This month we go over 5 popular risk management frameworks and the importance of security controls to mitigate future risks and increase security. Read more below:
Risk Management Frameworks
There are many risk management frameworks out there, but here is a brief summary of 5 of the most popular:
NIST Cybersecurity Framework (CSF)
Developed by the American National Institute of Standards and Technology, it provides a set of guidelines and best practices for managing and reducing cybersecurity risk. It was developed in response to Executive Order 13636, issued by President Obama in 2013, which called for the development of a voluntary framework for improving critical infrastructure.
It is structured around 5 core functions: Identify, Protect, Detect, Respond, and Recover. Each of these includes a set of categories and subcategories that organisations can use to evaluate and improve their cybersecurity posture. CSF is designed to be flexible and adaptable to different organisations across different industries and all sizes, including energy, finance or healthcare.
ISO/IEC 27001
An international standard that aids in establishing, implementing, maintaining, and continually improving an information security management system (ISMS). The standard was developed by the ‘International Organization for Standardization’ (ISO) and the International Electrotechnical Commission (IEC) to help organisations protect their information assets from a variety of risks, including cyber-attacks, data breaches and other security threats.
It outlines a risk management approach, requiring organisations to identify and assess the risks to their information assets and to implement security controls to manage these risks. It requires organisations to regularly review and evaluate their security measure effectiveness and continual improvement of their security posture over time.
Operationally Critical Threat, Asset and Vulnerability Evaluation (OCTAVE)
Developed by the Software Engineering Institute (SEI) at Carnegie Mellon University, it is widely used in both the public and private sectors. OCTAVE takes a holistic approach, taking into consideration the technical vulnerabilities, but also business processes, organisational structures, and other non-technical factors.
It is designed to be flexible and adaptable to a variety of organisational contexts and can be customised to meet the specific needs of an organisation. It is particularly well-suited for organisations that have complex, interconnected systems and processes, such as those found in the financial or healthcare sectors.
Control Objectives for Information and Related Technology (COBIT)
A widely recognised framework for IT governance, it was initially developed by the Information Systems Audit and Control Association (ISACA) in 1996 to provide a common language and framework. It is designed to help organisations of all sizes and industries to manage their IT activities. It is structured around five main focus areas: Governance and Management of Enterprise IT, Information Security Management, Risk Management, IT Operations Management, and IT-related Business Continuity Management.
Each of these domains is divided into processes and control objectives, designed to achieve specific IT-related goals and objectives. It is frequently used in conjunction with other IT governance frameworks such as ITIL or ISO 27001. Together, these can provide organisations a comprehensive set of tools and practices.
Information Technology Infrastructure Library (ITIL)
A set of best practices for managing IT services. It provides a framework for delivering high-quality IT services while minimising risks and reducing costs. Originally developed by the UK government in the 1980s as a set of guidelines, it has since evolved into a comprehensive set of practices that are used by organisations worldwide.
The framework is organised into five core volumes: Strategy, Design, Transition, Operation, and Continual Service Improvement. Many organisations use it as a basis as it provides a common language and can help organisations improve their IT service delivery.
Summary
Embracing a risk management framework can assist businesses mitigate future risks with minimal impact on growth. It can also offer key benefits such as; reputation management, protection of assets, and the optimisation of data management. An effective framework is more than just a set of standards and rules, it should have the ability to deliver actionable results that make a difference in how your business performs.
Security Controls
In today’s digital world, it is often far too easy to forget about the most basic security function of all, whilst pondering all the new latest, trendy, interesting AI developments etc.
Basic is a little bit of an understatement – it is everywhere and we all do it on a daily basis. Car keys hidden away from sight, front door locked and milk padlocked in a fridge (or is that just me). However, we mustn’t forget that these are all controls that are well used.
Recently, I have been visiting an area that placed a great amount of focus on physical security: what electronic devices I was bringing in, did I have any liquids, did I know the keycode to get in. All great controls to prevent unauthorised or intrusive access, but I was a visitor who should have access anyway. So, the place in question had to let me through. How do you balance protection against user experience and flexibility, to adapt and evolve?
Relating to this, airports are evolving and trialling new controls to make the user experience more enjoyable – no more guzzling 1 litre of water at the security desk instead of throwing it away. Why? To keep the same level of security whilst bringing the nice experience back to travelling.
But physical threats and attacks evolve too.
The reason for implementing liquid volume controls was due to a new attack type. Bollards, flowerpots and well-placed hidden obstructions, are now commonplace in outdoor spaces to protect against attacks using cars or trucks as weapons and drones supplying goods or weapons.
Physical security controls apply to buildings, rooms, and anything else that protects access to precious goods, whether they are physical or electronic jewels from theft or damage. Elements of the Security budget or estates budget should be retained for continual improvement in physical security controls.
But these controls are used by visitors, bypassed by authorised users who are either familiar with the controls, similar ones elsewhere or have back doors that are well known. Fire exits at data centres anyone?
To support the basic security measures, you can…
1. Draw up a list of your security controls. Consider:
- All authorised access points for personnel and visitors.
- Potential unauthorised access points for people and technology (e.g. drones)
- Any exposed IT equipment, e.g. cables leaving the secure physical environment.
2. Look for single points of failure where one bypassed control can mean all controls can be bypassed (e.g. a lost security pass, a friendly security guard).
3. Good controls that can cause potential negative side effects, e.g. slow moving queues at building entry points. Emergency exits being congested.
4. Review the latest trends and industry analysis for the latest developments.
5. Design and implement new controls to improve your security position. Consider:
- Deterrent controls that could put off the opportunistic attacker
- Technical controls to supplement physical controls
- Integrating physical security processes with other HR related controls
6. Review the access logs to see if there are any unusual patterns, such as staff regularly entering out of hours, or accessing on their days off.
7. Identify security contacts, including the police non-emergency line to report incidents.
8. Test your security controls, using unknown and known staff and techniques.
Summary
So, remember to constantly review security of all new developments, by keeping on top of the latest trends. But don’t forget to look after the physical side and protect the basics. Don’t let complacency be your downfall.