2019 Update on frameworks, standards, and regulations for infosec

At the 2019 BSides Tampa Security conference I did a talk on 2019 Updates on frameworks, standards, and regulations for infosec.  Over the last year several new and updated frameworks and regulations have come out, as well as are being updated.

Most of the information can be found on the Internet, but if you're not making an effort to stay up to date, you can miss something.  So here I give links to much of the information I gave.

NIST is the National Institute of Standards and Technology, a non-regulatory part of the Department of Commerce.  They are doing a lot of things that impact us in infosec.  Most are hopefully familiar with the Special Publication 800 and 1800 series that are put out on a regular basis.  Several are being developed, updated, and in a few cases retired. Go HERE to access all of them.

The NIST Cybersecurity Framework (CSF) was updated to version 1.1 last year, and they later had a cyber risk conference in October.  It just had its 5th anniversary, too. For full info on the CSF, and any updates and the like, go HERE.  One element I am looking forward to is an update to informative references that will add additional references (such as crosswalks to PCI-DSS, Standards of Good Controls, etc).  Hopefully we'll start seeing these coming out.

NIST Privacy Framework.  NIST has embarked on creating a privacy framework like they've done for cybersecurity.  This work has just begun, and they are working on a preliminary framework which we should see soon.  I would hope there will be further workshops and feedback before the final version is out.  To see where they are, go HERE.

FISMA is the Federal Information Security Management Act. Basically sets down security standards for federal information systems.  NIST has developed the materials for this, the Risk Management Framework (SP 800 37), the controls set (SP 800-53) and other materials.  They are working on updating this, having just come out with the latest version of the RMF.  The control set is next, with others to follow.  Go HERE for their page on this work.  The schedule is HERE.

Baldridge Cybersecurity Excellence Builder is a combination of NIST's Baldridge Excellence work crossed with their CSF.  It was rolled out in 2017, and should get an update this Spring.  You can download it for free HERE, and there is info on how others have used it successfully.

NIST OSCAL is an interesting project that attempts to create a common set of control assessment language.  This is a project I want to spend more time looking into myself.  More info on their website HERE.

Hopefully most have heard of the "Critical Controls" or the "Critical Security Controls".  Maybe you've heard it referred to as the "Top 20" or the "SANS20" or the like.  While it was started by SANS, they no longer manage it.  For the last few years its been handled by the Center for Internet Security, which has rolled out v6 and in early 2018 they rolled out v7.  They have reorganized it into 3 groups: Basic, Foundational, Organizational.  They have been putting out other resources for it, including the CSAT, a self assessment tool.  They are working on a v7.1 and I expect more resources coming from CIS.  So keep your eye out for them, as they just rolled out a companion guide for cloud (go HERE) and is working on another for IoT.

ISO/IEC 27000 is the international standard set for information security.  This series is made up of about 50-60 documents in various states of work.  Sadly, the documents are not free, and the cost is over $100 for each.  Key documents is usually 27001 and 27002.  1 sets down the ISMS (Information Security Management System) and 2 is the control set (compare with SP800-53).  As several of the documents are being worked on, its hard to keep up.  ISO/IEC 27005 got updated.  My go-to site to keep up to date on this is iso27002security.com.

Privacy regs  (GDPR & California).  Privacy is getting more and more important.  While we work in security, we often get pulled into privacy work as well.  GDPR (General Data Protection Regulation) of the EU was rolled out last year.  And we've already seen some big companies get in trouble.  While I see a lot of groups pushing GDPR training and the like, as a consultant I'm not seeing a lot of clients asking for help.  Yet.  California is rolling out their regulation, which isn't in effect yet.  We'll see if other states will roll out or update their privacy regulations.

One I left out of my presentation is 23 NYCRR 500, which is the New York Department of Financial Services (NY DFS) regulations on cybersecurity.  Rolled out a couple of years ago, the various elements of the regulation has been slowly rolled out with the last one required this March.  This regulation expects companies do certain things to protect NPI (non-public information), such as have a security program, policies, doing pentesting and vulnerability scanning, have a CISO, do training, have an incident response plan, vendor management plan, etc.  This may be a model for other state.  You can read it all HERE.

Now, there are some other items that aren't pure infosec/cybersecurity, but do touch on it, so should be mentioned.

CMMI- The Capability Maturity Model Integrated, originally for assessing the maturity of software development, it was later expanded to others.  Later merged into the CMMI, with Development, Service, and Acquisition versions.  The Software Engineering Institute at CMU developed it, and it used to be available for free or via books.  But they moved the CMMI to the CMMI Institute, which was recently bought by ISACA.  They've rolled out CMMI v2, but its available as a SaaS product, and no longer free.  The CMMI Institute has also rolled out a Cybermaturity Platform, again as a SaaS product.  I'd like to learn more about it, but hard to do.

COBIT, which is ISACA framework for governance of enterprise IT has been updated to COBIT 2019.  They've rolled out the new books, and hopefully other materials will be updated to COBIT 2019.

ITIL is a framework for IT Service Management, which includes infosec.  The current version is ITIL v3 (updated in 2011).  It's being updated to a new version, ITIL 4.  So far only the foundation certification info have been updated.  Hopefully they will update the 5 main books this year.

PCI-DSS is the standard for assessing credit card processing systems.  Current version is 3.2.1, which was updated due to issues with SSL.  Well, the next version, v4, is going to be coming out, but not for another year or so.  It will be a very different version, but info on this is hard to find.  Am sure as we move further along we'll learn more.

Hopefully this is useful for others.  As I learn of new updates, I'll make further postings.

Security Maturity Models (Part 1 of 2)

At the 2018 BSides Miami conference I spoke on the topic of "Security Maturity Models".  In part, due to technical problems with the presentation, am presenting a lot of what I spoke on there.  This is a topic I continue to research and gather information on, so I may do an updated presentation at a future conference or possibly write an article for a journal.  Due to the amount of information, I'll be doing this as 2 postings.

What IS "maturity"?  We aren't talking about individuals (tho that's important), but about organizations.  From Wikipedia: "Maturity is a measurement of the ability of an organization for continuous improvement in a particular discipline."  Thus the higher the maturity, the higher will be the chances that incidents or errors will lead to improvements either in the quality or in the use of the resources of the discipline as implemented by the organization.  An 'immature' organization is often times in 'firefighter mode', they are a re-active organization.  Because they don't do things in a consistent manner, there is no "process", they often times cause many of the problems they later have to fix.  For instance, if an IT organization is building systems such that each is unique, this will make it harder for them to maintain those systems vs if they built systems in a consistent manner.

A mature organization would instead follow a process to build systems that enable them to be maintained.  A mature organization would be proactive.

We can see these principles in security when we build a information security management system or program.  Some security organizations are immature, being reactive.  Others are mature, being proactive.  And hopefully organizations are trying to work toward maturity.  If they understand this.

Many have created a variety of maturity models, in security and elsewhere.  Which is part of the problem.  Some models are focused on particular areas, such as security awareness or secure coding or endpoint protection.  Others are fairly high-level, others more detailed.  Many models are based on a widely used model, the Capability Maturity Model, developed by the Software Engineering Institute at Carnegie Mellon.

Let's start with this one from Blue Lava.  A fairly high level level model, ranging from reactive to proactive.  Immature/reactive organization are in the "blocking & tackling" level.  I think many can relate to that.  I did like how they have the next 2 levels.  Too often some will focus on compliance when the right target is to create a risk-based security program.  Compliance is NOT security.  Compliance should instead be seen as a measurement of security, an outcome of being risk-based, not the goal.

Moving on to another one, a little more complex.  Still 3 levels of organizations.  But here we assess orgs against 4 categories.  3 should be familiar: people, process, and technology.  People is who, both leadership and team members.  Process is how, how do we do what we do.  Technology is the means of doing those things.  I find the last (or is it first) category interesting: philosophy.  The why?  

A more complex model, here going with 5 levels of organization, which is something to be familiar with.  It builds off the 5 level Capability Maturity Model I mentioned.  We'll spend more time at the start of part 2 going into it.  But the names are pretty common to the CMM.  This one looks at the 3 categories of People, Process, and Technology.

And now we get an even more complex model, again using the 5-level maturity levels of the CMM.  But a difference here is the security aspect goes from basic to advanced.

Here is a high-level diagram of the CMMI, the Capability Maturity Model Integrated, which replaced the CMM.  It changed some of the level names.  I should point out that the 5th level is OptimizING. To often those who used the CMM as a basis overlook this and call it Optimized.  But that's wrong.  Its optimizing, as process improvement is ongoing, never stopping.

Now, some further overview of the CMM.  There is more to this model, as in levels 2 thru 5, there are various Key Process Areas that need to be met to be considered at that level.  Organizations usually start at level 1, then by completing these KPA they can move up the levels.  Some may never get past 3 or 4.  I was part of an IT organization that was formally access at Level 3.

So hopefully this has peaked some interest.  In the next part, I'll go into more depth on several maturity models in use:  CMM/CMMI, The Cybermaturity Platform, maturity models built into things like the NIST CSF and FFIEC CAT, and others.

DevOps- a preliminary look

This is a posting I've been working a bit on for sometime.  I decided to at least get this out, as its a topic I will probably be visiting more in the future.

As a long time IT professional, I've had to deal with process and procedures.  These are needed to manage the systems we are responsible for and deliver the services we should be.  Even as security professionals, we need to understand that our job is to secure these systems to help ensure that the delivery of them is not interrupted.  And often times this means doing so in a consistent matter, which happens when we follow procedures.