5.2 Security Frameworks

Question 1

Center for Internet Security (CIS)

Answer 1

Commonly known as “CIS CSC”.
Critical Security Controls for Effective Cyber Defense

Focused on improving security poster.
Strategies differ depending on organization size.
Run by IT professionals.

Question 2

NIST RMF

Answer 2

National Institute of Standards and Technology Risk Management Framework. MANDITORY for US federal agencies

Six Steps:
Step 1 - Categorize - Define environment
Step 2 - Select - Pick the right controls
Step 3 - Implement - Define proper implementation
Step 4 - Assess - Determine if controls are working
Step 5 - Authorize - Make a decisions to authorize system
Step 6 - Monitor - Check for ongoing compliance

Question 3

NIST CSF

Answer 3

NIST Cybersecurity Framework (CSF)

Framework Core:
Identify
Protect
Detect
Respond
Recover

Implementation Tier:
Org determines their approach to cybersecurity and how they plan to manage the risks.

Framework Profile:
Standards, guidelines, practices align with framework core

Question 4

International Organization for Standardization and International electrotechnical Comission (ISO/IEC)

ISO/IEC 27001

Answer 4

Standard for Information Security Management Systems (ISMS)

Question 5

International Organization for Standardization and International electrotechnical Comission (ISO/IEC)

ISO/IEC 27002

Answer 5

Code of practice for information security controls

Question 6

International Organization for Standardization and International electrotechnical Comission (ISO/IEC)

ISO/IEC 27701

Answer 6

Privacy Information Management Systems (PIMS)

Question 7

International Organization for Standardization

ISO 31000

Answer 7

International standards for risk management practices

Question 8

SSAE SOC 2 Type I/II

Answer 8

Performed by The American Institute of Certified Public Accountants (AICPA)

It’s an auditing standard called “Statement on Standards for Attestation Engagements #18” (SSAE 18)

SOC 2 - Trust Services Criteria (security controls)
- Focuses on firewalls, intrusion detection, multifactor authentication.

Type 1 Audit - Tests controls at a certain point in time

Type 2 Audit - Test over period of at least 6 months

Question 9

Cloud Security Alliance (CSA)

Answer 9

Not-for-profit organization

Cloud Controls Matrix (CCM)

• Cloud-specific security controls
• Controls are mapped to standards and best practices and regulations for the cloud