Partner Perspectives  Connecting marketers to our tech communities.
6/18/2015
03:40 PM
Ryan Vela
Ryan Vela
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

Breach Defense Playbook: Reviewing Your Cybersecurity Program (Part 2)

Cybersecurity requires a combination of people, process, and technology in a coordinated implementation leveraging a defense-in-depth methodology.

As I mentioned in Part 1 of this installment, the goal of reviewing your cybersecurity program is to quantitatively ensure that a secure enterprise network exists within your business environment. To do so, you should perform a gap analysis of your security framework that results in a roadmap for enhancements. The gap analysis will provide insight into areas that need improvements and adjustments, which can be leveraged to develop the cybersecurity roadmap.

Cybersecurity Roadmap

Cybersecurity requires a combination of people, process, and technology in a coordinated implementation leveraging a defense-in-depth methodology. The defense-in-depth methodology includes a cyclical process of Prediction -- Prevention -- Detection -- Response.

Prediction comprises proactive measures to identify attackers, their objectives, and the methods used prior to actual attacks with a goal of improving prevention activities. Prevention is maintaining security network environments with current people, processes, and technology and using timely industry best practices with a goal of providing better detection. Detection is leveraging situational awareness and visibility into key methods to effectively monitor bad practices, attacks, and breaches with a goal of improving incident response capabilities. Response is effective and efficient management to contain, repair, and recover the environment to normal operations with a goal of reducing losses and feeding intelligence for future prediction.

All of these processes form a cycle that is made operational with continuous monitoring and analytical awareness.

The defense-in-depth strategy relies on an operational system and is a living organism that requires fuel. That fuel is the security team personnel who continuously tweak and tune the system so that it performs effectively and efficiently. Without fuel, the system will die; money for tools, hardware, and software will be wasted; and your organization will be at risk.

There should be a commitment from the executive leadership of your organization to defending against the clear and present threat presented by today’s advanced attackers. This is achieved with a foundation of solid policies and procedures built upon with assignment of roles and responsibilities, commitment of resources, personnel training, and accountability.

An example of a proven methodology for ensuring the effectiveness of your defense-in-depth strategy is the Plan - Do - Check - Act (PDCA) management method for continuous improvement. Most organizations understand defense-in-depth. Your security program assessment should address all the layers of defense-in-depth with the goal of placing your organization in a good position to quickly defend against future attacks.

Roadmap Report

Your Roadmap Report must provide detailed analysis of your findings, which you will use to facilitate the enhancement of security controls and operational capabilities. The report must summarize your activities and observations and include an actionable list of enhancements; the level of effort required to implement each action; key stakeholders required to implement each action; an estimated timeline with milestones for implementing the actions; and key metrics to evaluate progress and establish a measure of effectiveness of the actions.

Your report should look like a quarterly project plan with quantitative values. The enhancements should be tracked back to the cybersecurity program assessment you just performed. The outcomes of each activity should be predicted so that they can be assessed again during the next assessment. In addition, your program assessment, and therefore Roadmap Report, should be broken into functional components such as those listed below:

  • Policy and Standards
  • Security Architecture
  • Strategic Planning
  • Risk Assessment
  • Risk Control
  • Incident Response
  • Disaster Recovery
  • Employee Training
  • Vendor Management
  • Compliance and Governance

Each activity should include observations that result in tactical outcomes that may include further action, realignment of responsibilities, requests for strategic changes, or removal of a process from the program. Obviously, the area should be included in the next round of assessments, but the outcomes of activities performed between assessments must be taken into consideration during future assessments.

The danger in this cycle is that assessments can become unwieldy, but only if observations are not translated into actions. If an organization does not remediate, then future assessments will grow in complexity -- not to mention management will not like the outcomes if they do not see improvements.

Ryan Vela is a Regional Director for Fidelis Cybersecurity. He has 15-years' experience in conducting investigations and digital forensic analysis. Ryan served as a Strategic Planner at the Defense Computer Forensics Laboratory (DCFL), where he established plans for the ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Privacy Careers Are Helping to Close the IT Gender Gap
Dana Simberkoff, Chief Risk, Privacy, and Information Security Officer, AvePoint, Inc.,  8/20/2018
Ohio Man Sentenced To 15 Months For BEC Scam
Dark Reading Staff 8/20/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
Fidelis Cybersecurity provides organizations with a robust, comprehensive portfolio of products, services, and expertise to combat today's sophisticated advanced threats and prevent data breaches. Our commercial enterprise and government customers around the globe can face advanced threats with confidence through use of our Network Defense and Forensics Services – delivered by an elite team of security professionals with decades of hands-on experience – and our award-winning Fidelis XPS™ Advanced Threat Defense Products, which provide visibility and control over the entire threat life cycle.
Featured Writers
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15667
PUBLISHED: 2018-08-21
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. It registers and uses the airmail:// URL scheme. The "send" command in the URL scheme allows an external application to send arbitrary emails from an active account without authentication. The handler has no restriction on who can...
CVE-2018-15668
PUBLISHED: 2018-08-21
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. The "send" command in the airmail:// URL scheme allows an external application to send arbitrary emails from an active account. URL parameters for the "send" command with the "attachment_" prefix designate atta...
CVE-2018-15669
PUBLISHED: 2018-08-21
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that requests from HTMLIFrameElements are blacklisted. However, other sub-classes of HTMLFrameOwnerElements are...
CVE-2018-15670
PUBLISHED: 2018-08-21
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that OpenURL is the default URL handler. A navigation request is processed by the default URL handler only if t...
CVE-2018-15671
PUBLISHED: 2018-08-21
An issue was discovered in the HDF HDF5 1.10.2 library. Excessive stack consumption has been detected in the function H5P__get_cb() in H5Pint.c during an attempted parse of a crafted HDF file. This results in denial of service.