User:Shawndouglas/sandbox/sublevel24
1. What is a cybersecurity plan and why do you need it?
.jpg)
From law firms[1] to automotive manufacturers[2], the need to address cybersecurity is increasingly apparent. In 2018, the Center for Strategic & International Studies estimated that cybercrime causes close to $600 billion in damages to the global economy every year[3], though due to underreporting of crimes, that number may be much higher. That number also likely doesn't take into account lost business, fines, litigation, and intangible losses[4] In the end, businesses of all sizes average about $200,000 in losses due to a cybersecurity incident[5], and nearly 60 percent of small and midsize businesses go bankrupt within six months because of it.[6]
And while large enterprises often grab the headlines after a cybersecurity breach, small businesses of all types are also subject to cyber crimes, and they too aren't doing enough to protect themselves. Juniper Research reports that despite small businesses making up over 99 percent of all companies, approximately 13 percent of overall cybersecurity spending came from those small businesses in 2018, amounting to about $500 per business.[7]
Even the tiniest of businesses face cybersecurity risks today. The independent contractor with a WordPress-based website that advertises their knowledge and skills must still ensure all website plugins and themes are updated and install security plugins to close potential vulnerabilities in the software. Without these precautions, hackers could spread malware, steal user data, add the website to a bot network, hack the site for the learning experience, or even hack it just for fun.[8][9][10]
As for larger companies, a late 2018 audit of Fortune 500 companies found a mix of good and bad news: they're doing better at reducing the number of entry points for hackers to enter their systems, yet their systems remain susceptible to fraudulent emails containing malware.[11] Additionally, Fortune 500 companies are still lagging behind in being publicly transparent in showing a commitment to cybersecurity and protecting customer data.[12] On a broader scale, roughly 60 to 70 percent of all companies are still ill-prepared for cyber threats, either not having an up-to-date cybersecurity strategy or having no plan at all.[6][10] By all appearances, businesses still aren't doing enough to protect themselves and their customer's data despite the fact that cybercrime appears to only be getting worse for everyone.
The most solid first steps any organization or individual can take to limit the potential effects of cybercrime is to learn more about the threat and to develop some sort of cybersecurity strategy. For most organizations, this means developing a cybersecurity plan that boasts solid policies and security controls.
A cybersecurity plan is a developed, distributed, reviewed, updated, and protected collection of assessments, analyses, requirements, controls, goals, policies, performance indicators, and metrics that shapes how an organization protects against and responds to cybersecurity threats. Developing a cybersecurity plan is not a simple process; it requires expertise, resources, and diligence. Even a simple plan may involve several months of development, more depending on the complexity involved. The time it takes to develop the plan may also be impacted by how much executive support is provided, the size of the development team (bigger is not always better), and how available required resources are.[13]
This guide attempts to assist organizations and individuals with overcoming the involved complexities of cybersecurity plan development and preventing becoming another cybersecurity statistic. It addresses the major regulations, standards, and standards frameworks related to cybersecurity, with a focus in particular on the National Institute of Standards and Technology's (NIST) Special Publication 800-53, Revision 4: Security and Privacy Controls for Federal Information Systems and Organizations. Also addressed is how to best incorporate a cybersecurity framework and controls into your plan development. At it's heart, this guide includes a comprehensive 10-step plan of attack for developing a cybersecurity plan, followed by closing comments. The end of this guide includes an appendix containing a slightly more simplified wording of NIST's most popular cybersecurity controls, as well as mappings to this wiki's own LIMSpec, an evolving set of specifications for laboratory informatics solutions and their development.
Note that this guide has been written with the intent to broadly cover multiple industries. (That also means that while NIST Special Publication 800-53 is geared to federal systems, SP 800-53 can still be applied to non-federal systems and practically any industry.) However, it does have a slight lean towards laboratories, particularly those implementing information systems. Despite that, there should be sufficient information contained herein to be helpful to most people attempting to navigate the challenges of consistently applying cybersecurity goals and policies to their organization.
References
- ↑ Sobowale, J. (1 March 2017). "Law firms must manage cybersecurity risks". ABA Journal. American Bar Association. https://www.abajournal.com/magazine/article/managing_cybersecurity_risk/. Retrieved 23 July 2020.
- ↑ Watney, C.; Draffin, C. (November 2017). "Addressing new challenges in automotive cybersecurity" (PDF). R Street Policy Study No. 118. R Street Institute. https://www.rstreet.org/wp-content/uploads/2018/04/118-1.pdf. Retrieved 23 July 2020.
- ↑ Lewis, J.A. (21 February 2018). "Economic Impact of Cybercrime". Center for Strategic & International Studies. https://www.csis.org/analysis/economic-impact-cybercrime. Retrieved 23 July 2020.
- ↑ "BLOG: Cost of Cyber Crime to Small Businesses". Virginia SBDC Blog. Virginia SBDC. 30 May 2017. https://www.virginiasbdc.org/blog-cost-of-cyber-crime-to-small-businesses/. Retrieved 23 July 2020.
- ↑ "Hiscox Cyber Readiness Report 2019" (PDF). Hiscox Ltd. April 2019. https://www.hiscox.com/documents/2019-Hiscox-Cyber-Readiness-Report.pdf. Retrieved 23 July 2020.
- ↑ 6.0 6.1 Galvin, J. (7 May 2018). "60 Percent of Small Businesses Fold Within 6 Months of a Cyber Attack. Here's How to Protect Yourself". Inc.com. https://www.inc.com/joe-galvin/60-percent-of-small-businesses-fold-within-6-months-of-a-cyber-attack-heres-how-to-protect-yourself.html. Retrieved 23 July 2020.
- ↑ "Cybersecurity Breaches to Result in over 146 Billion Records Being Stolen by 2023". Juniper Research. 8 August 2018. https://www.juniperresearch.com/press/press-releases/cybersecurity-breaches-to-result-in-over-146-bn. Retrieved 23 July 2020.
- ↑ Grima, M. (26 June 2020). "Top reasons why WordPress websites get hacked (and how you can stop it)". WP White Security. https://www.wpwhitesecurity.com/why-malicious-hacker-target-wordpress/. Retrieved 23 July 2020.
- ↑ Moen, D. (19 April 2016). "What Hackers Do With Compromised WordPress Sites". Wordfence Blog. Defiant, Inc. https://www.wordfence.com/blog/2016/04/hackers-compromised-wordpress-sites/. Retrieved 23 July 2020.
- ↑ 10.0 10.1 Talaleve, A. (23 July 2020). "Website Hacking Statistics in 2020". WebARX. https://www.webarxsecurity.com/website-hacking-statistics-2018-february/. Retrieved 23 July 2020.
- ↑ Uchill, J. (11 December 2018). "Fortune 500 cybersecurity is better and worse than you'd think". Axios. https://www.axios.com/fortune-500-cybersecurity-email-security-8cb4a3ee-0aa4-42b4-8ab4-da722d756379.html. Retrieved 23 July 2020.
- ↑ Stahie, S. (4 October 2019). "Fortune 500 Companies Take Cyber Security for Granted". Security Boulevard. https://securityboulevard.com/2019/10/fortune-500-companies-take-cyber-security-for-granted/. Retrieved 23 July 2020.
- ↑ Cadmus Group, LLC (30 October 2018). "Cybersecurity Strategy Development Guide" (PDF). National Association of Regulatory Utility Commissioners. https://pubs.naruc.org/pub/8C1D5CDD-A2C8-DA11-6DF8-FCC89B5A3204. Retrieved 23 July 2020.
