Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
6/18/2015
03:40 PM
Ryan Vela
Ryan Vela
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

Breach Defense Playbook: Reviewing Your Cybersecurity Program (Part 2)

Cybersecurity requires a combination of people, process, and technology in a coordinated implementation leveraging a defense-in-depth methodology.

As I mentioned in Part 1 of this installment, the goal of reviewing your cybersecurity program is to quantitatively ensure that a secure enterprise network exists within your business environment. To do so, you should perform a gap analysis of your security framework that results in a roadmap for enhancements. The gap analysis will provide insight into areas that need improvements and adjustments, which can be leveraged to develop the cybersecurity roadmap.

Cybersecurity Roadmap

Cybersecurity requires a combination of people, process, and technology in a coordinated implementation leveraging a defense-in-depth methodology. The defense-in-depth methodology includes a cyclical process of Prediction -- Prevention -- Detection -- Response.

Prediction comprises proactive measures to identify attackers, their objectives, and the methods used prior to actual attacks with a goal of improving prevention activities. Prevention is maintaining security network environments with current people, processes, and technology and using timely industry best practices with a goal of providing better detection. Detection is leveraging situational awareness and visibility into key methods to effectively monitor bad practices, attacks, and breaches with a goal of improving incident response capabilities. Response is effective and efficient management to contain, repair, and recover the environment to normal operations with a goal of reducing losses and feeding intelligence for future prediction.

All of these processes form a cycle that is made operational with continuous monitoring and analytical awareness.

The defense-in-depth strategy relies on an operational system and is a living organism that requires fuel. That fuel is the security team personnel who continuously tweak and tune the system so that it performs effectively and efficiently. Without fuel, the system will die; money for tools, hardware, and software will be wasted; and your organization will be at risk.

There should be a commitment from the executive leadership of your organization to defending against the clear and present threat presented by today’s advanced attackers. This is achieved with a foundation of solid policies and procedures built upon with assignment of roles and responsibilities, commitment of resources, personnel training, and accountability.

An example of a proven methodology for ensuring the effectiveness of your defense-in-depth strategy is the Plan - Do - Check - Act (PDCA) management method for continuous improvement. Most organizations understand defense-in-depth. Your security program assessment should address all the layers of defense-in-depth with the goal of placing your organization in a good position to quickly defend against future attacks.

Roadmap Report

Your Roadmap Report must provide detailed analysis of your findings, which you will use to facilitate the enhancement of security controls and operational capabilities. The report must summarize your activities and observations and include an actionable list of enhancements; the level of effort required to implement each action; key stakeholders required to implement each action; an estimated timeline with milestones for implementing the actions; and key metrics to evaluate progress and establish a measure of effectiveness of the actions.

Your report should look like a quarterly project plan with quantitative values. The enhancements should be tracked back to the cybersecurity program assessment you just performed. The outcomes of each activity should be predicted so that they can be assessed again during the next assessment. In addition, your program assessment, and therefore Roadmap Report, should be broken into functional components such as those listed below:

  • Policy and Standards
  • Security Architecture
  • Strategic Planning
  • Risk Assessment
  • Risk Control
  • Incident Response
  • Disaster Recovery
  • Employee Training
  • Vendor Management
  • Compliance and Governance

Each activity should include observations that result in tactical outcomes that may include further action, realignment of responsibilities, requests for strategic changes, or removal of a process from the program. Obviously, the area should be included in the next round of assessments, but the outcomes of activities performed between assessments must be taken into consideration during future assessments.

The danger in this cycle is that assessments can become unwieldy, but only if observations are not translated into actions. If an organization does not remediate, then future assessments will grow in complexity -- not to mention management will not like the outcomes if they do not see improvements.

Ryan Vela is a Regional Director for Fidelis Cybersecurity. He has 15-years' experience in conducting investigations and digital forensic analysis. Ryan served as a Strategic Planner at the Defense Computer Forensics Laboratory (DCFL), where he established plans for the ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How Security Vendors Can Address the Cybersecurity Talent Shortage
Rob Rashotte, VP of Global Training and Technical Field Enablement at Fortinet,  5/24/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7068
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7069
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7070
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7071
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-7072
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .