Instructor: Key frameworks.
In this lesson, we're going to talk
about a couple of different frameworks that are covered
by the objectives of the Security+ exam.
Now, the first one we're going to talk
about is the Center for Internet Security or CIS.
The Center for Internet Security,
creates a framework that's based
on a consensus-developed secure configuration guidelines
for hardening, these are known as benchmarks,
as well as some prescriptive, prioritize
and simplified sets of cyber security best practices,
these are known as configuration guides.
Now, when we look at benchmarks,
this tells us what are the things that we should be using
as we go through and make sure our systems are up to snuff.
When we look at the configuration guides,
this will be actually step by step instructions.
For instance, if you're running a Windows 10 machine,
you should go and set up these configurations
to make sure it's secure and ready for users.
The next framework we're going to cover is known
as the Risk Management Framework or RMF.
Now, RMF is something has become very popular
in recent years.
This is a process that integrates security
and risk management activities
into the system development lifecycle early on.
This way, we can do this as an approach
to security control selection
and specification that considers the effectiveness,
efficiency and constraints due to the different laws,
directives, executive orders, policies,
standards, and regulations.
Now I know this is a mouthful,
but the reason why we have all these different types
of laws and regulations and policies is
because RMF was developed for the federal government's use.
If you work for the federal government
or as a contractor for the federal government,
you are probably going to be using
the Risk Management Framework.
When you look at the Risk Management Framework,
there is lots of pieces that make this thing up.
As you go through the different steps,
you're going to start with preparation.
After you prepare,
you're going to go ahead and categorize your systems.
You're going to select the different controls you want,
you're going to implement those controls,
you're going to assess those controls,
you're going to authorize the system
and you're going to monitor those controls for effectiveness.
And this happens in a loop as it goes around.
And there's preparation that happens for each of these.
Now, as you can see, there are lots
of different publications
that help you understand the Risk Management Framework,
including NIST special publications shown
on the outside ring there as well
as some other FIPS instructions.
Do you have to know all of these for the exam?
No, not at all.
You should just know
that the Risk Management Framework is made
by NIST and it's used in federal government systems.
The other one that's made
by NIST is known as the Cybersecurity Framework or CSF.
This is a set
of industry standards and best practices
that were created by NIST
to help organizations manage their cyber security risks.
Often, you will find that Risk Management Framework
and the CSF work together inside of an organization.
When you look at CSF, it's going to start out
with some five basic functional areas.
These are identify, protect, detect, respond, and recover.
And these are basically the five phases
that you're going to do inside of cybersecurity.
Now, under those, we have categories.
For instance, here on my screen,
you can see things like asset management,
the business environment, governance, risk assessment,
if we dropped down a little bit further,
awareness and training and data security,
even further, we have anomalies and events
that have to be detected and the detection processes.
As you can see all these is basic categories
and under those, we have sub categories as well.
And so because this is a federal government system,
there are layers upon layers of complexity to it.
Again, it's not something you need to know in depth
for the exam, but you should be aware
that the CSF, the Cyber Security Framework is made by NIST,
and you should be aware
of the five category functions that we have,
identify, protect, detect, respond, and recover.
The next framework we're going to talk
about is an international one.
This is known as ISO 27001.
ISO is the International Organization for Standardization.
And this is an international standard
that details the requirements for establishing, implementing
maintaining, and continually improving
an information security management system or ISMS.
Now, when you hear ISO 27001, I just want you to think
about the fact that this is a basic procedure
for cyber security, and it is an international standard.
The next one we have is ISO 27002.
This again is an international standard
and it provides best practice recommendations
on information security controls
for use for those responsible,
for initiating, implementing, or maintaining
information security management systems, ISMSs.
So again, you can see how 27001
and 27002 could work together.
With 27001, we're talking about the requirements
for establishing and maintaining these systems.
When we're talking about 27002, we're talking specifically
about the controls that we're going to choose
to protect those systems.
Next, we have the ISO 27701.
This again is an international standard
and it acts as a privacy extension to the ISO 27001.
It's used to enhance the existing ISMS
with additional requirements
in order to establish, implement, maintain,
and continually improve
privacy information management systems.
So if you have 27001, that's your information systems.
If you have 27002,
that's the controls to protect those systems.
When you talk about 27701,
you're talking about adding privacy on top of that.
The final international standard we want to talk
about is ISO 31000.
This is an international standard
for enterprise risk management,
and it provides a universally recognized paradigm
for practitioners and companies
to employ risk management processes
to replace the myriad of existing standards,
methodologies, and paradigms that differed
between different industries, subject matters and regions.
So essentially, if you think
about risk management framework, the RMF,
how it's used in the United States,
the ISO 31000 was trying to do this globally.
They're trying to figure out how we can make everybody use
the exact same Risk Management Framework,
and that's where ISO 31000 comes into play.
Now, the next framework we're going to talk
about is System and Organization Controls,
also known as SOC.
Now, this is a suite of reports are going to be produced
during an audit.
And this is going to be used
by service organizations to issue validated reports
of internal controls over those information systems
to the users of those services.
Now, if you're going to go ahead and get a SOC audit done,
this is going to be something is going to be used
in conjunction with some of your other frameworks.
So if you're using NIST RMF or NIST Cybersecurity Framework,
that tells you what controls you wanted to put in place.
The SOC is going to do the audit of those controls
and make sure you're in compliance.
Now on your objectives, they mentioned two terms.
They mentioned the SOC two
and they mentioned type two underneath this idea of a SOC.
When we talk about SOC two,
this means it is a trusted services criteria.
And this is basically when you go and look
at the manual for SOC,
it you'll tell you what those requirements are
as part of that audit.
That's what the trusted services criteria is used for.
Now, when I talk about the type two.
This is going to address the operational effectiveness
of the specified control over a given period of time.
Normally, that's going to be 9 to 12 months.
So if I'm doing an audit and I'm looking
to make sure you have multifactor authentication
to prevent people from logging onto your systems,
I can then say how effective is your implementation
of multifactor authentication over a 9 to 12 month period
and I can put that into my report as well,
if I'm doing a SOC two, type two report.
The next framework we want to talk
about comes from the Cloud Security Alliance.
It is the Cloud Control Matrix.
This is a framework that's designed
to provide fundamental security principles
to guide cloud vendors
and to assist prospective cloud customers
in assessing the overall security risk
of a given cloud provider.
So if you're trying to decide are you going to go with Azure
or AWS or Google cloud,
you can run it through your Cloud Control Matrix
to figure out which one is best going to meet your needs
and provide you the best security.
Now, the final thing we want to talk
about also comes from the Cloud Security Alliance
and it's the Reference Architecture.
This is a methodology and a set of tools
that enable security architects, enterprise architects
and risk management professionals to leverage a common set
of solutions that fulfill their common needs
to be able to assess where their internal IT
and their cloud providers are
in terms of security capabilities, and to plan a roadmap
to meet the security needs of their business.
Essentially, when we talk about a reference architecture,
we're saying, this is the thing we're going to build towards,
this is how we want to build this thing
to make sure it's secure.
Now, once we do that over time,
that may change and things go and deviate away
from that reference architecture,
that's when we go away from baseline,
but what we designed as a reference architecture
gives us the outline of what we want
and how we want everything to match up
so we can have the best security
and we meet our roadmap to meet those needs.