In this module we will take a closer look at the NIST Cybersecurity Framework and apply its tenets to different hypothetical situations. Also included in this module is course exam #3. Good luck!
how the NIST Cybersecurity Framework might work.
we will undertake an abbreviated version of the framework process.
a medium sized city of about 450,000 residents in Colorado.
the NIST Cybersecurity Framework over the next year.
In essence, completing steps one and two of the system framework.
using the framework core according to step three.
According to our analysis, we rate ourselves at tier one, partial.
risk, and we have not included our suppliers in any past risk assessments.
Okay, this puts us up to step four, conduct a risk assessment.
that could disrupt 100% of the utility service for up to a week.
should we take the next step and try to achieve tier level two?
Pause this video if necessary, to consider your answer before we continue.
Yes, we should try to attain a higher tier level?
Or no, we are sufficiently protected by our current profile?
water to 80% or 450,000 residents, I would say yes.
We should try to attain at least the next tier level, tier level two.
also pressure to your fire hydrants.
Government, businesses, and schools might have to shut down.
I hope you agree that such a situation would be considered catastrophic.
that will raise our current cybersecurity profile to at least level two.
So we proceed to step five, and we create a target profile using the framework core.
So we now go on to step six, to identify and prioritize gaps.
comparing our current profile to the target profile.
we pretty much comply with sub categories one, two, and three.
to which only system administrators have the lock and code.
And this system is configured to prevent any unauthorized access over the Internet.
according to the principles of least privilege.
At present, all 35 utility employees have system accounts.
all accounts have the same non-administrative access rights.
And notice that we have implemented none of it's subcategories.
undergoing any kind of internal training.
Okay, here we are in step six.
that are required to raise our current profile to tier two.
The question is, which should be granted higher priority?
access rights based on the principle of least privileged is more important?
according to Awareness and Training Subcategory 1, is more important?
Again, pause the video if necessary to consider your answer.
Did you assign higher priority to Access Control Subcategory 4?
Or did you assign higher priority to Awareness and Training Subcategory 1?
The correct answer is, there is no correct answer.
Even if some of you said both should have the same priority.
A strong argument could be made to give either measure precedence over the other.
not the least of which is your own knowledge and experience.
you can reasonably assess the risk of each.
You have advanced your organization from ignorance to understanding.
choose first, and you are aware of the latent risk of doing the other second.
into the actual application of the NIST Cybersecurity Framework.
And give you some appreciation for the challenges attended to the task.
of the NIST Cybersecurity Framework.