Cybersecurity Maturity Models

HC3 Intelligence Briefing Cybersecurity Maturity Models

08/06/2020

Report #: 202008061030

Agenda

? Executive Summary

? Background ? What is Cybersecurity Maturity Model(CMM) ? History of CMM ? Why use CMM ? How to use CMM

? Notable Cybersecurity Maturity Models ? Cybersecurity Capability Maturity Model (C2M2) ? NIST Cybersecurity Framework ? Cybersecurity Maturity Model Certification

? How can CMM be used to protect the Health/Public Health Sector ? Using CMMs to provide customer with continuous service ? Using CMMs to protect sensitive information ? Using CMMs to comply with laws and regulations

Slides Key:

Non-Technical: managerial, strategic and high-level (general audience)

Technical: Tactical / IOCs; requiring in-depth knowledge (sysadmins, IRT)

TLP: WHITE, ID# 202008061030 2

Executive Summary

? Cybersecurity Maturity Models: ? Attempt to collect the best cybersecurity practices; ? Are developed by a collaboration of experts from diverse backgrounds; ? Consider the dispersion in size, knowledge, skills, abilities, and experience of organizations that will use the model; ? Take a life cycle and continuous improvement approach to cybersecurity

? Cybersecurity Models help organizations ? Provide services for their customers without interruption; ? Protect sensitive customer and proprietary information; and ? Comply with laws and regulations that govern their operations.

TLP: WHITE, ID# 202008061030

3

Cybersecurity Maturity Model

? Provides a structure for organizations to baseline current capabilities in cybersecurity workforce planning, establishing a foundation for consistent evaluation

? Management tool for leadership in identifying opportunities for growth and evolution

NICCS (2014)

Optimizing Managed/Review Defined/Maintenance

Developing Initial

TLP: WHITE, ID# 202008061030

4

Maturity Model History

1986 Capabilities

Maturity Model (CMM)

2012 Cybersecurity

Capability Maturity Model (C2M2)

2020 Cybersecurity

Maturity Model Certification (CMMC)

2006 Capability Maturity

Model Integration

(CMMI)

2013

NIST Cybersecurity

Framework (CSF)

TLP: WHITE, ID# 202008061030

5

Why do you need a Cybersecurity Maturity Model

Help CISOs to communicate

security to Board

Provide current security posture

Benchmarking against industry

NICCS (2014)

Security strategy and

roadmap

Balancing cyber security

portfolio

Help in optimizing

security investments

TLP: WHITE, ID# 202008061030

6

How to use a Cybersecurity Maturity Model

ACT

? Develop lessons learned

? Establish baselines, ? Make adjustments as

needed ? Continue cycle again

Plan

? Select Cybersecurity Maturity Model or Framework

? Identify Assessment Tool

? Conduct Security Assessment

NICCS (2014) Demming, E. W. (1982)

Check

? Verify the Security Controls

? Self-Assessment ? Third Party

verification

Do

? Implement Security Controls

? Develop Policies ? Conduct training

TLP: WHITE, ID# 202008061030

7

Notable Cybersecurity Maturity Models

Cybersecurity Capabilities Maturity NIST Cybersecurity Framework

Model (C2M2)

(CSF)

DOD Cybersecurity Maturity Model Certification

? Developed in 2012, updated in 2014 and 2019.

? Developed collaboratively with an industry advisory group from government, Industry, and academia led by the Department of Energy in partnership with the Department of Homeland Security.

? Derived from cybersecurity best practices from government and industry.

? Originally developed for critical infrastructure but updated to be applied to all sectors with information and operations technology. [1]

? Published first in 2014. Updated in ? Created in 2019 and updated in

2017 and 2018.

2020.

? Collaborative effort of industry,

? Developed in concert with

academia, and government

Department of Defense

coordinated by the National

stakeholders, University Affiliated

Institute of Standards and

Researchers, Federally Funded

Technology (NIST).

Research Centers, and the

? Mandated by the Cybersecurity

Defense Industrial Base and led

Enhancement Act of 2014 (CEA).

by the Office of the Under

? Brings best practices from industry

Secretary of Defense for

and government but practices are

Acquisition and Sustainment.

derived directly from NIST 800-53, ? From NIST SP 800-171, Security

Security and Privacy Controls for

Requirements for Controlled

Federal Information Systems and

Unclassified Information, and the

Organizations, April 2013.

Defense Acquisition Supplement.

? Developed to improve

? For Defense Industrial Base

cybersecurity risk management for

Contractors and will require a

critical infrastructure but can be

third- party certification. [3]

used by any sector or community.

[2]

[1] Department of Energy (n.d.) [2] NIST (n.d.) [3] CMMC (2020)

TLP: WHITE, ID# 202008061030

8

 ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download