Difference between revisions of "User:Shawndouglas/sandbox/sublevel24"
Shawndouglas (talk | contribs) |
Shawndouglas (talk | contribs) |
||
Line 34: | Line 34: | ||
Note that before development begins, you'll want to consider the knowledge resources available and key stakeholders involved. Do you have the expertise available in-house to address all 10 planning steps, or will you need to acquire help from one or more third parties? Who are the key individuals providing critical support to the business and its operations? Having the critical expertise and stakeholders involved with the plan's development process early on can enhance the overall plan and provide for more effective strategic outcomes.<ref name="NARUCCyber18" /> | Note that before development begins, you'll want to consider the knowledge resources available and key stakeholders involved. Do you have the expertise available in-house to address all 10 planning steps, or will you need to acquire help from one or more third parties? Who are the key individuals providing critical support to the business and its operations? Having the critical expertise and stakeholders involved with the plan's development process early on can enhance the overall plan and provide for more effective strategic outcomes.<ref name="NARUCCyber18" /> | ||
Also remind yourself that completing this plan will likely not require a straightforward, by-the-numbers approach. The most feasible outcome will have you jumping around a few steps and filling in blanks or revising statements in previous portions of the plan. While the ordering of these items is deliberate, completing them step by step may not make the best sense for your organization. Don't be afraid to go back and update sections you've worked on previously using new-found knowledge. | |||
===5.1. Develop strategic cybersecurity goals and define success=== | ===5.1. Develop strategic cybersecurity goals and define success=== | ||
Line 47: | Line 49: | ||
<blockquote>Establishing a strategic [mission] is a critical first step that sets the tone for the entire process of drafting the strategy. Before developing [the mission], a commission may want to do an internal inventory of key stakeholders; conduct blue-sky thinking exercises; and do an environmental assessment and literature review to identify near-, mid-, and long-term drivers of change that may affect its goals.</blockquote> | <blockquote>Establishing a strategic [mission] is a critical first step that sets the tone for the entire process of drafting the strategy. Before developing [the mission], a commission may want to do an internal inventory of key stakeholders; conduct blue-sky thinking exercises; and do an environmental assessment and literature review to identify near-, mid-, and long-term drivers of change that may affect its goals.</blockquote> | ||
Whatever cybersecurity mission goals you inevitably declare, you'll want to be sure they | Whatever cybersecurity mission goals you inevitably declare, you'll want to be sure they "provide a sense of purpose, identity, and long-term direction" and clearly communicate what's most important in regards to cybersecurity to internal and external customers. Also consider adding concise points that paint the overall mission as one dedicated to limiting vulnerabilities and keeping risks mitigated.<ref name="NARUCCyber18" /> | ||
====5.1.4 Gain and promote active and visible support from executive management in achieving the cybersecurity mission==== | ====5.1.4 Gain and promote active and visible support from executive management in achieving the cybersecurity mission==== | ||
Ensuring executive management is fully on-board with your stated cybersecurity mission is vital. If key business leaders have not been intimately involved with the process as of yet, it is now time to gain their input and full support. As NARUC notes, "with leadership buy-in, it will be easier to institutionalize the idea that cybersecurity is a priority and can result in more readily available resources."<ref name="NARUCCyber18" /> Consider what AHIMA calls a "State of the Union" approach to presenting the cybersecurity mission goals to leadership, being prepared to answer questions from them about responsible parties, communication policies, and "cyber insurance."<ref name="DowningAHIMA17" /> (Answers to such questions are addressed further into this template. You may wish to have some of what follows informally addressed before taking it to leadership. Or perhaps have an agreement to keep leadership appraised throughout cybersecurity plan development, gaining their feedback and overall acceptance of the plan as development comes to a close.) | |||
===5.2 Define scope and responsibilities=== | ===5.2 Define scope and responsibilities=== | ||
====5.2.1 Define the scope and applicability through key requirements and boundaries==== | ====5.2.1 Define the scope and applicability through key requirements and boundaries==== | ||
Now that the cybersecurity mission goals are clear and supported by leadership, it's time to tailor strategies based on those stated goals. | |||
When considering the scope of the plan itself, you'll also want to take into account advancements in both technology and cyber threats. "Unprecedented cybersecurity challenges loom just beyond the horizon," states CNA, a nonprofit research and analysis organization located in Arlington, Virginia. But we have to focus on more than just the "now." CNA adds that "today's operational security agenda is too narrow in scope to address the wide range of issues likely to emerge in the coming years."<ref name="CNACyber19">{{cite web |url=https://www.cna.org/centers/ipr/safety-security/cyber-security-project |title=Cybersecurity Futures 2025 |work=Institute for Public Research |publisher=CNA |date=2019 |accessdate=29 November 2019}}</ref> Just as CNA is preparing a global initiative to shape policy on future cybersecurity challenges, so should you apply some focus to what potential technology upgrades may be made and what new cyber threats may appear. | |||
Additionally, some of the plan's scope may be dictated by prioritized assessment of risks to critical assets, addressed in the next section, and other assessments. It's important to keep this in mind when developing the scope; it may be affected by other parts of the plan. | |||
====5.2.2 Define the roles, responsibilities, and chain of command of those enacting and updating the cybersecurity plan==== | ====5.2.2 Define the roles, responsibilities, and chain of command of those enacting and updating the cybersecurity plan==== | ||
<ref name="DowningAHIMA17" /> | <ref name="DowningAHIMA17" /> | ||
====5.2.3 Ensure responsibility for security risk management and other key aspects (the “who” of it) is clear==== | ====5.2.3 Ensure responsibility for security risk management and other key aspects (the “who” of it) is clear==== | ||
===5.3 Identify cybersecurity requirements and objectives=== | ===5.3 Identify cybersecurity requirements and objectives=== | ||
Line 76: | Line 86: | ||
<ref name="DowningAHIMA17" /> | <ref name="DowningAHIMA17" /> | ||
====5.3.11 Select and refine security controls for identification, protection, detection, response, and recovery based on the assessments, objectives, and policies above (NIST security controls are used for this example plan)==== | ====5.3.11 Select and refine security controls for identification, protection, detection, response, and recovery based on the assessments, objectives, and policies above (NIST security controls are used for this example plan)==== | ||
===5.4 Establish performance indicators and associated time frames=== | ===5.4 Establish performance indicators and associated time frames=== | ||
Line 81: | Line 92: | ||
====5.4.2 Determine how to measure progress and assess performance (quantitative vs. qualitative) and what tools are needed for such measurement and assessment (e.g., monitoring anomalous activity, system and asset activity logging)==== | ====5.4.2 Determine how to measure progress and assess performance (quantitative vs. qualitative) and what tools are needed for such measurement and assessment (e.g., monitoring anomalous activity, system and asset activity logging)==== | ||
<ref name="DowningAHIMA17" /> | <ref name="DowningAHIMA17" /> | ||
===5.5 Identify key stakeholders=== | ===5.5 Identify key stakeholders=== | ||
Line 86: | Line 98: | ||
====5.5.2 Determine what internal entities or people may act as cybersecurity stakeholders==== | ====5.5.2 Determine what internal entities or people may act as cybersecurity stakeholders==== | ||
====5.5.3 Define how those stakeholders shape the cybersecurity plan and its strategic goals==== | ====5.5.3 Define how those stakeholders shape the cybersecurity plan and its strategic goals==== | ||
===5.6 Determine resource needs=== | ===5.6 Determine resource needs=== | ||
Line 91: | Line 104: | ||
====5.6.2 Estimate time commitments and resource allocation towards training exercises, professional assistance, infrastructure, asset management, and recovery and continuity==== | ====5.6.2 Estimate time commitments and resource allocation towards training exercises, professional assistance, infrastructure, asset management, and recovery and continuity==== | ||
====5.6.3 Review the budget==== | ====5.6.3 Review the budget==== | ||
===5.7 Develop a communications plan=== | ===5.7 Develop a communications plan=== | ||
Line 100: | Line 114: | ||
====5.7.5 Address cybersecurity training methodology, requirements, and status tracking==== | ====5.7.5 Address cybersecurity training methodology, requirements, and status tracking==== | ||
<ref name="DowningAHIMA17" /> | <ref name="DowningAHIMA17" /> | ||
===5.8 Develop a recovery and continuity plan=== | ===5.8 Develop a recovery and continuity plan=== | ||
Line 106: | Line 121: | ||
====5.8.2 Include a listing of organizational resources and their criticality, a set of formal recovery processes, security and dependency maps, a list of responsible personnel, a (previously mentioned) communication plan, and information sharing criteria==== | ====5.8.2 Include a listing of organizational resources and their criticality, a set of formal recovery processes, security and dependency maps, a list of responsible personnel, a (previously mentioned) communication plan, and information sharing criteria==== | ||
<ref name="DowningAHIMA17" /> | <ref name="DowningAHIMA17" /> | ||
===5.9 Establish how the overall cybersecurity plan will be implemented=== | ===5.9 Establish how the overall cybersecurity plan will be implemented=== | ||
Line 111: | Line 127: | ||
====5.9.2 State the major implementation milestones==== | ====5.9.2 State the major implementation milestones==== | ||
====5.9.3 Determine how best to communicate progress on the plan’s implementation==== | ====5.9.3 Determine how best to communicate progress on the plan’s implementation==== | ||
===5.10 Review progress=== | ===5.10 Review progress=== |
Revision as of 23:35, 29 November 2019
1. What is a cybersecurity plan and why do you need it?
Developing a cybersecurity plan is not a simple process; it requires expertise, resources, and diligence. Even a simple plan may involve several months of development, more depending on the complexity involved. The time it takes to develop the plan may also be impacted by how much executive support is provided, the size of the development team (bigger is not always better), and how available required resources are.[1]
2. What are the major standard and regulations dictating cybersecurity action?
3. The NIST Cybersecurity Framework and its control families
4. Fitting a framework or specification into a cybersecurity plan
5. Develop and create the cybersecurity plan
What follows is a template to help guide you in developing your own cybersecurity plan. This template has at its core a modified version of the template structure suggested in the late 2018 Cybersecurity Strategy Development Guide created for the National Association of Regulatory Utility Commissioners (NARUC).[1] While their document focuses on cybersecurity for utility cooperatives and commissions, much of what NARUC suggests can still be more broadly applied to all but the tiniest of businesses. Additional resources such as AHIMA's AHIMA Guidelines: The Cybersecurity Plan[4]; National Rural Electric Cooperative Association (NRECA), Cooperative Research Network's Guide to Developing a Cyber Security and Risk Mitigation Plan[2]; and various cybersecurity experts' articles[3][5][6][7][8][9] have been reviewed to further supplement the template. This template covers 10 main cybersecurity planning steps, each with multiple sub-steps. Additional commentary, guidance, and citation is included with those sub-steps.
Note that before development begins, you'll want to consider the knowledge resources available and key stakeholders involved. Do you have the expertise available in-house to address all 10 planning steps, or will you need to acquire help from one or more third parties? Who are the key individuals providing critical support to the business and its operations? Having the critical expertise and stakeholders involved with the plan's development process early on can enhance the overall plan and provide for more effective strategic outcomes.[1]
Also remind yourself that completing this plan will likely not require a straightforward, by-the-numbers approach. The most feasible outcome will have you jumping around a few steps and filling in blanks or revising statements in previous portions of the plan. While the ordering of these items is deliberate, completing them step by step may not make the best sense for your organization. Don't be afraid to go back and update sections you've worked on previously using new-found knowledge.
5.1. Develop strategic cybersecurity goals and define success
5.1.1 Broadly articulate business goals and how information technology relates
Something should drive you to want to implement a cybersecurity plan. Sometimes the impetus may be external, such as a major breach at another company that affects millions of people. But more often than not, well-formulated business goals and the resources, regulations, and motivations tied to them will propel development of the plan. Business goals have, hopefully, already been developed by the time you consider a cybersecurity plan. Now is the time to identify the technology and data that are tied to those goals. A clinical testing laboratory, for example, may have as a business goal "to provide prompt, accurate analysis of specimens submitted to the laboratory." Does the lab utilize information management systems as a means to better meet that goal? How secure are the systems? What are the consequences of having mission-critical data compromised in said systems?
5.1.2 Articulate why cybersecurity is vital to achieving those goals
Looking to your business goals for the technology, data, and other resources used to achieve those goals gives you an opportunity to turn the magnifying glass towards why the technology, data, and resources need to be secure. For example, the clinical testing lab will likely be dealing with protected health information (PHI), and an electric cooperative must reliably provide service practically 100 percent of the time. Both the data and the service must be protected from physical and cyber intrusion, at risk of significant and costly consequence. Be clear about what the potential consequences actually may be, as well as how business goals could be hindered without proper cybersecurity for critical assets. Or, conversely, clearly state what will be positively achieved by addressing cybersecurity for those assets.
5.1.3 Based on the above, state the cybersecurity mission and define how to achieve it
You've stated your business goals, how technology and data plays a role in them, and why it's vital to ensure their security. Now it's time to develop your strategic mission in regards to cybersecurity. You may wish to take a few extra steps before defining the goals of that mission, however. The NARUC has this to say in that regard[1]:
Establishing a strategic [mission] is a critical first step that sets the tone for the entire process of drafting the strategy. Before developing [the mission], a commission may want to do an internal inventory of key stakeholders; conduct blue-sky thinking exercises; and do an environmental assessment and literature review to identify near-, mid-, and long-term drivers of change that may affect its goals.
Whatever cybersecurity mission goals you inevitably declare, you'll want to be sure they "provide a sense of purpose, identity, and long-term direction" and clearly communicate what's most important in regards to cybersecurity to internal and external customers. Also consider adding concise points that paint the overall mission as one dedicated to limiting vulnerabilities and keeping risks mitigated.[1]
5.1.4 Gain and promote active and visible support from executive management in achieving the cybersecurity mission
Ensuring executive management is fully on-board with your stated cybersecurity mission is vital. If key business leaders have not been intimately involved with the process as of yet, it is now time to gain their input and full support. As NARUC notes, "with leadership buy-in, it will be easier to institutionalize the idea that cybersecurity is a priority and can result in more readily available resources."[1] Consider what AHIMA calls a "State of the Union" approach to presenting the cybersecurity mission goals to leadership, being prepared to answer questions from them about responsible parties, communication policies, and "cyber insurance."[4] (Answers to such questions are addressed further into this template. You may wish to have some of what follows informally addressed before taking it to leadership. Or perhaps have an agreement to keep leadership appraised throughout cybersecurity plan development, gaining their feedback and overall acceptance of the plan as development comes to a close.)
5.2 Define scope and responsibilities
5.2.1 Define the scope and applicability through key requirements and boundaries
Now that the cybersecurity mission goals are clear and supported by leadership, it's time to tailor strategies based on those stated goals.
When considering the scope of the plan itself, you'll also want to take into account advancements in both technology and cyber threats. "Unprecedented cybersecurity challenges loom just beyond the horizon," states CNA, a nonprofit research and analysis organization located in Arlington, Virginia. But we have to focus on more than just the "now." CNA adds that "today's operational security agenda is too narrow in scope to address the wide range of issues likely to emerge in the coming years."[10] Just as CNA is preparing a global initiative to shape policy on future cybersecurity challenges, so should you apply some focus to what potential technology upgrades may be made and what new cyber threats may appear.
Additionally, some of the plan's scope may be dictated by prioritized assessment of risks to critical assets, addressed in the next section, and other assessments. It's important to keep this in mind when developing the scope; it may be affected by other parts of the plan.
5.2.2 Define the roles, responsibilities, and chain of command of those enacting and updating the cybersecurity plan
5.2.3 Ensure responsibility for security risk management and other key aspects (the “who” of it) is clear
5.3 Identify cybersecurity requirements and objectives
5.3.1 Detail the existing system and classify its critical cyber assets
5.3.2 Define the contained data and classify its criticality (data maps may help)
5.3.3 Identify current and previous cybersecurity policy and tools; determine what has worked and what hasn’t
5.3.4 Identify the regulations and standards affecting your assets and data (e.g., what are the data retention requirements)
5.3.6 Identify and analyze physical entry points
5.3.7 Perform a gap analysis (comparing safeguards in place vs. how well they work)
5.3.8 Perform a risk assessment and prioritize risk based on threat, vulnerability, likelihood, and impact (e.g., examine personnel, third parties, hardware, etc.)
5.3.9 Declare and describe objectives based on the outcomes of the above assessments
5.3.10 Develop new policies for passwords, physical security, etc. where gaps have been identified from the above assessments and objectives
5.3.11 Select and refine security controls for identification, protection, detection, response, and recovery based on the assessments, objectives, and policies above (NIST security controls are used for this example plan)
5.4 Establish performance indicators and associated time frames
5.4.1 Determine baselines and indicators based on the assessments and objectives from the previous step
5.4.2 Determine how to measure progress and assess performance (quantitative vs. qualitative) and what tools are needed for such measurement and assessment (e.g., monitoring anomalous activity, system and asset activity logging)
5.5 Identify key stakeholders
5.5.1 Determine what external (federal, state, local, and private) entities the business currently interacts with
5.5.2 Determine what internal entities or people may act as cybersecurity stakeholders
5.5.3 Define how those stakeholders shape the cybersecurity plan and its strategic goals
5.6 Determine resource needs
5.6.1 Determine whether sufficient in-house subject-matter expertise exists, and if not, how it will be acquired
5.6.2 Estimate time commitments and resource allocation towards training exercises, professional assistance, infrastructure, asset management, and recovery and continuity
5.6.3 Review the budget
5.7 Develop a communications plan
5.7.1 Address the need for transparency in improving the cybersecurity culture
5.7.2 Determine guidelines for everyday communication (e.g., informing third parties of organization privacy policies) and mandatory reporting to meet cybersecurity goals
5.7.3 Determine guidelines for handling or discussing sensitive information
5.7.4 Address incident reporting and response (consider the use of playbooks, report templates, and training drills) as well as corrective action
5.7.5 Address cybersecurity training methodology, requirements, and status tracking
5.8 Develop a recovery and continuity plan
5.8.1 Consider linking a cybersecurity incident recovery plan and communication tools with a business continuity plan and its communication tools
5.8.2 Include a listing of organizational resources and their criticality, a set of formal recovery processes, security and dependency maps, a list of responsible personnel, a (previously mentioned) communication plan, and information sharing criteria
5.9 Establish how the overall cybersecurity plan will be implemented
5.9.1 Detail the specific steps regarding how all the above will be implemented
5.9.2 State the major implementation milestones
5.9.3 Determine how best to communicate progress on the plan’s implementation
5.10 Review progress
5.10.1 Monitor and assess the effectiveness of security controls
5.10.2 Review how to capture and incorporate corrective action procedures and results
5.10.3 Determine how often to review and update the cybersecurity plan
5.10.4 Determine external sources for “lessons learned” and how to incorporate them for improving cybersecurity strategy
6. Closing remarks
Appendix 1. A revised NIST Cybersecurity Framework, tied to LIMSpec
6.1 Access control
6.2 Awareness and training
6.3 Audit and accountability
6.4 Security assessment and authorization
6.5 Configuration management
6.6 Contingency planning
6.7 Identification and authentication
6.8 Incident response
6.9 Maintenance
6.10 Media protection
6.11 Physical and environmental protection
6.12 Planning
6.13 Personnel security
6.14 Risk assessment
6.15 System and services acquisition
6.16 System and communication protection
6.17 System and information integrity
References
- ↑ 1.0 1.1 1.2 1.3 1.4 1.5 1.6 Cadmus Group, LLC (30 October 2018). "Cybersecurity Strategy Development Guide" (PDF). National Association of Regulatory Utility Commissioners. https://pubs.naruc.org/pub/8C1D5CDD-A2C8-DA11-6DF8-FCC89B5A3204. Retrieved 29 November 2019.
- ↑ 2.0 2.1 Lebanidze, E. (2011). "Guide to Developing a Cyber Security and Risk Mitigation Plan" (PDF). National Rural Electric Cooperative Association, Cooperative Research Network. https://www.cooperative.com/programs-services/bts/documents/guide-cybersecurity-mitigation-plan.pdf. Retrieved 29 November 2019.
- ↑ 3.0 3.1 Lago, C. (10 July 2019). "How to implement a successful cybersecurity plan". CIO. IDG Communications, Inc. https://www.cio.com/article/3295578/how-to-implement-a-successful-security-plan.html. Retrieved 29 November 2019.
- ↑ 4.00 4.01 4.02 4.03 4.04 4.05 4.06 4.07 4.08 4.09 4.10 4.11 4.12 4.13 4.14 Downing, K. (December 2017). "AHIMA Guidelines: The Cybersecurity Plan" (PDF). American Health Information Management Association. https://journal.ahima.org/wp-content/uploads/2017/12/AHIMA-Guidelines-Cybersecurity-Plan.pdf. Retrieved 29 November 2019.
- ↑ 5.0 5.1 Norton, K. (21 June 2018). "Similar but Different: Gap Assessment vs Risk Analysis". HIPAA One. https://www.hipaaone.com/2018/06/21/gap-assessment-vs-risk-analysis/. Retrieved 29 November 2019.
- ↑ 6.0 6.1 Ewing, S. (12 July 2017). "4 Ways to Integrate Your Cyber Security Incident Response and Business Continuity Plans". Delta Risk. https://deltarisk.com/blog/4-ways-to-integrate-your-cyber-security-incident-response-and-business-continuity-plans/. Retrieved 29 November 2019.
- ↑ 7.0 7.1 Krasnow, M.J. (February 2017). "Cyber-Security Event Recovery Plans". International Risk Management Institute, Inc. https://www.irmi.com/articles/expert-commentary/cyber-security-event-recovery-plans. Retrieved 29 November 2019.
- ↑ 8.0 8.1 "How to Develop A Cybersecurity Plan For Your Company (checklist included)". Copeland Technology Solutions. 17 July 2018. https://www.copelanddata.com/blog/how-to-develop-a-cybersecurity-plan/. Retrieved 29 November 2019.
- ↑ 9.0 9.1 Talamantes, J. (6 September 2017). "Does Your Cybersecurity Plan Need an Update?". RedTeam Knowledge Base. RedTeam Security Corporation. https://www.redteamsecure.com/blog/does-your-cybersecurity-plan-need-an-update/. Retrieved 29 November 2019.
- ↑ "Cybersecurity Futures 2025". Institute for Public Research. CNA. 2019. https://www.cna.org/centers/ipr/safety-security/cyber-security-project. Retrieved 29 November 2019.