Chapter 4: Frameworks Flashcards
framework
a guiding document which provides structure to the ways in which we manage risks, develop enterprise architecture, and secure all our assets
RMF
risk management frameworks
common RMFs
NIST RMF, ISO/IEC 27005, OCTAVE, and FAIR
Seven steps of NIST RMF
Prepare, categorize, select, implement, assess, authorize, and monitor
common security controls in NIST framework
they exist outside of a system and apply to multiple systems
system-specific security controls in NIST framework
they exist inside a system boundary and protect only the one system
hybrid security controls in NIST framework
they are a combination of the other two (common and system-specific)
Four risk treatments
mitigated, accepted, transferred, or avoided
OCTAVE
Operationally Critical Threat, Asset, and Vulnerability Evaluation; team-oriented risk management methodology which employs workshops and is commonly used in the commercial sector
FAIR
Factor Analysis of Information Risk; only internationally recognized quantitative approach to risk management
Most common info security program frameworks
ISO/IEC 27001 and NIST cybersecurity framework
ISO/IEC 27001
standard for the establishment, implementation, control, and improvement of the info security mgmt system (ISMS)
NIST Cybersecurity Framework official name
Framework for Improving Critical Infrastructure Cybersecurity
Five higher-level functions of NIST Cybersecurity Framework
Identify, protect, detect, respond, and recover
Most common security controls frameworks
NIST SP 800-53, CIS Controls, and COBIT
NIST SP 800-53
over 1,000 security controls grouped into 20 families; Security and Privacy Controls for Info Systems and Orgs
CIS
Center for Internet Security Controls
CIS Controls framework
20 controls and 171 subcontrols organized in implementation groups to address any org’s security needs from small to enterprise level
COBIT
framework of control objectives and allows for IT governance; developed by ISACA and ITGI (IT Governance Institute)
Enterprise architecture frameworks
used to develop architectures for specific stakeholders and present information in views; used to build individual architectures that best map to individual organizational needs and business drivers
Blueprints
functional definitions for the integration of technology into business processes
Most common enterprise architecture frameworks
Zachman and SABSA; TOGAF and DoDAF
Zachman Framework
enterprise architecture framework
SABSA
security enterprise architecture framework
ITIL
set of best practices for IT service management
Six Sigma
used to identify defects in processes so that the processes can be improved upon
CMM
Capability Maturity Model
what is the CMM
allows for processes to improve in an incremented and standard approach
ISO/IEC 27005
describe risk management frameworks
NIST SP 800-37
describe risk management frameworks
ISO/IEC 27001
describes information security management system
OCTAVE
developed by Carnegie Mellon University; focused only on risk assessments; team-oriented risk management methodology which employs workshops
Key benefit of Zachman Framework
Allows different groups within the org to look at it from different viewpoints
Key benefit of the DoDAF
ensures all systems, processes, and personnel are interoperable in a concerted effort to accomplish organizational missions
Key benefit of the TOGAF
Use of the iterative and cyclic Architecture Development Method (ADM)
Key benefit of the ITIL
Focus on internal SLAs between the IT department and the “customers” it serves
COBIT 2019
Balances resources utilization, risk levels, and realization of benefits by explicitly tying stakeholder needs to organizational goals to IT goals
NIST RMF categorization
NIST RMF relies on the Federal Information Processing Standard Publication 199 (FIPS 199) which breaks down a system’s criticality by security objective (confidentiality, integrity, availability) and then applies the highest security objective category (out of low, medium, high) to determine the overall category of the system
SC
security category; SC = {(confidentiality, high), (integrity, medium), (availability, low)}= high
