Nassau County BOCES BUILDING AN INFORMATION SECURITY PROGRAM WITH - - PowerPoint PPT Presentation

Nassau County BOCES

BUILDING AN INFORMATION SECURITY PROGRAM WITH CIS 20 AND NIST CSF

MARCH 13, 2020

Adaptive Security

AGENDA

• Introductions
• Presidio Cyber Security Practice Overview
• Why are we here?
• Common District Cyber Challenges
• Framework Overview
• Critical Security Controls – CIS 20
• NIST Cyber Security Framework
• Relationship of CIS 20 to NIST CSF
• Adoption Plan and Recommendations

PRESIDIO CYBER SECURITY TEAM

Engagement and Operations Management Infrastructure Security Technical Assessment Information Security

Pete Insall,

Managing Consultant, Architecture Practice

CISSP, SABSA Security Architect- Foundation, CCNP, PCNSE

About me: – 7+ years @ Presidio

• Security Architect
• Sr. Security Solutions Architect

– 12+ years as Security Engineer

• Insurance
• Business Process Outsourcing
• High-Tech

– 6 years in the US Navy – Submariner

• Radiation Protection and Nuclear Chemistry

Technician (ELT)

PRESIDIO CYBER SECURITY TEAM

Engagement and Operations Management Infrastructure Security Technical Assessment Information Security

Dustin Harriman,

Managing Consultant, ISG/GRC Practice

CISSP, ISO/IEC 27001 LI, CPT, CEH, CNDA

About me: – 7+ years @ Presidio

• Penetration Testing
• Governance Risk and Compliance

– 8.5 years in Army

• 5.5 years in Artillery
• 3 years IT / Army Red Team

– InfraGuard Member

Adaptive Strategy

• Security Strategy
• Compliance & Gap Analysis

– HIPAA Security Rule – PCI DSS – CMMC / NIST 800-171 – SSAE 18 SOC II

• Policy and Standards Dev
• GDPR, CCPA, State Privacy
• NIST CSF/800-53
• ISO 27001 Program Dev
• IR/IH Program Dev & TTX
• CIS 20 Controls

Adaptive Testing

• Baseline Assessments
• Penetration Testing
• Red Team
• Red/Blue (Purple)
• Application Security Assessment
• Mobile Application Assessment
• On-Demand and Quarterly

Testing

• Social Engineering
• Security Analysis
• M&A Testing

Adaptive SecOps

• Engagement Management
• Reporting
• Managed Security Services
• Remediation Services
• Security Controls

Implementation

• Staff Augmentation
• Incident Response

Adaptive Architecture

• Architecture Consulting

– Security Architecture

▪ Cloud and IoT

– Firewall Analysis – Device Hardening – Segmentation Workshop – Active Directory Analysis – PKI Architecture Assessment

• Architecture Design
• Architecture Implementation

CYBER SECURITY CAPABILITIES

Adaptive Security

PRESIDIO CYBER FRAMEWORK SERVICES

❑ Security Program Assessment

• Looks at the structure and enforcement of the information security management program, and evaluates it for both the maturity
• f the process and the risk to the organization. Presidio will map these levels using the NIST CSF (or other customer defined

framework

❑ NIST CSF Assessment

• Analyzes an organization’s alignment with the NIST CSF Framework: Framework Core, Implementation Tiers and Framework

profile

❑ Security Architecture Analysis

• A series of workshops with key stakeholders to review current IT initiatives and overall security architecture elements. Spot

configuration reviews verify some workshop findings. NIST CSF and CIS 20 controls are leveraged in the analysis.

❑ CIS 20 Assessment

• An assessment of an organization’s implementation of the CIS controls based on the appropriate Implementation Group level

for the particular organization. Includes interviews, reviews of documentation and policies, and spot validation of control state and maturity for a subset of sub-controls.

❑ Ransomware Defense Assessment

• Analyzes an organization’s ability to prevent, detect, respond and recover from Ransomware attacks based on (10) key areas

critical for ransomware defense. Includes sample vulnerability testing.

WHY ARE WE HERE?

• The Public Education Sector (K-12) Threat Landscape is evolving rapidly and security efforts need to be

at the forefront of protecting district technology assets, infrastructure, people, and students.

• Mandatory Education Law 2-D Requirements Enforcement
• NY State Office of Information Technology Services

strongly recommends the CIS 20

– Applied as the mechanism for implementing controls within the IT organization

• NY State Privacy Office recommends NIST CSF

– Applied to address Privacy concerns and build a district wide security strategy and defensible security program

• Proposed Part 121 Updates

– Published January 31st in the State Register – SED will continue to work with workgroup and stakeholders to develop resources for implementation

TODAY’S CYBER SECURITY CHALLENGES IN EDUCATION Attack Vectors Disruption Technology Organization Issues

Board Issue Where do I start? Compliance

Everything is Digital!

Data Risks

Visibility

I Don’t Know What I Don’t Know Resource Shortage Culture Funding

COMMON CYBER ATTACK METHODOLOGY

• More commonly referred as the Cyber Kill Chain
• Concept was derived from the military
• 7 Core Phases
• Blue team goal = Detect and disrupt
• Early detection is critical
• Implement Defense in Depth
• NOT a linear model
• Ability to break one link in the overall chain

increases chances of stopping attack

• Majority of organizations don’t detect compromise

until data extraction or exfil occur

COMMON DISTRICT CHALLENGES & INFLUENCERS

• Federal, State, Local, & Contractual Requirements

– FERPA - Family Educations Rights and Privacy Act – CIPA – Children’s Internet Protection Act – COPPA – Children’s Online Privacy Protection Rule – PPRA – Protection of Pupil Rights Amendment – K-12 Cybersecurity Act of 2019 – Part 121 of the Regulations of the Commissioner – New York State Education Law 2-D

• Tradition Education Culture = Security not a Primary Focus
• Lack of budget dedicated to security resources

– People, Process, & Technology

• Antiquated infrastructure & devices
• Poor Security Awareness & Education

– Administration, Staff, Faculty, Support Staff, etc. have access to SENSITIVE data

WHAT DATA ARE WE PROTECTING AGAINST?

• Educational Information

– “Records, files, documents, and other materials maintained by an education agency or institution

• r by a person acting for such agency or

institution…”

• Student Transcripts
• GPA
• Grades
• Social Security Numbers
• Academic Evaluations
• Psychological Evaluations
• Directory Information / Personally Identifiable Information

(PII) – Student’s First & Last Name – Parent’s Names – Date of Birth – Physical Addresses – Telephone Numbers – Student ID Number – Online contact info (i.e. email) – Persistent Identifiers (cookies, IP Addresses, device serial numbers, unique device identifier) – Digital Content containing child’s image/voice – Geological information that can be tied to an address

• Ex: Latitude & Longitude

The below is a combination of what FERPA and COPPA determine to be Protected Information

Security Frameworks

WHAT ARE FRAMEWORKS?

• Security Frameworks are designed to act as an organizational blueprint for building a defensible information security

program to manage organizational risk and known vulnerabilities.

• Frameworks enable organizations to align security requirements to business goals and objectives, define and prioritize

resources to address security risks, and integrate security into all aspects of the organization

• Examples of Risk Management Frameworks:

– ISO 27005 – NIST 800-30 – FAIR

• Examples of Standards, Compliance, Privacy

– NIST 800-53 R4 – HIPAA Security Rule – PCI DSS 3.2 – GDPR – CCPA – NIST 800-171

• Examples of common Security Program Frameworks:

– ISO/IEC 27000 Series (Internationally recognized in

• ver 160+ countries)

– NIST Cybersecurity Framework (NIST CSF) – COBIT – COSO

• Examples of Control Frameworks:

– CIS 20 – HITRUST CSF – SSAE 18 SOC I & SOC II

CRITICAL SECURITY CONTROLS

• What are the Critical Security Controls?

– “The CIS Critical Security Controls are a recommended set of actions for cyber defense that provide specific and

actionable ways to stop today's most pervasive and dangerous attacks”. – Created in 2008 by the NSA to prioritize Cybersecurity controls based on attack methods and frequency

• How many are there?

– As of the current version 7.1: there are 20 major controls, with 171 total sub-controls.

• What are they based on?

– Derived from the most common attack patterns in leading threat reports and vetted across a very broad community of government and industry security practitioners for most effective defenses.

• Why use them?

– They prioritize and focus a smaller number of actions for improved Cybersecurity posture.

http://cissecurity.org/critical-security-controls/

From the California Breach Report 2016: https://oag.ca.gov/sites/all/files/agweb/pdfs/dbr/2016-data-breach-report.pdf

WHO’S USING THE CIS CONTROLS?

• Adopted by thousands of global enterprises to use in conjunction with a security program

framework such as NIST CSF

• Hundreds of universities
• Hundreds of cities
• State Government adoptions: Michigan, Idaho, Colorado, Arizona, Oregon, others
• K-12 districts throughout the U.S.

“I have found the CIS Implementation Groups (IG) to be very helpful when explaining to school officials and municipal leaders the steps or controls that need to be implemented to raise their security posture….Cybersecurity can be an overwhelming undertaking for organizations that lack the staff or knowledge. The CIS Controls take the guesswork out of what steps to implement. The Implementation Groups take an overwhelming list of controls and essentially turns them into a checklist that is very easy to understand.” Neal Richardson - CISSP, GCCC, GMOB, GCIH, GCIA, GSEC, Director of Technology New Hampshire Hillsboro-Deering School District

CIS 20 CONTROL OVERVIEW

Controls 1-16 are more technical focused Controls 17 – 20 focus more on people and processes.

CIS 20 IMPLEMENTATION GROUPS

• Prioritizing the CIS 20 Sub-Controls

– Starting with CIS 20 v7.1 Implementation Groups were created. – IG’s provide a realistic and achievable starting point for

• rganizations to begin using the CIS Controls.

– The (43) CIS Sub-Controls in IG1 represent basic "Cyber Hygiene"

• Organizations may classify themselves as belonging to one
• f three groups based on the following attributes:

1. The sensitivity of data residing within the organization 2. The level of technical expertise of staff or individuals on contract 3. Availability of resources dedicated to cybersecurity activities

• Note:

– Each implementation group builds on the other – Not all sub-controls of a given IG are applicable or reasonable for an organization to implement. – Higher level IG sub-controls may or should be implemented by an

• rganization

CIS 20 CONTROL OVERVIEW (1-6)

• Actively manage (inventory, track, and correct) all hardware devices on the network so that only authorized devices

are given access, and unauthorized and unmanaged devices are found and prevented from gaining access.

• 1. Inventory and Control of Hardware Assets
• Actively manage (inventory, track, and correct) all software on the network so that only authorized software is

installed and can execute, and that unauthorized and unmanaged software is found and prevented from installation

• r execution.
• 2. Inventory and Control of Software Assets
• Continuously acquire, assess, and take action on new information in order to identify vulnerabilities, remediate, and

minimize the window of opportunity for attackers.

• 3. Continuous Vulnerability Management
• The processes and tools used to track/control/prevent/correct the use, assignment, and configuration of

administrative privileges on computers, networks, and applications.

• 4. Controlled Use of Administrative Privileges
• Establish, implement, and actively manage (track, report on, correct) the security configuration of mobile devices,

laptops, servers, and workstations using a rigorous configuration management and change control process in order to prevent attackers from exploiting vulnerable services and settings.

• 5. Secure Configuration for Hardware and Software on Mobile Devices, Laptops,

Workstations and Servers

• Collect, manage, and analyze audit logs of events that could help detect, understand, or recover from an attack.
• 6. Maintenance, Monitoring and Analysis of Audit Logs

Common Findings

• Incomplete view of devices in

network

• Incomplete software list, outdated

software

• Incomplete patch management,
• No routine vulnerability scanning
• Shared admin accounts,
• Limited alerting on admin

activities

• No standardized secure

benchmarks being followed for hardening consistently.

• No enforcement of hardening
• Limited centralized logging, no

log analytics

CIS 20 CONTROL OVERVIEW (7 - 11)

• Minimize the attack surface and the opportunities for attackers to manipulate human behavior

though their interaction with web browsers and email systems.

• 7. Email and Web Browser Protections
• Control the installation, spread, and execution of malicious code at multiple points in the enterprise,

while optimizing the use of automation to enable rapid updating of defense, data gathering, and corrective action.

• 8. Malware Defenses
• Manage (track/control/correct) the ongoing operational use of ports, protocols, and services on

networked devices in order to minimize windows of vulnerability available to attackers.

• 9. Limitation and Control of Network Ports, Protocols and Services

The processes and tools used to properly back up critical information with a proven methodology for timely recovery of it.

• 10. Data Recovery Capabilities
• Establish, implement, and actively manage (track, report on, correct) the security configuration of

network infrastructure devices using a rigorous configuration management and change control process in order to prevent attackers from exploiting vulnerable services and settings.

• 11. Secure Configuration for Network Devices, such as Firewalls, Routers

and Switches

Common Findings

• Email clients and Web browsers

not hardened

• No DNS layer security
• Modern endpoint anti-malware

defenses not deployed

• Not all systems updated with up

to date anti-malware

• No host-based segmentation
• Limited service hardening
• Backups not routinely tested
• No true offline backups
• Network devices not configured

to standard hardening benchmark

• Management restrictions not in

place

CIS 20 CONTROL OVERVIEW (12 - 16)

• Detect/prevent/correct the flow of information transferring networks of different trust levels with

a focus on security-damaging data.

• 12. Boundary Defense
• The processes and tools used to prevent data exfiltration, mitigate the effects of exfiltrated data,

and ensure the privacy and integrity of sensitive information.

• 13. Data Protection
• The processes and tools used to track/control/prevent/correct secure access to critical assets

(e.g., information, resources, systems) according to the formal determination of which persons, computers, and applications have a need and right to access these critical assets based on an approved classification.

• 14. Controlled Access Based on the Need to Know
• The processes and tools used to track/control/prevent/correct the security use of wireless local

area networks (WLANs), access points, and wireless client systems.

• 15. Wireless Access Control

Actively manage the life cycle of system and application accounts - their creation, use, dormancy, deletion - in order to minimize opportunities for attackers to leverage them.

• 16. Account Monitoring and Control

Common Findings

• Limited network detection

capabilities

• No data classification in place
• No inventory of sensitive

information

• Full drive encryption of mobile

devices not fully configured

• Limited if any network

segmentation

• Limited rogue AP on network

control

• Insecure wireless

authentication/encryption in use

• Multi-factor authentication non-

existent or limited in use

• Limited account controls

CIS 20 CONTROL OVERVIEW (ORGANIZATIONAL)

• For all functional roles in the organization (prioritizing those mission-critical to the business

and its security), identify the specific knowledge, skills and abilities needed to support defense of the enterprise; develop and execute an integrated plan to assess, identify gaps, and remediate through policy, organizational planning, training, and awareness programs.

• 17. Implement a Security Awareness and Training Program
• Manage the security life cycle of all in-house developed and acquired software in order

to prevent, detect, and correct security weaknesses.

• 18. Application Software Security
• Protect the organization's information, as well as its reputation, by developing and

implementing an incident response infrastructure (e.g., plans, defined roles, training, communications, management oversight) for quickly discovering an attack and then effectively containing the damage, eradicating the attacker's presence, and restoring the integrity of the network and systems.

• 19. Incident Response and Management
• Test the overall strength of an organization's defense (the technology, the processes, and

the people) by simulating the objectives and actions of an attacker.

• 20. Penetration Tests and Red Team Exercises

Common Findings

• Routine phishing testing and

social engineering testing not taking place

• Refresher security awareness

training limited

• Code analysis both static and

dynamic testing not being used

• Incident response plans and

playbooks incomplete

• Penetration testing not being

performed or with any regularity

CIS CONTROLS™ SELF-ASSESSMENT TOOL (CSAT)

• FREE online web-based tool to

track and prioritize implementation of the CIS Controls

• Allows for the definition of

implementation groups.

• Allows for self-assessments for

each CIS sub-control across (4) areas

• Mapping to other controls such

as those from NIST 800-53 and compliance requirements from the PCI DSS

• Export capabilities into PDF,

Excel, PPT

https://csat.cisecurity.org/

CIS SECURE SUITE MEMBERSHIP

• Access to the full suite of CIS cybersecurity

resources including: – CIS-CAT Pro configuration assessment tool – Full-format CIS Benchmarks™ - best practices for the secure configuration of a particular system (Over 140 benchmarks available). – Build Kits (Active Directory GPOs, Linux scripts, and more) for rapidly implementing CIS Benchmark recommendations

• FREE Membership to U.S. State, Local,

Tribal, and Territorial (SLTT) government entities and U.S. public academic institutions. https://www.cisecurity.org/cis-securesuite/

CIS CONTROL COMPANION GUIDES

• Specific control applicability and

guidance in the following areas: – Cloud

• IaaS
• PaaS
• SaaS
• FaaS

– Mobile Devices

• Apple IOS
• Android

– Internet of Things (IoT) https://workbench.cisecurity.org/dashboard

10 Minute Break

NIST CYBER SECURITY FRAMEWORK

• v1.0 published in February 2014 as a result of the Presidential Executive

Order 13636 Improving Critical Infrastructure Cybersecurity released in 2013.

• v1.1 was released in April 16, 2018….Among some of the changes that were

made, Supply Chain Risk Management was one of the most significant net- new additions as a sub-category in the Identify function.

• CSF defines standardized cybersecurity activities, desired outcomes, and

applicable references

• Creates a common language for the discussion of cybersecurity issues
• Helps answers the following Cybersecurity questions:

▪ What are we doing today? ▪ How are we doing? ▪ Where do we want to go? ▪ When do we want to get there?

• The framework itself is voluntary and not mandated to be followed by any

regulatory body. Solely based on existing standards, guidelines, and best practices to better manage and reduce cyber security risk.

NIST CYBER SECURITY FRAMEWORK (CSF) OVERVIEW

Complimentary Framework

• Designed for integration

into security program not replacement 3 Core Components 1. Implementation Tiers 2. Framework Core 3. Profiles Technology Neutral 5 Core Functions

• 23 Categories
• 108 Sub-categories

Supply Chain Risk Management added as a category in NIST CSF v1.1 in April of 2018

WHAT NIST CSF IS NOT

• It is not a prescriptive control framework
• An IT governance framework like CoBIT
• A compliance framework or standard like PCI DSS or HIPAA Security Rule
• It was and is not designed to be a one size fits all approach for a Security Program
• A Cybersecurity capability maturity model such as the ISACA CMMI
• It is DEFINITELY not

a Silver Bullet:

“I am convinced that there are only two types of

companies: those that have been hacked and those that will

• be. And even they are converging into one category:

companies that have been hacked and will be hacked again.”

• Robert Mueller, FBI Director March 1, 2012

CYBER SECURITY FRAMEWORK (CSF) CONTROLS

Naming Conventions: ID.BE-1 Core Function Category Sub- Category

PEOPLE, PROCESS, & TECHNOLOGY

• Less than 50% of the

framework categories focus on technology

“If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.”

• Bruce Schneier

UNDERSTANDING IMPLEMENTATION TIERS

• Tiers provide a mechanism for an organization

to view and understand the characteristics

• f their approach to managing cyber

security risk.

• Four Tiers exist, ranging from Tier 1 to Tier 4,

but should not be seen as maturity levels.

• Different Tiers may exist for each function, and

potentially for individual business units within a larger organization.

• Selecting the appropriate Tier for each area

and for the organization’s requirements is a fundamental component of appropriately aligning cyber security to the business.

• Limited awareness at the organizational level
• Reactive and informal risk management
• Prioritization of activities is not informed by organizational risk/threat

• More awareness at the organizational level
• Some risk-informed and management-approved processes and procedures
• Prioritization of activities is informed by organizational risks/threats
• Not universally governed by policy
• Adequate resources available

• Organization-wide approach
• Risk-informed processes and controls are defined, implemented, and updated periodically
• Risk management practices are formally approved as a policy and updated based on the changing

• Resources are knowledgeable and skilled

• Risk management processes are updated based on lessons learned
• Risk management processes are updated to reflect the evolving threat landscape in a timely

• Cyber security risk management is part of the organizational culture and is based on both internal

UNDERSTANDING FRAMEWORK PROFILES

• Profiles represent the outcomes based on

District needs that have been pre-selected by stakeholders

• They are typically characterized as the

alignment of policies, standards, guidelines, and practices to the Framework Core.

• Profiles are commonly categorized into two

types: – Current Profile: “as-is” state – Target Profile: “to-be” state

• Profiles should be used to support

prioritization and program measurement

• ver time

– KPIs, KRIs, & KCIs should also be created and used for program measurement

CYBERSECURITY MATURITY LEVELS

• Organizational process and

control maturity is a critical component to consider and take into account when performing a cyber security risk assessment under the Cyber Security Framework.

• Maturity Assessments are based
• n the ISACA Capability Maturity

Model Index (CMMI)

Level Title Maturity Definitions None The organization’s security program element does not exist in the area being evaluated. 1 Ad-Hoc The organization’s security program element is undocumented and in a state of dynamic change, with a tendency to be driven in an ad-hoc, uncontrolled, and reactive manner. 2 Repeatable The organization’s security program element has formalized some repeatable processes, with the potential for consistent results. Program discipline is unlikely to be rigorous, but where it exists it may help to ensure that the program element satisfies requirements. 3 Defined The organization’s security program element has established a set of defined and documented standard processes that are subject to some degree of improvement over time. These standard processes are in place and used to establish consistency of program element performance across the organization. 4 Managed The organization’s security program element has established a set of defined and documented processes with capabilities that enable management to effectively control the program element. 5 Optimized The organization’s security program element has established a set of defined and documented processes that continually improve process performance through incremental and innovative changes.

NIST CSF FRAMEWORK VS. CIS 20 CONTROLS

**Do not expect there to be direct 1:1 relationships and or mappings between the two frameworks** **There are going to be gaps between the two frameworks – cue NIST 800-53 r4**

CIS Level CIS 20 Controls v7.1 Critical Security Control #1: Inventory of Authorized and Unauthorized Devices Critical Security Control #2: Inventory of Authorized and Unauthorized Software Critical Security Control #3: Continuous Vulnerability Assessment and Remediation Critical Security Control #4: Controlled Use of Administrative Privileges Critical Security Control #5: Secure Configurations for Hardware and Software Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs Critical Security Control #7: Email and Web Browser Protections Critical Security Control #8: Malware Defenses Critical Security Control #9: Limitation and Control of Network Ports Critical Security Control #10: Data Recovery Capabilities Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches Critical Security Control #12: Boundary Defense Critical Security Control #13: Data Protection Critical Security Control #14: Controlled Access Based on the Need to Know Critical Security Control #15: Wireless Access Control Critical Security Control #16: Account Monitoring and Control Critical Security Control #17: Implement a Security Awareness and Training Program Critical Security Control #18: Application Software Security Critical Security Control #19: Incident Response and Management Critical Security Control #20: Penetration Tests and Red Team Exercises Foundational Organizational Basic

Function Category CIS 20 IDENTIFY (ID) Asset Management (ID.AM)

CIS 1.4,2.1-2.5,11.2,12.1-2,13.1,15.1,17.3

Business Environment (ID.BE) Governance (ID.GV)

CIS 19.2

Risk Assessment (ID.RA)

CIS 3.1,3.7

Risk Management Strategy (ID.RM) Supply Chain Risk Management (ID.SC)

CIS 19.5

PROTECT (PR) Identity Management, Authentication and Access Control (PR.AC)

CIS 1.7-8,4.1-4.5,11,12.12,14,15,16,20.8

Awareness and Training (PR.AT)

CIS 17

Data Security (PR.DS)

CIS 1,2,6,13,14,15,18

Information Protection Processes and Procedures (PR.IP)

CIS 5,7,8,9,10,11,12,15,19

Maintenance (PR.MA)

CIS 12.12

Protective Technology (PR.PT)

CIS 4,6,8,10,13

DETECT (DE) Anomalies and Events (DE.AE)

CIS 6,7,8,15

Security Continuous Monitoring (DE.CM)

CIS 1,2,3,5,7,8,9,11,12,13,15,16

Detection Processes (DE.DP)

CIS 19

RESPOND (RS) Response Planning (RS.RP) Communications (RS.CO)

CIS 19

Analysis (RS.AN)

CIS 6,18,19

Mitigation (RS.MI)

CIS 3.7

Improvements (RS.IM) RECOVER (RC) Recovery Planning (RC.RP) Improvements (RC.IM) Communications (RC.CO)

CIS 20 AS A STARTING POINT FOR NIST CSF

• Implementing CIS 20

controls and sub-controls will not address all categories of NIST CSF

• Likewise, NIST CSF

subcategories do not map to all CIS 20 sub-controls

FILLING THE GAP WITH NIST 800-53 R4

No mention of CIS 20 Controls in the Informative References When a CIS 20 control does not map to the NIST CSF sub-category you will need to reference NIST 800- 53 Low-Impact Controls to address the control gap Priority and Baseline Allocation:

• P1 = priority level
• LOW AT-2 = Baseline control selected for low impact
• MOD AT-2(2) = Baseline control selected for Moderate impact PLUS

“control enhancement (2).

• High AT-2(2) = Baseline control selected for Moderate impact PLUS

“control enhancement (2).

FILLING THE GAP WITH NIST 800-53 R4

NIST 800-53 R4 QUICK GLANCE

• The security industry’s gold standard for control coverage
• Provides guidance for 3 levels of control implementation

– Low Impact – This should be the starting point for K-12 – Moderate Impact – High Impact

• All controls can be mapped directly to

NIST CSF sub-categories

ID Family ID Family AC Access Control MP Media Protection AT Awareness and Training PE Physical and Environmental Protection AU Audit and Accountability PL Planning CA Security Assessment and Authorization PS Personnel Security CM Configuration Management RA Risk Assessment CP Contingency Planning SA System and Services Acquisition IA Identification and Authentication SC System and Communications Protection IR Incident Response SI System and Information Integrity MA Maintenance PM Program Management

• 18 Control Families

– Over 1,000 Controls – 115 controls for Low Impact

WHERE DO WE GO NOW?

Risk Prioritization & Treatment.

• Analyze & Prioritize Gaps & Risks
• Develop Risk Register
• Create Risk treatment plans (RTP)

NIST CSF Gap Analysis.

• Gap Analysis establishes Current State
• Leverage 3rd Party
• Understand Gaps in Framework and Control

Implementation **A risk assessment can be bundled and conducted in parallel if desired**

Information Security Policy Development and Implementation.

• Develop Policies – Security and Privacy based
• Create supporting Standards & Guidelines
• Build Procedural documents (SoPs, playbooks, etc.)

CIS 20 Assessment.

• Self Assess using CSAT tool
• Leverage 3rd Party to assess

Strategic Risk Committee.

• Cross functional in nature
• Authority to make decisions based on risk
• Provides oversight for the district

Security Strategy and Charter.

• Rooted in NIST CSF and aligned to the District’s

mission & objectives

03 02 04

05 06

01

• What you may or may not already have, BUT NEED:

– Obtain Executive commitment & sponsorship for building the security program – Understanding of the District’s vision, mission, objectives, & priorities – Develop & Assign Information Security Roles, Responsibilities, and Authorities

• Security Org = CISO + dedicated security staff

– Develop a District-wide aggregate list of Security Requirements

Continuous Program Monitoring.

• Measure, report, & optimize
• Continually assess all aspects of program
• Ensure all program components continue to align to

district needs, address the evolving threat landscape, and align to NIST CSF/CIS 20

SECURE DESIGN PRINCIPLES – LEVERAGING NIST CSF

• Establish the context (IDENTIFY)

– Identify all the elements which compose your system(s), so your defensive measures provide maximum visibility

• Making compromise detection easier (DETECT)

– Design your system so you can spot suspicious activity as it happens and take necessary action

• Making compromise difficult (PROTECT)

– An attacker can only target the parts of a system they can reach. Make your system as difficult to penetrate as possible

• Making disruption difficult (PROTECT)

– Design a system that is resilient to denial of service attacks and usage spikes

• Reducing the impact of compromise (PROTECT)

– If an attacker succeeds in gaining a foothold, they will then move to exploit your system. Make this as difficult as possible

ADDITIONAL RESOURCES & FREE TOOLS

• Framework for Improving Critical Infrastructure Cybersecurity, NIST. (NIST CSF)

– https://www.nist.gov/cyberframework

• Critical Infrastructure Cyber Community (C3) Voluntary Program

– https://www.us-cert.gov/resources/academia

• Consortium for School Networking

– https://www.cosn.org/cybersecurity – https://www.cosn.org/sites/default/files/2017%20Cybersecurity%20rubric.pdf

• National Cybersecurity Assessments and Technical Services (NCATS)

– https://www.us-cert.gov/resources/ncats

• FBI Ransomware Prevention and Response

– https://www.fbi.gov/file-repository/ransomware-prevention-and-response-for- cisos.pdf/view

• The K-12 Cybersecurity Resource Center

– https://k12cybersecure.com/

• Internet Crime Complaint Center

– https://www.ic3.gov/default.aspx

• FBI Cyber Investigation

– https://www.fbi.gov/investigate/cyber

• National Cyber Security Alliance

– https://staysafeonline.org/stay-safe-online/

• Department of Homeland Security (DHS)

– https://www.dhs.gov/topic/cybersecurity

Q&A / Next Steps

| @presidio | youtube.com/presidio | fb.com/PresidioIT | linkedin.com/company/presidio

THREAT GROUPS: AT A GLANCE

Nation State Hacktivists Organized Crime Cyber Terrorists Insider Threat Script Kiddie

TOP CYBER INCIDENTS AND THREATS AFFECTING K-12

1. Data Breaches – Unauthorized disclosure:

• Current & former k-12 staff
• District vendors & partners

– Unauthorized access:

• Students
• External hacking

2. Ransomware – 5 + school districts around country close doors – Pay ransom? – Re-build, re-architect, refresh? 3. Email origin threats – Phishing Campaigns – Business Email Compromise (BEC)

• District Business Officials

60% of breaches included student data 46% of breaches included data about

current and former staff

K-12 PUBLIC CYBER SECURITY INCIDENTS

• Data is a cumulative roll up since

2016

• ~ 800 Reported Incidents Nationally
• Purple represent miscellaneous data

breaches, disclosure of personal information, etc.

• Blue pins are Phishing attacks

resulting in unauthorized information disclosure

• Yellow Pins are Ransomware
• Red represents other disruptions

EDUCATION TECHNOLOGY RISKS FBI: “The US school systems’ rapid growth of education technologies (EdTech) and widespread collection of student data could have privacy and safety implications if compromised or exploited.”

“Malicious use of this sensitive data could

result in:

– Social engineering, bullying, tracking, identity theft, or other means for targeting children”

SOCIAL ENGINEERING: THE ART OF MANIPULATING PEOPLE TO GIVE UP INFORMATION

Only amateurs attack machines; professionals target people

SOCIAL ENGINEERING AND SOCIAL MEDIA

• School Social Media accounts hacked

– Stolen passwords, simple passwords

• Not everything needs to be posted!

– 15% of Americans use social media to report when they have left the home*

LET’S GO PHISHING !

• Phishing scams are a popular attack vector across

multiple industries that have also spread to education, with 91 percent of cyberattacks starting with a phishing email.

• “Phishing scams are typically carried out over email, but

may also come from social media or SMS. Attackers will send an email that appears to be from an authoritative source, or from someone the user knows personally, asking users to send along sensitive information or to enter their login credentials on a fake

• site. Thirty percent of phishing messages get opened by

targets, and 12 percent of those users click on the malicious attachment.”

BUSINESS EMAIL COMPROMISE (BEC)

• What is BEC?

– Phishing email designed to redirect large payments from legitimate school contractors/partners to a criminal account. – This has resulted in the theft of millions of tax payer dollars – The largest theft recorded for K-12 occurred in 2018

• Totaled approximately $2 million dollars in losses by a Texas district
• Public Schools affect by BEC:

– An important observation is that about 60% of BEC attacks do not involve a link in an email: – Attack is typically a plain text email intended to fool the recipient to commit a wire transfer or send sensitive information. – Difficult for existing email security systems to detect

• Often sent from legitimate email accounts
• Tailored to each recipient
• Do not contain any suspicious links.
• U.S. BEC Losses Reported to FBI:

– $375 million in 2016 – $675 million in 2017 – $1 billion estimated in 2018

RANSOMWARE

• Definition: a type of malware that is intended to encrypt encrypt

a user’s important files and document (including network files) making them unreadable, until a ransom is paid

• Ransomware has become a significant threat to all U.S.

businesses, education and individuals.

• Has resulted in some school’s technology systems being down

for weeks!

• Most of the newer ransomware variants collect payment solely in

bitcoin for anonymity

– Decision to pay ransom seldom the right choice

• Damages Globally:

– $325 million in 2015. – $5 billion in damages for 2017. – $7.5 billion estimated in 2019

BASIC INFORMATION SECURITY HYGIENE

• Be vigilant and aware of emails and links: report suspicious emails to IT
• Follow established policies/processes within the district for protection of information
• Social media: be careful what you post and share
• Passwords: use strong passwords, don’t share them and do not use the same passwords

for personal as business.

• Protect and secure your personal computing devices – laptops and phones

BASIC INFORMATION SECURITY HYGIENE

User Awareness Training

• Training
• Periodic testing

Patching and Maintenance

• Current, supported operating systems
• Patch operating systems and

software Backup and Recovery

• Ensure critical systems and data are

backed up regularly

• Periodically validate recovery

Strengthen Authentication

• Enforce strong password requirements
• Adopt multi-factor authentication on critical

and/or public-facing systems Account Permissions / Active Directory Security

• Review/implement role-based access controls
• Review service accounts
• Reduce/eliminate shared accounts

Secure Configurations

• Review system configs against benchmarks

(ex. CIS)

• Adopt secure templates for new systems

BASIC INFORMATION SECURITY HYGIENE

Perimeter Security – ”Next Generation Firewall”

• Content inspection
• URL filtering
• Dynamically updated by threat feed(s)

Perimeter Security – Email Security

• Enforce email security configurations
• Ex. Sender Policy Framework (SPF), Domain

Message Authentication Reporting and Conformance (DMARC), and Domain Keys Identified Mail (DKIM)

• Scan attachments for malware
• Scrub malicious links
• Effective blocking of phishing and spam emails

Endpoint Security

• Effective against current-generation

threats Network Segmentation

• Limit exposure/impact of threats from

users to critical systems Monitoring

• Logging, notification on critical

events, ideally automate response actions

NIST CSF ADOPTION ACTION PLAN

• 1. Review CIS Controls
• 2. Perform Gap analysis against CIS 20, focus on Implementation Group 1, then 2

➢ Report on written policy adherence, control implementation, level of automation (measuring and implementing) and reporting

• 3. Remediate foundational “Cyber Hygiene” areas to improve overall security posture
• 4. Perform NIST CSF assessment

➢ Map CIS 20 implementation against NIST CSF ➢ Identify gaps

• 5. Leverage NIST 800-53 controls to address remaining NIST CSF gaps