Cyber Security is Hard

But, how to make sure everyhting is covered?

Standards and frameworks

Different frameworks guide cyber risk management -each with its own focus and adoption.

NIST CSF 2.0

• Helps organisations manage and reduce cybersecurity risk
• Built around six core functions
• Based on recognised standards and best practice
• Provides a clear method for assessing maturity and improving controls
• Aligns well with ISO/IEC 27001 (next week)

NIST Components

• A - CSF Core
  • Functions → Categories → Subcategories (outcomes)
• B - Profiles
  • Describe Current vs Target cybersecurity posture
  • Support gap analysis
• C - Tiers
  • Characterise maturity of risk governance & management
  • From Tier 1 (Partial) → Tier 4 (Adaptive)

A. NIST CSF 2.0 - The Core

What you need to do.

6 Functions: Govern, Identify, Protect, Detect, Respond, Recover 22 Categories (high-level outcomes) 106 Subcategories (specific outcomes) Each subcategory links to informative references (SP 800-53, ISO, CIS Controls) Delivered as a spreadsheet with rows/columns of outcomes & mappings “Outcome” = security goal (Category = high-level, Subcategory = specific)

1. GOVERN (GV)

Categories (high-level outcomes):

• Organizational Context (GV.OC)
• Risk Management Strategy (GV.RM)
• Roles, Responsibilities, and Authorities (GV.RR)
• Policy (GV.PO)
• Oversight (GV.OV)
• Cybersecurity Supply Chain Risk Management (GV.SC)

Example: Define a supply chain risk policy requiring vendors to comply with ISO/IEC 27001.

2. IDENTIFY (ID)

Categories:

• Asset Management (ID.AM)
• Risk Assessment (ID.RA)
• Improvement (ID.IM)

Example: Maintain an updated inventory of cloud servers and assess them for vulnerabilities quarterly.

3. PROTECT (PR) (CIA)

Categories:

• Identity Management, Authentication, and Access Control, Backup (PR.AA)
• Awareness and Training (PR.AT)
• Data Security (PR.DS)
• Platform Security (PR.PS)
• Technology Infrastructure Resilience (PR.IR)

Example: Enforce multi-factor authentication (MFA) for all staff and provide annual phishing awareness training.

4. DETECT (DE)

Categories:

• Continuous Monitoring (DE.CM)
• Adverse Event Analysis (DE.AE)

Example: Use a SIEM system to detect unusual login attempts and analyse logs for signs of compromise.

5. RESPOND (RS)

(More to this in the last week with incident response)

Categories:

• Incident Management (RS.MA)
• Incident Analysis (RS.AN)
• Incident Response Reporting and Communication (RS.CO)
• Incident Mitigation (RS.MI)

Example: Activate the incident response plan during a ransomware attack, isolate infected systems, and notify stakeholders.

6. RECOVER (RC)

Categories:

• Incident Recovery Plan Execution (RC.RP)
• Incident Recovery Communication (RC.CO), e.g. Backup

Example: Restore critical services from tested backups and update customers with regular recovery progress reports.

NIST: Functions and 22 categories

Activity 1: Classify Controls into CSF Functions

Pick the correct NIST CSF Function for each row.

B. CSF Profiles

• Describe an organisation’s posture against CSF outcomes
• Help assess, prioritise and communicate cybersecurity needs
• Built with context such as mission, stakeholders and threat landscape

Types of Profiles

• Current Profile: What the organisation achieves today
• Target Profile: Desired outcomes for future capability
• Community Profile: Shared baseline for a sector or use case

B. CSF Profiles: In a nutshell

CSF Profile - Lifecycle Steps

Profiles describe what outcomes you achieve.

Scope - Define scope (whole org, business unit, or specific threat) Gather - Collect policies, risk registers, BIA, standards, roles Create - Document Current & Target Profiles Analyse gaps - Compare Current vs Target → action plan Implement & update - Execute plan, update Profile continuously 🔄 Continuous improvement cycle

C. CSF Tiers

Tiers describe how mature your governance and processes are when achieving those outcomes.

Tier 1 - Partial Ad hoc, limited awareness Tier 2 - Risk Informed Some processes, fragmented, not org-wide Tier 3 - Repeatable Formalised policies, consistent and reviewed Tier 4 - Adaptive Continuous improvement, agile, integrated with ERM ➡️ Tiers = levels of maturity in governance & risk practices ➡️ Provide progressive targets for improving cybersecurity posture

Building a CSF Profile with Tiers

Example – CSF Profiles with Tiers

A university IT department manages staff and student data. Backups exist but are not encrypted. Logs are collected but rarely monitored. There is no formal incident response plan.

Applying the CSF Profile and Tiers

Activity: CSF Profiles and Tiers

A small university department has limited budget and no dedicated SOC. Backups are done monthly, logs are collected but not reviewed, and there is no formal incident response plan. Basic MFA is enabled for staff.

Task: estimate the Current Tier and Target Tier for each CSF Category below.

NIST: Issue

The NIST CSF defines what outcomes an organisation should achieve.

But it does not show:

• Which assets those outcomes apply to
• Who is responsible for each area
• How to spot gaps across devices, applications, networks, data and users

The Cyber Defense Matrix to the rescue.

The Cyber Defense Matrix

The Cyber Defense Matrix expands NIST CSF with a two‑dimensional model: Dimension 1: CSF Functions - Identify, Protect, Detect, Respond, Recover Dimension 2: Asset Classes - Devices, Applications, Networks, Data, Users Creates a 5×5 grid to map security outcomes and capabilities to assets Purpose Clarifies responsibilities Supports gap analysis and resource allocation Improves communication across the organisation

CDM Asset Classes

• Devices - Hardware, firmware, OS, vendor apps, networking gear
• Applications - In-house business apps and services
• Networks - Routing, DNS, PKI, firewalls, VPNs
• Data - At rest, in transit, and in use (databases, files, cloud)
• Users - People and AI agents with IDs, credentials, and permissions

Applications of the Cyber Defense Matrix

• CSF profile status and planning
• Responsibility assignments and handoffs
• Measurement and metrics
• Cybersecurity portfolio gap analysis
• Structural and situational awareness
• Vendor / product classification

CDM used for CSF profile status and planing

• The Cyber Defense Matrix (CDM) can represent Current vs Target Profiles
• Makes it easier to:
  • Prioritise and allocate resources
  • Monitor progress over time
  • Communicate status to management & stakeholders

CDM for Responsibility Assignment & Handoffs

• The CDM is useful for defining who owns which responsibilities
• Clarifies the division of security tasks across departments
• Avoids unrealistic expectation that the security team handles everything

Benefit: Security is embedded across all business units, not siloed in the SOC.

Lab

Please review your activities from here

Book