Now I don't know about you.
But if you've been watching these episodes in order you probably be in a little bit of a panic right
now.
We've got all of this I-T governance and risk management and security controls and processes and policies
and holy smoke.
There is a lot to this.
So if you were to walk into an organization that suddenly said Help us help us we have no security.
Just the organizational process is a massive massive job.
So how do you as an I.T. security professional just start the process of making all this happen.
Well that is the job of what we call frameworks.
A framework is nothing more than a process idea almost like project management almost like a list of
the big things you got to do as an I.T. Security thing that helps you as a professional provide the
type of organization to give good I.T. Security to your infrastructure.
Now a framework is not going to be much more than a bunch of boxes and a lot of overview stuff.
But they are very very important.
There's lots of frameworks out there.
There are regulatory frameworks that certain organizations absolutely must use.
There's a lot of non regulatory were just organizations.
So this is a really good way to do it.
And some people abide by those.
We have national standards.
We have international standards that define these types of frameworks.
And there's also industry specific frameworks that are usually defined for one particular organization
to give you some examples of these types of frameworks Well I'm an NIST guy so let's start with probably
the most famous of all of these frameworks.
Good ole Espey 837 this massive document is the first go to place for I.T. security professionals who
want to be able to understand how to perform a risk management framework.
Now keep in mind that this is also a national standard and it's also at least in terms of United States
federal organizations.
It's a regulatory one as well.
Now for somebody like me I just like the risk management framework so it's not going to be regulatory
for me very much non regulatory.
But as a private organization these are free public documentations that everybody knows about them.
So we all tend to use them now.
A good example of a non regulatory would be the good ole Ayas ACA I.T. infrastructure.
Now this is published by I as a CA and a lot of people follow these guys as well.
In the international world Google ISO 27000 definitely defines a risk management framework that people
all over the world can use.
Now if you want to terrify yourself Jim just putting all kinds of fear in your life today aren't what
you need to do is go into Google and I want you to type in risk management framework.
Hit enter and then don't look at the Web results.
Look at the image results.
There are gazillions of these management frameworks and they're all absolutely fine.
Different types of people might use different ones but for me because I'm an NIST guy what I'd like
to do is take a minute and let's go through the NIST risk management framework.
So what you're looking at right here folks are the six steps of NIST.
Risk management framework.
So what I want to do at this point is just do a quick run through on each one of these so you can get
an idea of the big steps that we use when it comes to organizing the security for our infrastructure.
So number one that's a big one and that is categorize your information systems.
Now what we're talking about big categorizing them is that we really need to have an understanding not
only I'm not saying to just count routers I mean you definitely do that at this part in counting the
number of Windows systems you have.
But more importantly you have to really categorize your workflows and your processes and your vendors
and all of your different organizational inputs and outputs.
And this is a big job and one of the most important first steps you can do when it comes to getting
everything organized using this particular risk management framework.
So you end up generating this huge list of different types of assets and workflows and processes.
So the second thing you're going to have to do then is you're going to have to select security controls.
Now we've already covered security controls in other episodes so I don't need to develop that again.
But at this point you need to start looking at all of the different things that are taking place and
based on regulations and laws and standards and best practices and common sense you start to say well
I want to do this.
We're going to use big passwords.
We're going to set everything to WPA two shared key with a minimum of 30 character password whatever
it might be.
You begin to select all of these different controls.
Now interestingly enough though let's take a look at the third step and that is implement security controls
that you would think well if you're selecting them aren't you implementing them.
Not at all the process between somebody sitting at a desk going oh these are good ideas versus the screwdriver
guys who actually have to start implementing all of these different types of controls can be a really
big step.
And as we start implementing different types of controls all said we'd run into little problems here
and there but we need to appreciate that that is a big step and very important that we keep that separated
from simply selecting the controls.
Now fourth is assess the security controls.
Now this has always been a bit of a weird one to me because if I'm applying to security control I'm
going to be watching what it does but that's not what they're talking about here.
What they're talking about is before we really put all this online whatever it might be let's verify
that everything works the way that we want it to do our best due diligence that we can to make sure
that if we require everybody to have a new password every 30 days that we understand that that's going
to have some pretty big implementation issues and a lot of problems with the administration as well
as people forget their password.
So that's where Step 4 is all about as we're assessing what that process is going to be in a lot of
times in this particular case.
This is all done through what we call a sandbox a separate little network where we're testing stuff
to see how it all works.
So Step Five is the big one.
Step Five is authorizing the controls so we've got all this set up.
Everything is ready to rock and roll.
We've know how to do it.
We've got the procedures down.
We've assessed it.
We feel that it works pretty good at some point there has to be some big boss up there who goes all
right let's do this.
I'm willing to accept the risk and behalf of the company or organization or whatever it might be.
Let's let's go ahead and authorize them authorization becomes very important in specially if something
goes wrong and we need to point a finger at somebody that's not necessarily to fire people but at least
you know lessons learned type scenarios.
Understanding who makes the authorization can often be an important point in that framework.
The next one is monitor and that's where OK everything's up and running and cooking.
Let's watch the control.
Let's stay on top of this control see what it's doing is it doing the job we wanted to is it restricting
people too much.
Is it mitigating or eliminating the risk whatever it's designed to be implemented for and let's make
a judgment on it.
So then what really happens as it's been monitored.
We really kind of repeat this whole process.
So we come right back to categorization.
Now in this case we're not having to reinvent Toria everything.
But what we're more doing now is as a result of the monitoring we begin to understand things like for
example hey the way these guys set up this enterprise level radious server really worked well.
So maybe we can go ahead and categorize all of our wireless networks and put them all into radious servers.
So literally what happens here is as we take a look at all six of these steps it becomes a big loop
and we just keep doing this and doing this and doing this.
And the most important thing is as you get to do it forever and thats why they call it a job.
So good luck to you.
I.T. security professional.