Enhance PII Protection with Elements of NIST Cybersecurity Framework

The concept of a ‘’unhackable’’ system is unachievable. Perhaps, the most ‘’secure’’ system would be the one without any network connection, but it would nevertheless be vulnerable to physical attacks such as theft. Cybercrime is a global predicament that’s been dominating the news cycle. In 2020, that breach’s average cost was AUD 3.35 million per breach, increasing by 9.8% from last year. 80% of these incidents resulted in the exposure of customer’s personally identifiable information (PII). What is concerning is that the time it took to identify and contain a breach took an average of 211 days for businesses without security automation. The need for an imminent solution for organisations that store the lucrative Protected Identifiable Information (PII) is more crucial than ever.

In response to the cyberattacks targeting organisations, the National Institute of Technology and Standards created a NIST Cybersecurity Framework) for any type or size of organisations in February 2014. The framework is designed to enable organisations to understand better and enhance their management of cybersecurity risk. The core of the NIST Cybersecurity Framework consists of five main functions, which are Identify, Protect, Detect, Respond, Recover. They aid organisations in efficiently expressing their management of cybersecurity risks at a high level and enabling risk management decisions.

The purpose of the function Identify is to help an organisation understand how to manage cybersecurity risks in systems, people, assets, data, and capabilities. This allows businesses to understand better the risks involved with the business operations and prioritise their efforts with their risk management strategy and business obligations. As a result of this function, organisations can produce an asset management plan, identify a risk management strategy, identify asset vulnerabilities, identify a supply chain risk management strategy and identify cybersecurity policies to define a Governance plan.

The purpose of the function Protect is to support organisations to establish capable mitigation strategies to ensure the delivery of critical infrastructure services. This will empower organisations to limit, contain, or mitigate the impact of a potential cybersecurity attack on their system. As a result of this function, organisations can protect identity management, access control, organiztional resources, managing data security, and protective technology to ensure they are aligned with the organization’s risk strategy and policies.

The purpose of the function Detect is to permit organisations to identify an occurrence of a cybersecurity attack. This enables organisations to discover cybersecurity events promptly. As a result of this function, organisations can monitor security events more efficiently and create detection processes to reveal anomalous events.

The purpose of the function Respond is to permit organisations to respond to the detected cybersecurity events and try to rectify it. This function also assists organisations in containing and mitigating the impact of a potential cybersecurity event. This will permit organisations to perform mitigation activities to prevent and resolve cyberattack breaches in their system and analyse the response’s effectiveness while incorporating lessons learned for future cybersecurity events.

The purpose of the function Recover is to enable organisations to establish strategies to restore any capabilities or services affected due to the cybersecurity event. This function will help produce an effective recovery process to normalise operations or reduce the impact of a cybersecurity incident.

The NIST Cybersecurity framework can be customised and modified to cater to any organisation’s requirements. This is crucial for organisations that are just starting to establish a cybersecurity program while also providing excellent value to organisations with mature programs, thus enabling scalability. NIST Framework became mandatory for all US Federal Agencies in 2017 due to a presidential executive order. According to the information technology research company Gartner, the Cybersecurity Framework is used by 30 percent of U.S. organisations, and that number is projected to reach 50 percent by 2020. Companies such as Intel, Microsoft, Boeing, and Ontario Energy Board have already incorporated the NIST framework. Thus, making the NIST Cybersecurity Framework one of the most comprehensive and reliable cybersecurity frameworks available.

If you are looking for a qualified professional to equip your organisation with NIST Framework standards, feel free to consult our experts at Quantum. Our experienced CISO will be happy to learn about your requirements and walk you through obtaining one of the most globally accepted cybersecurity frameworks in the world.

Originally published at https://blog.quantum.security on July 30, 2021.