As a seasoned cybersecurity scientist with extensive experience across various analytical, auditing, and investigative roles, I bring a unique lens to the NIST Cybersecurity Framework Version 2.0 (CSF 2.0). While the traditional application of the CSF often leans towards mapping its categories to security controls, this article intends to pivot from the usual engineering-focused interpretations. Here, we delve into the CSF 2.0 with an eye on the seven interrelated core themes of cybersecurity science:
- Risk: The identification, assessment, and prioritization of risks followed by coordinated and economical application of resources to minimize, monitor, and control the probability or impact of unfortunate events.
- Attack Analysis: The study and investigation of attack methods and pathways, focusing on understanding and anticipating attacker behavior and methodologies.
- Measurable Security: Establishing quantifiable metrics and benchmarks to evaluate the effectiveness of security measures and controls.
- Agility: The ability to rapidly adapt and respond to new threats, changing requirements, and evolving technological landscapes.
- Human Factors: Recognizing and accounting for the human element in cybersecurity, including user behavior, education, and the interface between humans and systems.
- Common Language: Developing and using a standardized set of terms and concepts that enable clear communication and understanding among diverse stakeholders in the cybersecurity field.
- Core Principles: Fundamental doctrines and guidelines that form the foundation of effective cybersecurity practices and policies.
This analysis aims to unfold the framework from a cybersecurity science standpoint, highlighting its applicability and relevance to roles that encompass analysts, auditors, investigators, and other key cybersecurity science figures in this domain. By doing so, we endeavor to offer insights that resonate more with the day-to-day realities and strategic nuances of cybersecurity science professionals.
The NIST CSF 2.0 is structured into several functions, each containing specific categories and subcategories. Each subcategory within these functions can be related to the seven core themes of cybersecurity science (Risk, Attack Analysis, Measurable Security, Agility, Human Factors, Common Language, and Core Principles). Here's an overview based on the content of the CSF 2.0:
GOVERN (GV)
Organizational Context (GV.OC) - The circumstances — mission, stakeholder expectations, and legal, regulatory, and contractual requirements — surrounding the organization’s cybersecurity risk management decisions are understood
- Subcategories: GV.OC-01 to GV.OC-05
- Relevance: Addresses Risk and Human Factors by understanding the organizational mission and stakeholder expectations, and manages legal, regulatory, and contractual requirements.
Risk Management Strategy (GV.RM) - The organization’s priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions
- Subcategories: GV.RM-01 to GV.RM-07
- Relevance: Focuses on Risk, Measurable Security, and Core Principles through establishing risk management objectives, determining risk appetite, and integrating cybersecurity risk into enterprise risk management processes.
Cybersecurity Supply Chain Risk Management (GV.SC) - The organization’s priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions
- Subcategories: GV.SC-01 to GV.SC-10
- Relevance: Linked to Risk, Common Language, and Core Principles by establishing a supply chain risk management program, and integrating supply chain security practices into cybersecurity risk management.
Roles, Responsibilities, and Authorities (GV.RR) - Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated
- Subcategories: GV.RR-01 to GV.RR-04
- Relevance: Addresses Human Factors and Core Principles by establishing accountability for cybersecurity risks and integrating cybersecurity into human resources practices.
Policies, Processes, and Procedures (GV.PO) - Organizational cybersecurity policies, processes, and procedures are established, communicated, and enforced
- Subcategories: GV.PO-01 to GV.PO-02
- Relevance: Relates to Common Language and Core Principles by establishing, communicating, reviewing, and updating policies for managing cybersecurity risks.
Oversight (GV.OV) - Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy
- Subcategories: GV.OV-01 to GV.OV-03
- Relevance: Tied to Measurable Security and Core Principles by using risk management outcomes to inform and adjust the strategy.
IDENTIFY (ID)
Asset Management (ID.AM) - Assets (e.g., data, hardware software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization’s risk strategy
- Subcategories: ID.AM-01 to ID.AM-08
- Relevance: Pertains to Risk and Measurable Security through the maintenance of inventories of hardware, software, and data, and managing these assets throughout their lifecycle.
Risk Assessment (ID.RA) - The organization understands the cybersecurity risk to the organization, assets, and individuals.
- Subcategories: ID.RA-01 to ID.RA-09
- Relevance: Focuses on Risk, Attack Analysis, and Measurable Security by identifying vulnerabilities, receiving cyber threat intelligence, and determining the impact and likelihood of threats.
Improvement (ID.IM) - Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all Framework Functions
- Subcategories: ID.IM-01 to ID.IM-04
- Relevance: Linked to Agility and Core Principles through continuous evaluation and identification of improvements in cybersecurity risk management processes.
PROTECT (PR)
Identity Management, Authentication, and Access Control (PR.AA) - Access to physical and logical assets is limited to authorized users, services, and hardware, and is managed commensurate with the assessed risk of unauthorized access
- Subcategories: PR.AA-01 to PR.AA-06
- Relevance: Addresses Measurable Security, Human Factors, and Core Principles by managing identities, credentials, and physical access to assets.
Awareness and Training (PR.AT) - The organization’s personnel are provided cybersecurity awareness and training so they can perform their cybersecurity-related tasks
- Subcategories: PR.AT-01 to PR.AT-02
- Relevance: Tied to Human Factors by providing cybersecurity awareness and training to personnel and specialized roles.
Data Security (PR.DS) - Data is managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information
- Subcategories: PR.DS-01 to PR.DS-11
- Relevance: Relates to Measurable Security and Core Principles through protecting the confidentiality, integrity, and availability of data in various states (at-rest, in-transit, in-use) and managing data throughout its lifecycle.
Platform Security (PR.PS) - The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization’s risk strategy to protect their confidentiality, integrity, and availability
- Subcategories: PR.PS-01 to PR.PS-06
- Relevance: Focuses on Measurable Security and Core Principles by applying configuration management practices, maintaining software and hardware, and integrating secure software development practices.
Technology Infrastructure Resilience (PR.IR) - Security architectures are managed with the organization’s risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience
- Subcategories: PR.IR-01 to PR.IR-04
- Relevance: Addresses Measurable Security and Core Principles by protecting networks, ensuring technology asset resilience, and maintaining resource capacity for availability.
DETECT (DE)
Continuous Monitoring (DE.CM) - Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events
- Subcategories: DE.CM-01 to DE.CM-09
- Relevance: Primarily related to Attack Analysis and Measurable Security by monitoring networks, the physical environment, and computing environments to find potentially adverse events.
Adverse Event Analysis (DE.AE) - Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents
- Subcategories: DE.AE-02 to DE.AE-08
- Relevance: Pertains to Attack Analysis by analyzing adverse events to understand associated activities and determining the impact and scope of events.
RESPOND (RS)
Incident Management (RS.MA) - Responses to detected cybersecurity incidents are managed
- Subcategories: RS.MA-01 to RS.MA-05
- Relevance: Concerns Attack Analysis, Agility, and Human Factors by managing responses to cybersecurity incidents, categorizing and prioritizing incidents, and applying criteria for incident recovery.
Incident Analysis (RS.AN) - Investigation is conducted to ensure effective response and support forensics and recovery activities
- Subcategories: RS.AN-03, RS.AN-06 to RS.AN-08
- Relevance: Aligns with Attack Analysis by performing analysis to determine the root cause of an incident and preserving incident data integrity.
Incident Response Reporting and Communication (RS.CO) - Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies
- Subcategories: RS.CO-02 to RS.CO-03
- Relevance: Tied to Human Factors and Common Language by notifying stakeholders of incidents and sharing information with internal and external stakeholders.
Incident Mitigation (RS.MI) - Activities are performed to prevent expansion of an event and mitigate its effects
- Subcategories: RS.MI-01 to RS.MI-02
- Relevance: Linked to Agility and Attack Analysis by containing and eradicating incidents.
RECOVER (RC)
Incident Recovery Plan Execution (RC.RP) - Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents
- Subcategories: RC.RP-01 to RC.RP-06
- Relevance: Related to Risk, Agility, and Core Principles by executing recovery plans, prioritizing recovery actions, and confirming the restoration of normal operations.
Incident Recovery Communication (RC.CO) - Restoration activities are coordinated with internal and external parties
- Subcategories: RC.CO-04
- Relevance: Pertains to Human Factors and Common Language by communicating recovery activities and progress to internal and external stakeholders.