NIST Framework Notes Flashcards
Understand NIST Framework
What are the 3 components of the NIST Framework?
Framework Core, Implementation Tiers, and Framework Profiles
Framework Core
Outlines the risk and the outcomes
Implementation Tier
Outlines how cybersecurity risk is managed by an organization.
Framework Profiles
Helps organizations outline how they are going to implement cybersecurity outcomes
Framework CORE Functions
Identify, Protect, Detect, Respond, and Recover
Identify Categories
Asset Management, Business Environment, Governance, Risk Assessment, Risk Management Strategy, and Supply Chain Risk Management.
Protect Categories
Identity Management & Access Control, Awareness Training, Data Security, Information Protection Processes and Procedures, Maintenance, and Protective Technology.
Detect Categories
Anomalies and Events, Security/continuous monitoring, and Detection Processes.
Respond Categories
Response Planning, Communications, Analysis, Mitigation, and Improvements
Recover Categories
Recovery Planning, Improvements, and Communications
4 Tiers in NIST Framework
Partial, Risk Informed, Repeatable, and Adaptive
Partial Tier 1
Cyber program is ad-hoc
Risk-Informed Tier 2
Cyber program is beginning to be informally developed
Repeatable Tier 3
Cyber program is defined
Adaptive Tier 4
Cyber program is robust and seeks out new threats before they occur
Asset Management
Defining the assets that are a part of the organization’s goals and business functions
Business Environment
Helps understand the goals of the business.
Governance
Identify policies and procedures, and relevant roles/responsibilities of those internal and external of the organization.
Risk Assessment
Identifying vulnerabilities
Risk Management Strategies
Process and procedures to prevent and detect risk
Supply Chain Risk Management
Identifying, Assessing, protecting, and managing our suppliers
Identity Management and Authentication
Least Privilege and Trust, but verify.
Awareness Training
providing insight into the organization’s initiatives and governance policies
Data Security
protecting data at rest, transit, and availability.
Information Protection
Confidentiality, Integrity, and availability of data
Maintenance
Continuous improvement of processes and how is it protected
Protection
WCGW and what are the critical assets that need to be operational
Anomalies and Events
establish a network baseline (traffic, etc..). Understand what good looks like.
Security and Continous Monitoring
Identifying the baseline and events that don’t meet the expected criteria
Detection Processes
Identifying roles and responsibilities for detecting events
Response Planning
Identify policies and procedures for events
Communications
Identify the person responsible and who needs to be informed. Make sure incidents are reported based on policies
Analysis
Take a closer look on what caused the incident or investigate incidents to gain assurance on the impact.
Mitigation
Limit the impact of an incident and remediate
Improvements
Understand what caused issues and build a plan to improve (Lessons learned).
Recovery Planning
Make sure plans are executed during and after incidents
