Partner Perspectives  Connecting marketers to our tech communities.
6/18/2015
03:40 PM
Ryan Vela
Ryan Vela
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

Breach Defense Playbook: Reviewing Your Cybersecurity Program (Part 2)

Cybersecurity requires a combination of people, process, and technology in a coordinated implementation leveraging a defense-in-depth methodology.

As I mentioned in Part 1 of this installment, the goal of reviewing your cybersecurity program is to quantitatively ensure that a secure enterprise network exists within your business environment. To do so, you should perform a gap analysis of your security framework that results in a roadmap for enhancements. The gap analysis will provide insight into areas that need improvements and adjustments, which can be leveraged to develop the cybersecurity roadmap.

Cybersecurity Roadmap

Cybersecurity requires a combination of people, process, and technology in a coordinated implementation leveraging a defense-in-depth methodology. The defense-in-depth methodology includes a cyclical process of Prediction -- Prevention -- Detection -- Response.

Prediction comprises proactive measures to identify attackers, their objectives, and the methods used prior to actual attacks with a goal of improving prevention activities. Prevention is maintaining security network environments with current people, processes, and technology and using timely industry best practices with a goal of providing better detection. Detection is leveraging situational awareness and visibility into key methods to effectively monitor bad practices, attacks, and breaches with a goal of improving incident response capabilities. Response is effective and efficient management to contain, repair, and recover the environment to normal operations with a goal of reducing losses and feeding intelligence for future prediction.

All of these processes form a cycle that is made operational with continuous monitoring and analytical awareness.

The defense-in-depth strategy relies on an operational system and is a living organism that requires fuel. That fuel is the security team personnel who continuously tweak and tune the system so that it performs effectively and efficiently. Without fuel, the system will die; money for tools, hardware, and software will be wasted; and your organization will be at risk.

There should be a commitment from the executive leadership of your organization to defending against the clear and present threat presented by today’s advanced attackers. This is achieved with a foundation of solid policies and procedures built upon with assignment of roles and responsibilities, commitment of resources, personnel training, and accountability.

An example of a proven methodology for ensuring the effectiveness of your defense-in-depth strategy is the Plan - Do - Check - Act (PDCA) management method for continuous improvement. Most organizations understand defense-in-depth. Your security program assessment should address all the layers of defense-in-depth with the goal of placing your organization in a good position to quickly defend against future attacks.

Roadmap Report

Your Roadmap Report must provide detailed analysis of your findings, which you will use to facilitate the enhancement of security controls and operational capabilities. The report must summarize your activities and observations and include an actionable list of enhancements; the level of effort required to implement each action; key stakeholders required to implement each action; an estimated timeline with milestones for implementing the actions; and key metrics to evaluate progress and establish a measure of effectiveness of the actions.

Your report should look like a quarterly project plan with quantitative values. The enhancements should be tracked back to the cybersecurity program assessment you just performed. The outcomes of each activity should be predicted so that they can be assessed again during the next assessment. In addition, your program assessment, and therefore Roadmap Report, should be broken into functional components such as those listed below:

  • Policy and Standards
  • Security Architecture
  • Strategic Planning
  • Risk Assessment
  • Risk Control
  • Incident Response
  • Disaster Recovery
  • Employee Training
  • Vendor Management
  • Compliance and Governance

Each activity should include observations that result in tactical outcomes that may include further action, realignment of responsibilities, requests for strategic changes, or removal of a process from the program. Obviously, the area should be included in the next round of assessments, but the outcomes of activities performed between assessments must be taken into consideration during future assessments.

The danger in this cycle is that assessments can become unwieldy, but only if observations are not translated into actions. If an organization does not remediate, then future assessments will grow in complexity -- not to mention management will not like the outcomes if they do not see improvements.

Ryan Vela is a Regional Director for Fidelis Cybersecurity. He has 15-years' experience in conducting investigations and digital forensic analysis. Ryan served as a Strategic Planner at the Defense Computer Forensics Laboratory (DCFL), where he established plans for the ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
13 Russians Indicted for Massive Operation to Sway US Election
Kelly Sheridan, Associate Editor, Dark Reading,  2/16/2018
Facebook Aims to Make Security More Social
Kelly Sheridan, Associate Editor, Dark Reading,  2/20/2018
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
Fidelis Cybersecurity provides organizations with a robust, comprehensive portfolio of products, services, and expertise to combat today's sophisticated advanced threats and prevent data breaches. Our commercial enterprise and government customers around the globe can face advanced threats with confidence through use of our Network Defense and Forensics Services – delivered by an elite team of security professionals with decades of hands-on experience – and our award-winning Fidelis XPS™ Advanced Threat Defense Products, which provide visibility and control over the entire threat life cycle.
Featured Writers
White Papers
Video
Cartoon Contest
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.