Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
6/18/2015
03:40 PM
Ryan Vela
Ryan Vela
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

Breach Defense Playbook: Reviewing Your Cybersecurity Program (Part 2)

Cybersecurity requires a combination of people, process, and technology in a coordinated implementation leveraging a defense-in-depth methodology.

As I mentioned in Part 1 of this installment, the goal of reviewing your cybersecurity program is to quantitatively ensure that a secure enterprise network exists within your business environment. To do so, you should perform a gap analysis of your security framework that results in a roadmap for enhancements. The gap analysis will provide insight into areas that need improvements and adjustments, which can be leveraged to develop the cybersecurity roadmap.

Cybersecurity Roadmap

Cybersecurity requires a combination of people, process, and technology in a coordinated implementation leveraging a defense-in-depth methodology. The defense-in-depth methodology includes a cyclical process of Prediction -- Prevention -- Detection -- Response.

Prediction comprises proactive measures to identify attackers, their objectives, and the methods used prior to actual attacks with a goal of improving prevention activities. Prevention is maintaining security network environments with current people, processes, and technology and using timely industry best practices with a goal of providing better detection. Detection is leveraging situational awareness and visibility into key methods to effectively monitor bad practices, attacks, and breaches with a goal of improving incident response capabilities. Response is effective and efficient management to contain, repair, and recover the environment to normal operations with a goal of reducing losses and feeding intelligence for future prediction.

All of these processes form a cycle that is made operational with continuous monitoring and analytical awareness.

The defense-in-depth strategy relies on an operational system and is a living organism that requires fuel. That fuel is the security team personnel who continuously tweak and tune the system so that it performs effectively and efficiently. Without fuel, the system will die; money for tools, hardware, and software will be wasted; and your organization will be at risk.

There should be a commitment from the executive leadership of your organization to defending against the clear and present threat presented by today’s advanced attackers. This is achieved with a foundation of solid policies and procedures built upon with assignment of roles and responsibilities, commitment of resources, personnel training, and accountability.

An example of a proven methodology for ensuring the effectiveness of your defense-in-depth strategy is the Plan - Do - Check - Act (PDCA) management method for continuous improvement. Most organizations understand defense-in-depth. Your security program assessment should address all the layers of defense-in-depth with the goal of placing your organization in a good position to quickly defend against future attacks.

Roadmap Report

Your Roadmap Report must provide detailed analysis of your findings, which you will use to facilitate the enhancement of security controls and operational capabilities. The report must summarize your activities and observations and include an actionable list of enhancements; the level of effort required to implement each action; key stakeholders required to implement each action; an estimated timeline with milestones for implementing the actions; and key metrics to evaluate progress and establish a measure of effectiveness of the actions.

Your report should look like a quarterly project plan with quantitative values. The enhancements should be tracked back to the cybersecurity program assessment you just performed. The outcomes of each activity should be predicted so that they can be assessed again during the next assessment. In addition, your program assessment, and therefore Roadmap Report, should be broken into functional components such as those listed below:

  • Policy and Standards
  • Security Architecture
  • Strategic Planning
  • Risk Assessment
  • Risk Control
  • Incident Response
  • Disaster Recovery
  • Employee Training
  • Vendor Management
  • Compliance and Governance

Each activity should include observations that result in tactical outcomes that may include further action, realignment of responsibilities, requests for strategic changes, or removal of a process from the program. Obviously, the area should be included in the next round of assessments, but the outcomes of activities performed between assessments must be taken into consideration during future assessments.

The danger in this cycle is that assessments can become unwieldy, but only if observations are not translated into actions. If an organization does not remediate, then future assessments will grow in complexity -- not to mention management will not like the outcomes if they do not see improvements.

Ryan Vela is a Regional Director for Fidelis Cybersecurity. He has 15-years' experience in conducting investigations and digital forensic analysis. Ryan served as a Strategic Planner at the Defense Computer Forensics Laboratory (DCFL), where he established plans for the ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19631
PUBLISHED: 2020-01-24
An issue was discovered in Big Switch Big Monitoring Fabric 6.2 through 6.2.4, 6.3 through 6.3.9, 7.0 through 7.0.3, and 7.1 through 7.1.3; Big Cloud Fabric 4.5 through 4.5.5, 4.7 through 4.7.7, 5.0 through 5.0.1, and 5.1 through 5.1.4; and Multi-Cloud Director through 1.1.0. A read-only user can ac...
CVE-2020-5219
PUBLISHED: 2020-01-24
Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the appli...
CVE-2019-18900
PUBLISHED: 2020-01-24
: Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions p...
CVE-2020-7226
PUBLISHED: 2020-01-24
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data...
CVE-2012-6302
PUBLISHED: 2020-01-24
Soapbox through 0.3.1: Sandbox bypass - runs a second instance of Soapbox within a sandboxed Soapbox.