NIST framework Core: Identify, Protect, Detect, Respond, Recover.
Organizationally
In an organization, to make the social system work, you need a division of roles to support the stability and authority needed for a good security program.
Executive: Create environment for teams to thrive, using power and knowledge. - Legitimate power and some expert power with other C levels
Risk team: Identify risks to guide Execs and security. - People responsible for identifying risks. As security is often not a priority from a business perspective, it’s important to select people that have some legitimate power or reward power. The risk team overall has more coercive power, and legitimate. Has informational power also.
Security team: Managing risks and strengthening the environment. - Expert power, legitimate power, reward power.
Auditing team: Check the other teams. - Legitimate power, reward/coercive power.
Baseline and discovery phase
Gather information to establish baseline (‘where are we now?’):
- Policies and procedures
- Endpoints
- Licensing and software renewal
- Internet footprint
- Networking and devices - routers/switches/IDS/IPS/traffic
- Logging and monitoring
- Ingress/egress - ISP/account numbers and IP addresses
- External vendors - contact information (supply chain)
Assess threats and risks - four steps
- Identify - look at the world and analyse it - Watch industry trends (e.g. fintech lots of island hopping). Talk with other experts. Also watch overall trends: malware, ransomware, phishing, remote exploits. OWASP top 10, CIS 20 Critical Security Controls. Don’t only look at external threats but also attack surface.
- Assess - Likelihood * impact. Also look at cost of mitigation.
- Mitigate - Risks can be: avoided (stop doing something), remedied (change something to prevent better), transferred out (delegate risk to specialised parties), accepted (identify low risks and accept them knowingly - LAST RESORT).
- Monitor - Keep track. What gets measured gets managed. What gets attention grows. Monitor the change over time.