Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
6/18/2015
03:40 PM
Ryan Vela
Ryan Vela
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

Breach Defense Playbook: Reviewing Your Cybersecurity Program (Part 2)

Cybersecurity requires a combination of people, process, and technology in a coordinated implementation leveraging a defense-in-depth methodology.

As I mentioned in Part 1 of this installment, the goal of reviewing your cybersecurity program is to quantitatively ensure that a secure enterprise network exists within your business environment. To do so, you should perform a gap analysis of your security framework that results in a roadmap for enhancements. The gap analysis will provide insight into areas that need improvements and adjustments, which can be leveraged to develop the cybersecurity roadmap.

Cybersecurity Roadmap

Cybersecurity requires a combination of people, process, and technology in a coordinated implementation leveraging a defense-in-depth methodology. The defense-in-depth methodology includes a cyclical process of Prediction -- Prevention -- Detection -- Response.

Prediction comprises proactive measures to identify attackers, their objectives, and the methods used prior to actual attacks with a goal of improving prevention activities. Prevention is maintaining security network environments with current people, processes, and technology and using timely industry best practices with a goal of providing better detection. Detection is leveraging situational awareness and visibility into key methods to effectively monitor bad practices, attacks, and breaches with a goal of improving incident response capabilities. Response is effective and efficient management to contain, repair, and recover the environment to normal operations with a goal of reducing losses and feeding intelligence for future prediction.

All of these processes form a cycle that is made operational with continuous monitoring and analytical awareness.

The defense-in-depth strategy relies on an operational system and is a living organism that requires fuel. That fuel is the security team personnel who continuously tweak and tune the system so that it performs effectively and efficiently. Without fuel, the system will die; money for tools, hardware, and software will be wasted; and your organization will be at risk.

There should be a commitment from the executive leadership of your organization to defending against the clear and present threat presented by today’s advanced attackers. This is achieved with a foundation of solid policies and procedures built upon with assignment of roles and responsibilities, commitment of resources, personnel training, and accountability.

An example of a proven methodology for ensuring the effectiveness of your defense-in-depth strategy is the Plan - Do - Check - Act (PDCA) management method for continuous improvement. Most organizations understand defense-in-depth. Your security program assessment should address all the layers of defense-in-depth with the goal of placing your organization in a good position to quickly defend against future attacks.

Roadmap Report

Your Roadmap Report must provide detailed analysis of your findings, which you will use to facilitate the enhancement of security controls and operational capabilities. The report must summarize your activities and observations and include an actionable list of enhancements; the level of effort required to implement each action; key stakeholders required to implement each action; an estimated timeline with milestones for implementing the actions; and key metrics to evaluate progress and establish a measure of effectiveness of the actions.

Your report should look like a quarterly project plan with quantitative values. The enhancements should be tracked back to the cybersecurity program assessment you just performed. The outcomes of each activity should be predicted so that they can be assessed again during the next assessment. In addition, your program assessment, and therefore Roadmap Report, should be broken into functional components such as those listed below:

  • Policy and Standards
  • Security Architecture
  • Strategic Planning
  • Risk Assessment
  • Risk Control
  • Incident Response
  • Disaster Recovery
  • Employee Training
  • Vendor Management
  • Compliance and Governance

Each activity should include observations that result in tactical outcomes that may include further action, realignment of responsibilities, requests for strategic changes, or removal of a process from the program. Obviously, the area should be included in the next round of assessments, but the outcomes of activities performed between assessments must be taken into consideration during future assessments.

The danger in this cycle is that assessments can become unwieldy, but only if observations are not translated into actions. If an organization does not remediate, then future assessments will grow in complexity -- not to mention management will not like the outcomes if they do not see improvements.

Ryan Vela is a Regional Director for Fidelis Cybersecurity. He has 15-years' experience in conducting investigations and digital forensic analysis. Ryan served as a Strategic Planner at the Defense Computer Forensics Laboratory (DCFL), where he established plans for the ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
Modern Day Insider Threat: Network Bugs That Are Stealing Your Data
David Pearson, Principal Threat Researcher,  10/21/2020
Are You One COVID-19 Test Away From a Cybersecurity Disaster?
Alan Brill, Senior Managing Director, Cyber Risk Practice, Kroll,  10/21/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7753
PUBLISHED: 2020-10-27
All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) [DNP] via trim().
CVE-2020-27182
PUBLISHED: 2020-10-27
Multiple cross-site scripting (XSS) vulnerabilities in konzept-ix publiXone before 2020.015 allow remote attackers to inject arbitrary JavaScript or HTML via appletError.jsp, job_jacket_detail.jsp, ixedit/editor_component.jsp, or the login form.
CVE-2020-27183
PUBLISHED: 2020-10-27
A RemoteFunctions endpoint with missing access control in konzept-ix publiXone before 2020.015 allows attackers to disclose sensitive user information, send arbitrary e-mails, escalate the privileges of arbitrary user accounts, and have unspecified other impact.
CVE-2020-8956
PUBLISHED: 2020-10-27
Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.
CVE-2020-15352
PUBLISHED: 2020-10-27
An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.