In this lesson,
we will learn about security frameworks.
Security frameworks are sets of guidelines,
best practices, and standards
designed to help organizations manage
and reduce cybersecurity risk.
Security frameworks include foundational best practices,
which form the core principles
that guide the implementation of security measures,
benchmarks, which are specific measurable standards
derived from foundational best practices,
and the Center for Internet Security or CIS Benchmarks,
which specifically offer actionable and detailed guidance
on securing systems and data.
Now, let's explore
each of these security frameworks in more detail.
First, we have foundational best practices.
Foundational best practices are key frameworks
and standards that help organizations protect data,
manage risks, and stay secure across different industries.
For example, the International Organization
for Standardization, or ISO 27000 series,
sets international standards
for managing information security.
The National Institute of Standards and Technology
or NIST Cybersecurity Framework helps businesses assess
and improve their ability to protect information systems.
Control Objectives for Information and Related Technology,
or COBIT, is essential for governing
and managing IT systems.
The Payment Card Industry Data Security Standard,
or PCI DSS, focuses on securing credit card transactions.
The committee of sponsoring organizations
of the Treadway Commission, or COSO Framework,
emphasizes enterprise risk management.
The General Data Protection Regulation, or GDPR,
sets strict data privacy rules in the European Union
and for European Union citizens.
If you're managing IT services,
the Information Technology Infrastructure Library,
or ITIL, is critical.
And for defense contractors,
the Cybersecurity Maturity Model Certification, or CMMC,
outlines specific security requirements
to protect sensitive information,
such as Controlled Unclassified Information, or CUI.
Lastly, in healthcare,
the Health Insurance Portability and Accountability Act
ensures the protection of patient data.
Together, these foundational best practice frameworks
and others like them enable organizations
to implement the right controls, reduce security risks,
and stay compliant with relevant regulations.
Second, we have benchmarks.
In order to understand a benchmark,
we need to also understand baselines.
A configuration baseline
is the minimum set of security configurations or standards
an organization puts in place.
Think of it as the foundation or starting point
that defines what good enough security looks like
within the company.
A benchmark, on the other hand, is an external standard
that provides a reference point
for how well our baseline measures up
to industry best practices.
In other words, once set our internal baseline,
we can use a benchmark
to compare it against what's recommended by industry experts
to see if we need to improve.
The relationship between the two
is that a baseline sets our internal standards
and a benchmark helps us verify if those standards
are up to the level that they should be.
Outside of configuration baselines,
we can also establish operational baselines.
Operational baselines establish
what normal operational traffic looks like
in our organization.
So if we're looking at our network utilization
and it's averaging 80% during working hours,
that becomes our baseline.
To effectively use operational baselines,
we need to be monitoring current network status
and looking for trends over time.
One way to do that is through continuous monitoring.
Continuous monitoring is essential
to good organizational security,
and it helps us identify abnormal events.
However, if we only look for abnormalities
once every six months, then our organization
could have been under attack for a long time
before we ever even discover it.
So in order to know what abnormal looks like
during our continuous monitoring,
we have to know what normal looks like,
and that's why we create a good operational baseline.
Now, our baseline isn't set in stone and it can be modified
and changed over time as our network or services change.
For example, if we look at our network utilization today
and it's 95% above the baseline,
we should analyze why that's the case.
Maybe somebody's exfiltrating data out of our network
and is causing a spike in usage,
or maybe it's because we just hired 20 new employees
and there are a lot more people using the network.
If the increase is due to explainable reasons
like hiring new employees who are using more bandwidth,
then we should update our baseline.
Continuous monitoring can detect all kinds of issues
in your organization.
For example, if your users are normally logged in
from 8:00 AM to 5:00 PM each day,
but we see through continuous monitoring
there's a new user account
that's logging in every night between 1:00 AM and 3:00 AM,
well, that could be a sign of foul play,
either from an attacker or an insider threat.
Third, we have the Center for Internet Security
or CIS Benchmarks.
CIS Benchmarks are a set of globally recognized,
best practice security configurations
that help organizations secure their systems and data
against cyber threats.
Once we've established a baseline
for our internal security configurations,
we can use CIS Benchmarks to see how well our setup aligns
with industry best practices.
CIS Benchmarks provide step-by-step guidelines
on how to secure different systems and applications.
They cover everything from operating systems
to cloud environments.
For example, if we're running Windows Server 2022,
there's a specific CIS Benchmark
that outlines all the recommended security settings
for that system.
It might include steps like configuring password policies,
ensuring unnecessary services are disabled,
and tightening user access controls.
These benchmarks act as a checklist
to help us secure our system
based on proven, widely tested configurations.
So remember, security frameworks guide organizations
in protecting their data, managing risks,
and staying compliant with regulations.
Foundational best practices, like the ISO 27000 series
and NIST Cybersecurity Framework, provide core principles
for security across various industries,
ensuring organizations have the right controls in place
to secure their information systems.
Benchmarks are measurable standards
often derived from these best practices,
and they help organizations
compare their internal security configuration baselines
against industry standards.
For example, the Center for Internet Security Benchmarks
offer detailed guidance on securing specific systems,
providing step-by-step instructions to align internal setups
with external best practices.
By applying these security standards
and using tools like CIS Benchmarks,
you can not only strengthen your organizational defenses,
but also provide clear, reportable evidence of compliance
with industry regulations.