencies here in the United States. So that's going to leave DISA as our correct answer here for question two. Question three, which of the following is a benefit of the NIST cybersecurity framework? Our first answer is it mandates specific tools and vendors, and that's not something that NIST does, so that's going to be incorrect.

2:13It replaces all other compliance frameworks. Well, if that was the case, we probably wouldn't have discussed the other ones, so that's not going to be a correct answer. It provides a flexible, risk-based approach. That actually sounds like a good answer, but let's check the last one here first before we mark it. It is only applicable to federal agencies. No, in fact, one of the advantages of the NIST framework is that it can easily be applied to the private sector as well. So that means that it provides a flexible, risk-based approach is going to be our correct answer.

2:51Final question, what is a key benefit of using the NIST CSF in a commercial environment? First answer, it enforces mandatory DOD-level controls. Well that wouldn't make a whole lot of sense in a commercial environment, so this is not going to be correct. It includes government-only encryption algorithms. Well, again, if it's government-only, then it wouldn't apply in a commercial environment, so that's clearly not going to be the case either.

3:23It provides adaptable, risk-based guidance. Well we know that term "risk-based" definitely applies to NIST, so that's probably going to be our answer. If we look at the last answer, it replaces the need for SIMS. If you're not familiar with this, that stands for security information and event management. These are different systems that can collect information. That's not what NIST CSF does, so again it's going to leave our best answer at it provides adaptable, risk-based guidance.

4:02So that concludes this challenge as well as this first half of our two-part skill. So I would encourage you to now move on to part two. In the meantime, I hope this has been informative for you, and I'd like to thank you for viewing. [BLANK_AUDIO]