-: Standard frameworks.
So we talked about policies and standards and guidelines
and procedures in the last lecture.
And there's a lot to creating all of those documents.
Is there a shortcut?
Well, yeah.
There are standard frameworks out there
because creating your own cybersecurity program
is a daunting task, there is so much to do.
So these standard frameworks exist to help us out
and provide us a standardized approach
to building these things, almost like building blocks.
So the first one I wanna talk about
is the NIST Cybersecurity Framework.
This is designed to meet one or more
of these five objectives.
They can be done to describe your current security posture,
describe your desired end state,
identify and prioritize areas for improvement,
assess your progress towards the desired end state
and communicate risk amongst your
internal and external shareholders.
Now, the idea here with the cybersecurity framework
by NIST is that gives you a very large opening
and a very large set of policy framework
that you can create this in.
Now, if you can see on the chart here,
in 2012, nobody was using NIST
as their cybersecurity framework.
But in 2015, about 30% of the folks were,
and now there's an expected usage about 50%,
so one out of every two organizations by 2020
is expected to be using the NIST Cybersecurity Framework.
The nice thing about the Cybersecurity Framework from NIST
is that it is specifically modeled for cybersecurity
and that gives you a really nice package
of policies to start with.
Now, when you start looking at some of these
other frameworks we're going talk about,
there is cybersecurity tie-ins into 'em,
but they were never designed originally
with cybersecurity in mind.
So when we talk about the Cybersecurity Framework from NIST,
it is three different frameworks that are built up.
There is the Framework Core which is a set of five
security functions that apply to all industries.
There's also the Implementation Tiers,
which is gonna measure how the organization
is positioned to meet its cybersecurity objectives
and start doing some analysis and metrics and measurements.
Framework Profiles, on the other hand,
describe how the organization might approach functions
by the Framework Core,
because again, that core is gonna say,
"Here's how I'm gonna do it, here's all these functions,"
and the profile will start giving you more or less security
that you can apply, based on the job functions you're doing.
Now, the second one I wanna talk about here is ISO 2701,
excuse me, 27001.
Now, the ISO 27001 is an international standard.
It is used most commonly in the information security
standard in the world at this time,
but NIST is starting to take more hold.
ISO 27001 is declining in usage recently
outside of regulated companies.
And the regulated companies are required
to follow ISO compliance, so they will keep going
with the 27001 standard.
That requires a lot of external audits
and a lot of other policies and procedures,
because to become ISO 27001 certified,
an external assessor has to validate
your organization's compliance.
So they come in, they read all your procedures,
and they look and make sure that you are following it,
and that you're doing everything the way
that they want you to under the 27001.
Now, how is the 27001 made up?
Well, it has 14 different categories
and policies that fall into it.
Now, I'm not gonna read each of these to you,
but you can read them on the screen.
You can see the fact that there are some IT ones,
but there's also some human resource ones.
There's also some asset management ones,
there's some system acquisition ones.
There's all these different categories and you have to be
from top to bottom in your policy cover all 14
of these areas, if you want to get 27001 certified.
So for the exam, you should know what the 27001 is,
the ISO standard, but you don't need to memorize
all 14 of these categories.
If you're gonna be working at an organization
that is ISO certified, you will have to become
more familiar with this in the future.
The next one I wanna talk to you about is ITIL.
Now, ITIL is the Information Technology
Infrastructure Library, and it's currently
on version 3 of the framework.
It's been out since the early 1980s
and it's now in its third revision as of 2009.
It is a very popular framework and used very heavily
in IT service management.
Now, IT service management is more focused
on operating a service and providing value
to its customers, not necessarily cybersecurity.
But there are key places where us, as cybersecurity
analysts, will tie into the ITIL framework.
And I've highlighted those with my red box here.
You'll see that continuity management,
the information security management,
event management, access management,
problem management and incident management
are just six of the key ones that I really think
you're gonna touch as a daily basis
as a cybersecurity analyst.
But there are other places you may touch it, as well.
Now, ITIL is broken up into five phases.
It is service strategy, service design,
service transition, service operation,
and then at the end, we have this
continual service improvement that's constantly going on,
trying to improve our processes in the ITIL framework.
ITIL is a very popular certification.
It is actually extremely popular in the United Kingdom,
but also in the United States.
If you are interested in learning more about ITIL,
you don't need to know more than this for the exam for CSA+,
but there is their own certification called
ITIL Foundations, which is the first one in the series.
And we do have our entire course here on YouTube on ITIL.
It's about eight and a half hours long.
It will teach you everything you need to know to pass
that exam, if you're in an organization that's using ITIL.
The next one I wanna talk about is COBIT.
And COBIT is a Control Objectives
for Information Related Technologies.
This one is a set of best practices created
by an organization called ISACA for IT governance.
So COBIT is split up into four phases.
And these four phases or domains are
planning and organizing,
acquire and implement,
deliver and support and monitor and evaluate.
Now, COBIT is a popular framework,
but it has definitely gone down in popularity
in recent years in favor of things like ITIL,
which is much never, 'cause COBIT was originally done
in the 70s and 80s, although there are a lot
of organizations that still do use COBIT.
Again, depending on your organization,
you can use any of these frameworks.
There's a lot of choices out there.
Now, COBIT does have a couple of components to it.
There's the COBIT framework, the process descriptions,
the control objectives, the management guidelines
and the maturity models.
These four domains are then broken up into these components
and addressed inside those frameworks and policies.
Again, it's places you can pull information from,
not required things, but things that can start helping you
as you're building your framework for your organization.
The next one I wanna talk about is TOGAF.
And that is The Open Group Architecture Framework.
This one is a widely adopted approach
to what's called enterprise architecture.
Or how you build this system of systems
across your networks.
Now, there's four domains here.
There's the business architecture,
application architecture, data architecture
and technical architecture.
The business architecture really integrates
the enterprise architecture with the business strategy.
So what is your business trying to do
and how are we going to develop our networks
and systems and processes to meet those business goals?
Application architecture is instead focused
on the applications and systems used
to meet those business processes and goals,
where data architecture starts focusing
on storing and managing your information assets.
And finally, your technical architecture
is where you really start look at the details
of the infrastructure that you need
to support those other three domains.
You'll notice that this is a very popular framework
and there are lots of people using it,
as far as enterprise architecture.
But it doesn't necessarily tie extremely well
into our cybersecurity framework, and that's why
people are starting to favor things like NIST.
Now, when we talk about SABSA.
SABSA is the Sherwood Applied Business
Security Architecture.
This is a different model for security architecture
that maps architectural layers to different perspectives.
It has that EA feel that we had with TOGAF.
It's using enterprise architecture
and you'll have these views and these architecture layers.
Honestly, I've never run across SABSA in my 20 years
of working in the cybersecurity world,
and you probably won't either, because honestly,
most people are going to TOGAF instead.
For the exam, you don't need to memorize SABSA,
except for the fact that it exists.
You don't need to worry about this chart on the screen
that shows you different views in the architecture layer.
But if you wanna dig into SABSA,
it may be something you wanna look into,
but most likely you're going to go with TOGAF,
if you're looking for EA stuff.
(cyber music)