TrustedSec - Another Standard to Keep in Mind

In TrustedSec’s Advisory division, one question we often hear is, “how can we prioritize our information security efforts?” It is not surprising, as there are many things organizations can and often should be doing from an information security perspective, but there are only so many hours in the day, and so many dollars in the budget.

Without fully understanding an organization’s operations and risk tolerance, it is challenging to determine what security controls and program elements are of the highest priority. With that being said, there are tons of standards and frameworks that provide guidance around these components. Many of these can be overwhelming for an organization wondering where to start implementing an information security program.

On June 25, the Cabinet Office in the UK released a new Minimum Cyber Security Standard. At first glance, it is hard miss the similarities to the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). As with the NIST CSF, the UK Minimum Cyber Security Standard does a good job of addressing the foundations for cyber security in a simple, straightforward fashion. While there are certain elements and requirements that are obviously specific to organizations in the UK (“Use the UK Public Sector DNS Service to resolve internet DNS queries”, for example), the Standard is a good base for any organization to reference. For organizations looking to begin a cyber security program, or those assessing where their program is currently, the UK Minimum Cyber Security Standard may be a great benchmark. The Standard may also serve as a schematic to create a program aimed at aligning with the NIST CSF without embarking on an overwhelming undertaking.

The applicability of this standard to non-UK organizations will be up to each organization to investigate and determine, but organizations that have operations in the UK should definitely become familiar with it. That being said,  The Minimum Cyber Security Standard is broken out into the following areas, which should look very familiar to anyone who has seen the NIST CSF:

 

IDENTIFY

  • Departments shall put in place appropriate cyber security governance processes.
  • Departments shall identify and catalogue sensitive information they hold.
  • Departments shall identify and catalogue the key operational services they provide.
  • The need for users to access sensitive information or key operational services shall be understood and continually managed.

 

PROTECT

  • Access to sensitive information and key operational services shall only be provided to identified, authenticated and authorised users or systems.
  • Systems which handle sensitive information or key operational services shall be protected from exploitation of known vulnerabilities.
  • Highly privileged accounts should not be vulnerable to common cyber- attacks.

 

DETECT

  • Departments shall take steps to detect common cyber- attacks.

 

RESPOND

  • Departments shall have a defined, planned and tested response to cyber security incidents that impact sensitive information or key operational services.

 

RECOVER

  • Departments shall have well defined and tested processes in place to ensure the continuity of key operational services in the event of failure or compromise.

 

Outside of the direct applicability to organizations who fall under this standard, it appears to be a standard that could be used by those looking to start on a path to increasing the maturity of their security program. Where the NIST CSF can seem daunting, the elements in this standard may be a good way for organizations to incorporate some elements of the NIST CSF in an achievable way. This is a good reminder that good guidance can come from places where you may not have been looking.

The post Another Standard to Keep in Mind appeared first on TrustedSec.



from TrustedSec https://www.trustedsec.com/2018/06/another-standard-to-keep-in-mind/

Comments

Post a Comment

Popular posts from this blog

KnowBe4 - Scam Of The Week: "When Users Add Their Names to a Wall of Shame"

Image
Eric Howes , KnowBe4 Principal Lab Researcher, found out about another insidious bad guy trick: " If you work in IT there has undoubtedly come a dark moment when you wondered to yourself just who among your employee users would be gullible enough to click through a phishing email and potentially bring down your organization. from KnowBe4 Security Awareness Training Blog https://blog.knowbe4.com/when-users-add-their-names-to-a-wall-of-shame
Read more

Krebs - NY Charges First American Financial for Massive Data Leak

Image
In May 2019, KrebsOnSecurity broke the news that the website of mortgage title insurance giant First American Financial Corp. had exposed approximately 885 million records related to mortgage deals going back to 2003. On Wednesday, regulators in New York announced that First American was the target of their first ever cybersecurity enforcement action in connection with the incident, charges that could bring steep financial penalties. First American Financial Corp. Santa Ana, Calif.-based  First American [ NYSE:FAF ] is a leading provider of title insurance and settlement services to the real estate and mortgage industries. It employs some 18,000 people and brought in $6.2 billion in 2019 . As first reported here last year , First American’s website exposed 16 years worth of digitized mortgage title insurance records — including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license images. The docum
Read more

US-CERT - SB18-169: Vulnerability Summary for the Week of June 11, 2018

Original release date: June 18, 2018 The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD , which contains historical vulnerability information. The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0 Medium - Vulnerabilities will be labeled Medium severity
Read more