Throughout your career as a cybersecurity specialist, you're going to come in contact with a lot of
different regulations and compliance reports, even contractual obligations that you need to be aware
of.
In this episode, we're going to discuss the different frameworks that you need to be aware of and specifically
for Cisa, the depth of which you need to be aware of these different frameworks, the different industry
frameworks that you need to be familiar with are listed here on this slide.
What you need to remember about those different industry frameworks is how they come into play.
With your job or your role as a cybersecurity analyst.
You don't need to go into such depth with these different security frameworks to where you know them,
inside and out.
However, your job as you're moving forward as an analyst may require you to go into more depth than
what you're going to see here in our presentation today for Cisa, what you really need to understand
is the different aspects of each different framework and how they are different from one another.
As opposed to the same as one another.
Within the different frameworks that we're providing you today, it's important to note that you don't
have to know each and every one as a detailed level.
The exam isn't specifically over one framework framework over another.
It's more or less a ideology that you need to be familiar with and a high level overview.
Meaning you may get a question on what type of framework is more for an international standard organization
versus one that is specifically for the United States?
You may also get different questions on related to the availability of the data specific to a specific
framework.
We'll go into each one of these frameworks moving forward to kind of give you a clue, and then we'll
wrap out at the end of the episode to identify what kind of questions you might see.
The first framework I want to talk about that isn't actually in Cisa is the NIST Cybersecurity Framework.
This framework is all about understanding the specific standards and technologies specific to cybersecurity
in the United States.
Now, this framework is specific to Security Plus, but it's not technically in the CSA objectives.
So why do we bring this up for you to understand?
Well, it's quite simple.
If it's in Security+, you probably need to know it because it's probably going to be added in later
revisions for CSA.
With that said, you have to remember that the NIST Cybersecurity Framework is all about United States
standards and how that technology is used in cybersecurity.
This framework is all about understanding those specific industry technology requirements, i.e., what
does a firewall do and how does that firewall is supposed to be properly configured in order to maintain
the best reliability within your network?
NIST is all about understanding specific fundamentals of what the technology should do, and it's more
technology eccentric rather than policy or procedure basics.
It doesn't mean that it doesn't have policies or procedures really in there.
It does, but not at an in-depth level.
It's really more about the technology and how that technology should be utilized within each individual
network.
The payment card industry, data security Standard, or PCI, DSS is specific to cardholders.
If you get exam questions specific to cardholder data or financial information related back to a security
standard, you have to remember that PCI, DSS is most likely what they're referring to.
This standard is all about protecting cardholder data and to maintain secure payment systems throughout
not only the technology process, but also the procedures tasked with individuals.
The PCI DSS framework is designed specifically for payment card industry.
But it's not a regulation.
It's not a government entity that's coming in and enforcing this contractual obligation.
This is where the industry really took hold and said, we need to come up with our own standards so
that the federal government doesn't come in and mess everything up.
That's exactly what the PCI DSS is all about.
It's a contractual obligation between the users of those credit cards and how those credit card information
is processed versus the actual cardholder.
Uh, security systems at the higher end.
It enables such things as saying, hey, you need to have encryption.
When you're sending payment card information over the wire, you need to store your information in this
form or fashion.
You'll see that I'm not really identifying specifics within the payment card industry, but more of
a high level overview.
And those are the types of questions that you should expect to see when it comes to PCI.
DSS in relation to your Cisa exam.
This payment Card industry data security standard is all about understanding the risk and the liability
to the card holders and the processes that are in place, i.e. the financial institution, and to minimize
that liability and risk as much as possible.
If you see exam questions like this security standard is how you would facilitate encryption over credit
card or over the transmission of cardholder data.
That's usually going to be PCI, DSS when it comes to those exam questions.
The Center of Internet Security CIS benchmarks was originally the Sans top 20.
They over the years have migrated over to this new form of functionality, which we specifically talk
about today.
Again, you don't need to know the specifics of the CIS benchmarks, but you do need to understand what
they're there for.
The actions are designed to help enhance your overall security posture within the organization.
We're going to discuss both of those right now.
And I'm going to kind of show you what we're talking about.
Let's talk about the NIST cybersecurity framework.
And I'm going to show you what that website looks like right now.
This is the nist.gov Cyber Framework website, which you can access via the link that we provide you
in the resources page.
You can see here on the website that we've got different resources available to us and that we're currently
in the Cybersecurity Framework 2.0.
You can read the document just by hitting this little tab right here.
You can set up different templates or profiles associated with how you would utilize this framework
within your own organization.
You can see a different quick Start guides specific here.
And of course there's the mapping which really provides you a resource to identify.
I've got this issue and I want to map it to this policy or procedure that NIST has put out.
If I click on the read document, you can see here that it's going to have a little pop up menu.
I'm just going to press okay.
On understanding that I understand my rights and privileges.
And it pulls up the document.
Now this document is fantastic for providing you a basic, abstract and understanding of what this information
covers.
Again, the table of contents come into play and you can see that this is a very hefty document and
recently updated as of February 26th, 2024.
You can scroll down and utilize different accesses for this document.
For instance, let's say I wanted to improve my risk management communication.
It talks about how you can improve those risk management communications within your own organization,
and provide some handy dandy guides that come along with it.
Again, this is really overall a good foundational level for the cybersecurity frameworks that you might
utilize.
And if you scroll down a little bit more, you can start to see where it comes into play with privacy
risk versus cybersecurity risk.
And it really does provide that cohesive knowledge base that you may see in the United States.
Now, I did talk about a little bit of how NIST comes into play with understanding the technical terms
within the framework.
You can see here that if I scroll all the way down, if you scroll down to appendix B, you can see
here that we have different tiers associated with risk governance.
This document provides us the different risk governance associated with it and how to utilize that risk
governance in our own different organization.
Again, you can see tier one, tier two, tier three, and it goes down all the way to tier four, which
we see adaptable, meaning that your organization is adaptive to what's going on.
This specific document is only 27 pages long, so it provides a good understanding of their overall
framework of how to utilize the cybersecurity framework.
But it's not going to go into so much detail that it overrides your process or your thinking.
Again, it's a good resource to have.
We're going to take a look at the CIS benchmarks and how that web page looks as well, so that you can
get a good handle on what it encompasses.
When you first log into the CIS or the Center of Internet Security website, you'll have to log in with
your email and provide that information to sign up for the website.
Once you've signed up, you should see a web page that looks something similar to.
Here.
You can see that it provides the different benchmarks that need to be associated with the different
technology that may use, for instance, operating systems.
You can see here that it's distribution for independent Linux.
We can scroll down and you see that it's got Windows 10, Windows 11 and the different editions.
You can even see that it provides those Microsoft Windows 7 workstation benchmarks from way, way long
ago.
If you continue to scroll down, you can see Debian followed by ubuntu.
We can also see Amazon CentOS, and you can see the full gambit of different operating systems that
are out there and available today, where CIS has come in and said, this is how we're going to secure
these different operating systems through the different benchmarks available.
There's just a ton of them available here, including VMware, MongoDB.
There's also Apache Tomcat.
I mean, it's just an incredible amount of information available at your fingertips, each associated
to a different operating system or provider associated with the different technology you may utilize.
While it doesn't have 100% of every technology available, you can see that it covers even some of the
more minute details, like snowflake.
It even provides mobile devices such as Apple and Google Android.
And further it goes down to Jupiter.
We see Google Chrome.
I mean, there's just a phenomenal amount of them out here.
We're going to click on the distribution for independent Linux here and download the PDF.
This is the cis benchmark for the distribution of independent Linux systems.
Version 2.00.
You can see here that it was updated in 716 of 2019.
And it provides a quick terms use.
I can go through this and identify the different aspects of this system that I want to know more about.
For instance, if I wanted to know more about mounting of Cramfs file systems and is disabled, it's
on page 21.
If I want to go through and ensure that the separate partition exists for VAR and log scored, I can
go 53.
Let's scroll down to one and just at random to try to see what it looks like.
So this one right here is literally ensuring that your node v option is set to tmp partition.
And it's scored.
We can see here that it's considered a profile applicability for server and workstation level one.
And it's on the node V mount.
If I scroll down to the bottom you can see that we can verify the node v option is set if the tmp partition
exists by providing a mount with grep e and then it gives me the entire command.
The best part is I can literally grab all of that, copy it, and then put it into my Linux system if
I wanted to to run that command.
It provides us a great foundation for understanding the different, uh, positions and how to secure
our operating systems, and it provides the commands in order to make it happen.
So this has gone through a lot of detail to provide this information to you as a user.
But as far as Sisa is concerned, while you don't necessarily need to know each individual command or
even understand the overall complexities of how to do it, you do need to know where the references
are and how to utilize them.
That's really where the Sisa comes into play.
It's that high level overview of understanding.
If I want to understand on an independent workstation, where would I get those specific commands from?
The answer would obviously be the CIS benchmarks for an independent Linux system.
Now, again, it provides us a load of different manuals to go through.
You don't need to memorize all those.
Just realize that that's where the CIS benchmarks really come into play.
The other resource that I really want to show you is a guide for defining reasonable cybersecurity.
This was again put out by CIS.
And let's take a look at that right now.
So in the reference material in the resources below, we've provided you this guide that you can download
to your own machine.
This guide is a simple PDF and it provides us a guide for defining reasonable cybersecurity.
Again, it provides us a basic acknowledgements page, and then it provides us the executive summary,
which basically says there's no minimum standard available across the United States.
We don't have any laws or regulations that dictate across our industry exactly how we have to go through
the different processes and procedures to secure our systems.
There's no set standard.
If IBM wants to do their way and Microsoft wants to do it their way, there's nothing in there as far
as the law is concerned, and forcing those companies to meet those minimum standards available, that's
where the reasonable cybersecurity guide really comes into play.
It is.
The latest edition was put out in May 1st of 2024.
So it's somewhat recent and provides us a lot of great information.
If you scroll down, you can see here that we have a timeline of federal security laws.
So it gives us a little bit of a foundation of where we came from, what the laws are available, and
how they intersect with cybersecurity.
But if we skip down to the very bottom.
On page 14, we can see how an organization should properly implement cyber safeguards to achieve reasonable
cyber security.
In section five, we can see how an organization should properly implement cybersecurity safeguards
to achieve reasonable cyber security.
This guide doesn't go into the specifics on exactly what needs to happen, but it does provide us an
high level overview of your different environments.
For instance, it says you should know your environment.
We need to account and configuration management.
We need security tools, data recovery, security awareness and of course business processes and outsourcing.
And it provides some great guides and high level knowledge of what they constitute as a reasonable safeguard
within the system.
It provides us a blanket statement over what they consider to be security awareness, and all of that
should be utilized within your organization.
Again, it's not providing any specific details, but it is providing us a great overview of what you
should be doing from a specific procedure or process point of view.
If we scroll down even more, you can see the data privacy statutes available on a state by state basis.
And again, if I keep scrolling down, it goes into more and more detail as we go through.
Finally, on appendix H, you can see implementing all 153 safeguards for the CIS critical security
controls.
And it provides, again what you should be taking.
But it doesn't exactly tell you how to take those actions.
For instance, number two says we need to actively manage our inventory, track and correct all software,
operating systems and applications on networks so that only authorized software is installed and can
execute, and that unauthorized and unmanaged software is found and prevented from installation or execution.
It just tells us to do it.
It doesn't tell us how to do it.
And that's really where the blunt of the information comes in from a high level for the CIS exam, you
really just need to understand that this document exists and that it provides us a reasonable guide
for cybersecurity.
That guide is very high level and provides us a list of things that we should do within our own organizations
to better protect and safeguard not only our data, but consumer data that may be residing on our systems.
The ISO, or International Organization of Standardization produced the 27,000 series specific to cybersecurity.
The 27,000 really lists the overall objectives or vocabulary specific to cybersecurity, and it really
doesn't go into finite decisions that need to be made, but it provides an overall arch of the different,
different episodes or different guides available to it.
For instance, ISO 27,001 goes over information security management systems and their requirements as
seen by ISO.
It's a standardization that they say, hey, we need to do this in order to meet the guidelines or requirements
set forth by ISO 27,000 series.
Now, each one of these little different guides specific to a specific industry requirement.
Meaning while it all has to do with cybersecurity or security in general, the different guides associated
with it come at different concepts associated with that security, for instance, to 27,005 goes over
security risk management, and 27,006 goes over requirements for bodies proving audit and certification.
While this guide or while this organization standardization can be certified, you can go through the
actual, um, checks and balances and audits to be ISO certified for 27,000.
It's not necessarily a requirement based on every organization that you work at.
A lot of organizations in the United States, they go more towards the side of the House, but not all
of them.
Some organizations use one or the other, and some organizations use both, because NIST is more on
the technical perspective and ISO is more on the process and procedures perspective.
What you need to know about this, as far as CSA is concerned, is that a lot of questions that you're
going to see come in, the fact of which standards organization is international or which one is worldwide?
They really ask those questions providing the different numbers or nomenclatures associated with it.
With ISO, you should expect to see questions like which of these ISO standards deals with specific
to information security management?
That's 27,001.
You don't really need to know every last one of these different episodes or guides or remediations when
it comes to play, but I would have an idea of that.
27,001 is the most popular, followed by 27,005, which is risk management.
The other ones you just need to realize are there and you should be okay for the exam.
For the most part, I wouldn't expect to see questions that relate directly to what the guides hold,
but more of a high level overview of knowing where to find the information if you need it to address
the guide.
For instance, you may be asked a question on which guide within the 27,000 series specifically deals
with risk management.
You would might need to know that that is ISO 27,005.
Let's take a look at the 27,000 series and what it looks like on the web page.
Now, if you go straight to the ISO standards and look at IEC 27,000 family, you can scroll down and
actually get the email for updates.
You don't necessarily need to subscribe to it, but just be aware that you can.
Underneath you can see the different highlights of associated with the 27,000, and you can see the
different dates associated with each manual.
For instance, the Information Technology 27,000 series.
The overall 27000 manual was produced in 2018.
That is the latest copy you can see.
The 27,001 was updated in 2022.
Same with 2002.
Now unfortunately these are blocked behind a paywall.
However, if your organization or your infrastructure deals specifically with ISO as one of their components,
these would be unlocked for you and you would have full access to each one of these manuals.
Again, Cisa doesn't expect you to know exactly what's in each one.
Just know where to find the information if you're asked a question about it.
If we open up the 27,001 right here, you can see on this document that it provides us a basic understanding
of what 27,000 1000 includes.
We can see on the right hand side.
It provides us a scope, the references and the specific information of what's going to be covered within
each one of the documents.
If I scroll down, it provides me the purpose of the document, the contents, the scope access.
And we can see here that some of the information is notably missing based on the fact that it's behind
a paywall.
If I scroll all the way down, we can see information security, incident management, and it says to
direct yourself to a 3.54 for detecting, reporting, assessing, responding, dealing with and learning
from information security incidents.
If I scroll down some more, we can see that the just provides us a different list of the different
confines associated with the 27,000 series.
It's literally just telling you where to find the information.
If you're looking specifically for something in the 27,000 manual.
Next, I want to talk about the OWASp top ten or the Open Worldwide Application Security Project Top
ten when it comes to web application vulnerabilities, this website provides us some good information
when it concerns specific to web application security.
Let's take a look at their website right now and see what it has to tell us.
Here you can see the OWASp top ten project associated with web application vulnerabilities.
This is a standardized awareness document for developers and web application security, and it was recently
updated in 2021.
They update this website about every 3 to 4 years, depending on what's going on within the industry.
You can see here that they provided us the 2017 and transposed it over into 2021.
While some of this has changed, most of it has not.
We're only seeing three new designs or vulnerabilities associated with their newest version.
For instance, in, uh, a04, we can see insecure design, that insecure design is new compared to
2017.
You don't need to know as far as Cisa is concerned.
The 2017 vulnerabilities.
You only need to know the 2021 vulnerabilities, but it would be a good idea to understand and appreciate
each one of the different vulnerabilities they've associated with this.
And that's why I provided that cross reference.
In order for you to to cross reference what you're trying to look at, for instance, broken access
control, this one provides us that 94% of applications were tested for some form of broken access control.
You don't necessarily need to know that 94% of applications were tested.
You just need to know that.
What broken access control is part of the OWASp top ten, you can expect to see questions related to
which one of these security vulnerabilities is associated with which OWASp top ten.
It's not uncommon to see different questions associated with Cisa, which through back to the different
vulnerabilities listed in the OWASp top ten, you might see a question like which one of these relate
back to an OWASp top ten vulnerability?
And it might be insecure design where it relates this type of design.
Or this scenario proceeds back into this OWASp top ten, you might see a question that relates back
to the security design or security vulnerabilities within OWASp top ten.
Something like.
Which one of these security misconfigurations relate back to a top ten vulnerability?
You might see a question like, uh, username and passwords are set for default or, uh, something
else for triggering where we're not using a Captcha or something like that might relate back to a security
misconfiguration.
Obviously a Captcha is not a security misconfiguration, but default username and password is.
This is where you might see different questions related specifically to top ten and OWASp.
Be aware that you need to memorize each one of these top tens when it comes into play, and specifically
to the 2021 version, not the 2017 version.
If you can identify that, you should be go for most of the exam.
Within this episode, we talked about the frameworks that you need to be familiar with.
As you approach the Cisa exam within your own careers, you should be associated and known for each
one of these different frameworks and how they're introduced within your separate organizations.
For instance, if you're looking for a career, say, in the payment card industry, it would be expected
that, you know more than just the high level overview of the Pci-dss framework.
So on the same version, it's just like working in healthcare.
If you were working in a healthcare environment, even as an IT perspective, you need to know more
about HIPAA than, say, somebody that's working in telecommunications.
As far as Cisa is concerned, it's a very broad overview of each one of the different standardizations
that would come into play for regulatory compliance, meaning you only really need to know that Pci-dss
has to deal with financial institutions and payment card industry, and that data should be encrypted
from point A to point C.
That's really where we're going with this.
You don't need to dive into each one of the individual frameworks because the exam isn't decided upon
an individual framework.
It's a high level overview.
Do not go into each one of these frameworks into a deep level, trying to figure out what each framework
really encompasses.
It's not going to be on the exam.
You really just have to have a high level overview of what it includes and a memorization of the OWASp
top ten, and you should be good for most of the exam questions that come into play.