In February NIST released version 2.0 of its Cybersecurity Framework, the first major update since 2014. It is one of the most widely used frameworks in the world, so it is worth a look.<\/p>\n
The biggest change is a new function. The five well known functions, Identify, Protect, Detect, Respond and Recover, now have a sixth one in the middle: Govern. More on that in my next post.<\/p>\n
On the technical side, a few things stand out. The framework is no longer aimed only at critical infrastructure. It is written for organisations of every size and sector, with quick start guides for smaller ones. Supply chain risk management has been expanded considerably, which fits this year well. The categories have been restructured, with more focus on identity, platform security and the resilience of technology infrastructure. And there are many more implementation examples, which makes it easier to go from \u2018what\u2019 to \u2018how\u2019.<\/p>\n
How do you use it technically? Map your existing controls to the framework\u00b4s categories and see where the gaps are. Use the profiles to describe where you are today and where you want to be. Combine it with MITRE ATT&CK, so you know which attacks your controls actually stop.<\/p>\n
The framework doesn\u00b4t tell you which product to buy. It tells you which questions you need answers to.<\/p>\n
A good framework is a checklist for your thinking, not a replacement for it.<\/p>\n","protected":false},"excerpt":{"rendered":"
In February NIST released version 2.0 of its Cybersecurity Framework, the first major update since 2014. It is one of the most widely used frameworks in the world, so it is worth a look. The biggest change is a new function. The five well known functions, Identify, Protect, Detect, Respond and Recover, now have a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,13],"tags":[146,145,26],"class_list":["post-1425","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-technology","tag-frameworks","tag-nist-csf","tag-security-architecture"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1425","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1425"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1425\/revisions"}],"predecessor-version":[{"id":1454,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1425\/revisions\/1454"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1425"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1425"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1425"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}