Security Frameworks

Security frameworks and controls#

Security frameworks are guidelines used for building plans to help mitigate risks and threats to data and privacy.
Purpose of security frameworks

• Protecting PII
• Securing financial information
• Identifying security weaknesses
• Managing organizational risks
• Aligning security with business goals

Core components of security frameworks

1. Identifying and documenting security goals
2. Setting guidelines to achieve security goals
3. Implementing security processes
4. Monitoring and communicating results

Security frameworks are about:

• Governance (e.g., ISO 27001, COBIT)
• Risk Management (e.g., NIST RMF, FAIR)
• Compliance (e.g., HIPAA, PCI-DSS)
• Controls and Standards (e.g., CIS, NIST CSF)
• Threat modeling and mapping (e.g., MITRE ATT&CK)

CIA Triad#

NIST Cybersecurity Framework (CSF)#

A voluntary framework that consists of standards, guidelines, and best practices to manage cybersecurity risk.
NIST CSF components: Core, Tiers, Profiles

Core#

The CSF core is a set of desired cybersecurity outcomes that help organizations customize their security plan. It consists of six functions, or parts: Identify, Protect, Detect, Respond, Recover, and Govern.

1. Identify: management of cybersecurity risk and its effect on an organization’s people and assets.
2. Protect: The strategy used to protect an organization through the implementation of policies, procedures, training, and tools that help mitigate cybersecurity threats.
3. Detect: Identifying potential security incidents and improving monitoring capabilities to increase the speed and efficiency of detections.
4. Respond: Making sure that the proper procedures are used to contain, neutralize, and analyze security incidents, and implement improvements to the security process.
5. Recover: The process of returning affected systems back to normal operation.
6. Govern

Tiers#

The CSF tiers are a way of measuring the sophistication of an organization’s cybersecurity program. CSF tiers are measured on a scale of 1 to 4. Tier 1 is the lowest score, indicating that a limited set of security controls have been implemented. Overall, CSF tiers are used to assess an organization’s security posture and identify areas for improvement.

Profiles#

The CSF profiles are pre-made templates of the NIST CSF that are developed by a team of industry experts. CSF profiles are tailored to address the specific risks of an organization or industry. They are used to help organizations develop a baseline for their cybersecurity plans, or as a way of comparing their current cybersecurity posture to a specific industry standard.

Implementing the CSF#

• Create a current profile of the security operations and outline the specific needs of your business.
• Perform a risk assessment to identify which of your current operations are meeting business and regulatory standards.
• Analyze and prioritize existing gaps in security operations that place the businesses assets at risk.
• Implement a plan of action to achieve your organization’s goals and objectives.

The NIST CSF also expands into the protection of the United States federal government with NIST special publication, or SP 800-53. It provides a unified framework for protecting the security of information systems within the federal government, including the systems provided by private companies for federal government use.

NIST’s Risk Management Framework (RMF)#

7 steps

1. Prepare
   Activities that are necessary to manage security and privacy risks before a breach occurs
2. Categorize
   Used to develop risk management processes and tasks
3. Select
   Choose, customize, and capture documentation of the controls that protect an organization.
4. Implement
   Implement security and privacy plans for the organization.
5. Assess
   Determine if established controls are implemented correctly.
6. Authorize
   Being accountable for the security and privacy risks that may exist in an organization.
7. Monitor
   Be aware of how systems are operating.

Other frameworks#

• The Federal Energy Regulatory Commission - North American Electric Reliability Corporation (FERC-NERC)
• The Federal Risk and Authorization Management Program (FedRAMP®)
• Center for Internet Security (CIS®)
• General Data Protection Regulation (GDPR)
  GDPR is a European Union (E.U.) general data regulation that protects the processing of E.U. residents’ data and their right to privacy in and out of E.U. territory.
• Payment Card Industry Data Security Standard (PCI DSS)
• The Health Insurance Portability and Accountability Act (HIPAA) - 1996
• International Organization for Standardization (ISO)
• System and Organizations Controls (SOC type 1, SOC type 2)
  The American Institute of Certified Public Accountants® (AICPA) auditing standards board developed this standard. The SOC1 and SOC2 are a series of reports that focus on an organization’s user access policies at different organizational levels.

Cyber Threat Framework (CTF)#

According to the Office of the Director of National Intelligence, the CTF was developed by the U.S. government to provide “a common language for describing and communicating information about cyber threat activity.” By providing a common language to communicate information about threat activity, the CTF helps cybersecurity professionals analyze and share information more efficiently. This allows organizations to improve their response to the constantly evolving cybersecurity landscape and threat actors’ many tactics and techniques.

ISO/IEC 27001#

An internationally recognized and used framework is ISO/IEC (International Organization for Standardization/International Electrotechnical Commission) 27001. The ISO 27000 family of standards enables organizations of all sectors and sizes to manage the security of assets, such as financial information, intellectual property, employee data, and information entrusted to third parties. This framework outlines requirements for an information security management system, best practices, and controls that support an organization’s ability to manage risks. Although the ISO/IEC 27001 framework does not require the use of specific controls, it does provide a collection of controls that organizations can use to improve their security posture.

ISO/IEC 19249#

ISO/IEC 19249:2017 Information technology - Security techniques - Catalogue of architectural and design principles for secure products, systems and applications.

• https://www.iso.org/standard/64140.html ↗
  ISO/IEC 19249 lists five architectural principles:

1. Domain Separation: Every set of related components is grouped as a single entity; components can be applications, data, or other resources. Each entity will have its own domain and be assigned a common set of security attributes. For example, consider the x86 processor privilege levels: the operating system kernel can run in ring 0 (the most privileged level). In contrast, user-mode applications can run in ring 3 (the least privileged level). Domain separation is included in the Goguen-Meseguer Model.
2. Layering: When a system is structured into many abstract levels or layers, it becomes possible to impose security policies at different levels; moreover, it would be feasible to validate the operation. Let’s consider the OSI (Open Systems Interconnection) model with its seven layers in networking. Each layer in the OSI model provides specific services to the layer above it. This layering makes it possible to impose security policies and easily validate that the system is working as intended. Another example from the programming world is disk operations; a programmer usually uses the disk read and write functions provided by the chosen high-level programming language. The programming language hides the low-level system calls and presents them as more user-friendly methods. Layering relates to Defence in Depth.
3. Encapsulation: In object-oriented programming (OOP), we hide low-level implementations and prevent direct manipulation of the data in an object by providing specific methods for that purpose. For example, if you have a clock object, you would provide a method increment() instead of giving the user direct access to the seconds variable. The aim is to prevent invalid values for your variables. Similarly, in larger systems, you would use (or even design) a proper Application Programming Interface (API) that your application would use to access the database.
4. Redundancy: This principle ensures availability and integrity. There are many examples related to redundancy. Consider the case of a hardware server with two built-in power supplies: if one power supply fails, the system continues to function. Consider a RAID 5 configuration with three drives: if one drive fails, data remains available using the remaining two drives. Moreover, if data is improperly changed on one of the disks, it would be detected via the parity, ensuring the data’s integrity.
5. Virtualization: With the advent of cloud services, virtualization has become more common and popular. The concept of virtualization is sharing a single set of hardware among multiple operating systems. Virtualization provides sandboxing capabilities that improve security boundaries, secure detonation, and observance of malicious programs.

ISO/IEC 19249 teaches five design principles:

1. Least Privilege: You can also phrase it informally as “need-to basis” or “need-to-know basis” as you answer the question, “who can access what?” The principle of least privilege teaches that you should provide the least amount of permissions for someone to carry out their task and nothing more. For example, if a user needs to be able to view a document, you should give them read rights without write rights.
2. Attack Surface Minimisation: Every system has vulnerabilities that an attacker might use to compromise a system. Some vulnerabilities are known, while others are yet to be discovered. These vulnerabilities represent risks that we should aim to minimize. For example, in one of the steps to harden a Linux system, we would disable any service we don’t need.
3. Centralized Parameter Validation: Many threats are due to the system receiving input, especially from users. Invalid inputs can be used to exploit vulnerabilities in the system, such as denial of service and remote code execution. Therefore, parameter validation is a necessary step to ensure the correct system state. Considering the number of parameters a system handles, the validation of the parameters should be centralized within one library or system.
4. Centralized General Security Services: As a security principle, we should aim to centralize all security services. For example, we would create a centralized server for authentication. Of course, you might take proper measures to ensure availability and prevent creating a single point of failure.
5. Preparing for Error and Exception Handling: Whenever we build a system, we should take into account that errors and exceptions do and will occur. For instance, in a shopping application, a customer might try to place an order for an out-of-stock item. A database might get overloaded and stop responding to a web application. This principle teaches that the systems should be designed to fail safe; for example, if a firewall crashes, it should block all traffic instead of allowing all traffic. Moreover, we should be careful that error messages don’t leak information that we consider confidential, such as dumping memory content that contains information related to other customers.