recently u.s cyber command has confirmed that it has acted against ransomware groups
underscoring the importance of cyber security to national security i'm here with cynthia brumfield
author cso online contributor and analyst to discuss why effective risk management techniques
are often an important line of defense against cyber incidents stick around
hey everyone welcome back to today in tech i'm julia beauchimp and i'm here like i mentioned with
cynthia bromfield she is an analyst a cso online contributor and also author of the new book gonna
make sure i get this title right cyber security risk management mastering the fundamentals using
the nist cybersecurity framework cynthia thank you so much for calling in and chatting with us today
thank you julia for having me on i appreciate it so like i mentioned in my little intro there
i really want to dive into how and why effective risk management techniques are
often the ultimate defense against any sort of cyber incident ransomware attack you
don't even have to be you know a security pro to understand the consequence of a really large scale
cyber incident i mean just off the top of my head i can think of the colonial pipeline this
year that was obviously a very um a very impactful ransomware attack i mean the pipeline was offline
in for days it was um and i think what we're seeing are uh cyber incidents becoming much more
impactful much more dangerous uh much more real world you mentioned the colonial pipeline
you know that was a cyber you know back in the day cyber incidents involved you know what
today looked like pranks you know back you know around the year 2000 around the year 2010
you know you had really funny little kind of cyber incidents that basically may have brought down
portions of the internet from time to time or may have caused some problems for organizations
and you know they had to go back and reconnect and do all kinds of different things but now you've
got incidents that are real world impactful that can shut down a pipeline to the eastern seaboard
and that is something that is relatively new it's also enormously expensive i mean
the colonial pipeline paid about 4.4 million in its ransomware attack now i've got about
2.3 million of that back because the justice department you know had a ninja move and retrieved
it from the ransomware attackers before they they themselves could make it disappear within the uh
kind of the cryptocurrency world but you know it also cost them a fortune and i i was looking
i haven't seen any really good estimates on how much revenue they lost for those multiple days
where the pipeline was not running they had to pull they had to bring in very expensive cyber
security consultants that you know likely cost them millions of dollars to resolve this incident
and they were hit with class action lawsuits in the aftermath of it not to mention the fact that
a lot of the data of their employees were stolen and that puts them at jeopardy so
there was just this mushrooming set of expenses that in damages that they experienced the risk
is certainly there and i and it's also certainly no secret that the risk is there so how can an
enterprise and i t team security pros within an organization even begin to wrap their arms around
their understanding of the risk that's out there and then coupled with that let's um talk if even
if you can just give a super brief um explanation of what exactly the nist framework is because
that's really what we're referencing here when we're talking about a risk management framework
that's a good idea because we just sort of assume people know what this is but um in this cyber
security framework was created as a result of an executive order under president obama who in 2013
ordered the national institute of standards and technology
to come up with a way to come up with a framework that better protects or all organizations but
particularly critical infrastructure organizations against cyber incidents and helps them resolve it
and helps them you know go back and take lessons learned that does basically the whole thing
uh out over the course of a year nist which is the standard setting body in the united states
and they have tremendous expertise in all areas of cyber security came up with this you know very
uh interesting uh and all-encompassing framework that does look at everything that organizations
should be paying attention to and offers what outcomes that they should be reaching for
and gives them a tool set uh in the form of an uh of standards they call them informative
references in the form of standards and other other kind of informant informative references
so that you can go back to your organization and start implementing these practices the
difficulty with the nist framework is that it was devised by scientists and i went to all
six of the missed workshops that led to the development of the framework and they were
held at universities across the country and they uh thousands of people attended most of them were
you know technically advanced uh thought leaders and academics and scientists and engineers
um and they came up with this very i think elegant cons elegant framework it is a difficult framework
to understand because nist doesn't tell you how to do anything it doesn't even really explain
in detail what the steps are under each of the you know uh you know 100 odd uh
subcategory recommendations that are contained in the framework you know our book hopes hopefully
breaks it down into language that says well here's this section of the nist framework this this
is what that means okay and and this is what you know best practices in the cyber security industry
typically call for for this particular thing so um it's a very elegant framework it is well
well understood by professionals and academics and scientists there is a translation gap between what
nist has produced in the mom and pop and small organizations in particular out there in terms of
how can we take this and apply it in our organization and so hopefully our boat does that
and this the nist framework specifically i know that you said that it was originally developed
i mean by the federal government and also specifically for critical infrastructure
critical infrastructure um organizations so that could be you know for example to continue talking
about colonial pipeline colonial pipeline um and that's sort of how this relates to
the government underscoring the importance of cyber security as it relates to national
security but i would think is it true that the nist framework doesn't just have to be applied to
the gas pipelines of the world it can be probably applied to
any organization small to large and i would i would think and you can certainly correct me here
that this could be a good jumping off point for say a small business or a medium-sized business
that maybe doesn't have dedicated security pro on staff to be able to look at this and say
okay here are some actionable insights and some actionable steps we can take to better protect our
enterprise better protect our data better protect whatever reputation for example yeah i mean
you're exactly right the the nist framework became the critical infrastructure framework
because that was the language in obama's executive order and that was you know kind of the focus
that we need to protect the critical infrastructure more but as nist went through
the development of the framework and even now um they made very clear that they hope organizations
who aren't critical infrastructure and you know that's a very expansive term absolutely they're
17 or 18. they've changed them over the year uh critical infrastructure sectors in the u.s that
could you know be as expansive you know i did some work in the broadcasting industry that could be as
expansive as including a broadcast station now is that critically different yes it is according
to um the you know the uh federal government and that is critical infrastructure so so it's really
hard to say that there you know there's very few businesses out there that don't fit into
a uh a sector that has been designated you know likely to be critical infrastructure however going
back to your point this really stresses that it needs to um that it encourages all organizations
to take the framework and pick and choose from its many components those bits that might
better help them secure their organizations and it's not it's sort of like a a la carte menu
in some respects nobody has to do everything and if you're small mom and pop it doesn't
make sense for you to do one particular aspect of the framework we'll look at the other parts that
if they help you then you know please adopt them in your organization that that's their posture
so with the nist framework what about it is and what about you know risk management frameworks
in general for cyber security what about them specifically are
important in defending against a cyber incident well you know it's interesting because
one of the things the nist framework seeks to do is to not produce a checklist of items that
organizations do because in the past in the past having said that i will give you a checklist but
um in the past what organizations you know compliance does not equal security that is kind
of a well-worn phrase within the cyber security industry but in the past a lot of security efforts
have been okay did that did that did that check off all those activities and we're done and that
has actually partially led to the security problems that we're facing today it makes us
less secure if you do that checklist model but i will tell you the
cyber security and infrastructure security agency which is part of dhs it's called cisa has
stressed since the beginning of the biden administration and continues to stress certain
base level activities that are really important to security and you know going back to the uh i
mentioned president i may not have mentioned but president biden issued a very ambitious
executive order on cyber security in may that mentions for example multi-factor authentication
appropriate detection and response activities encryption which basically enables you to
keep data you know kind of out of the hands of those who don't have
the formulas that your mathematical formulas that you're using to you know store your data um
and uh having an empowered security team all those things are really important but in addition
to that cisa and i think i pulled this directly from their website and jen easterly who is the
director of cisco currently has mentioned them in various statements you know keep backups of data
that is for example when it comes to ransomware very critical because if you have sufficient
data backups and you test those backup systems and you keep them separate from the networks that
are going to be infiltrated by ransomware attackers then there's really no well this
is a simplification but it lessens the need to have to deal pay any ransom at all because
okay you know you got in our system and you know you made everything non-functional well
fine we'll just build everything again from backups well it's a little more complicated
than that because these days ransomware attackers are also stealing data and they're
uh you know black mailing organizations that they'll release it so so it's not that simple
but if you keep backups it will you know keep the organization in good stead um uh
use a risk-based strategy to drive patched management programs and this is really critical
because software is continually being patched every day even as we speak by the thousands of
providers you know we know the big ones there's microsoft there's adobe there's oracle there's
so many organizations out there that are kind of driving the business sector in terms of software
and they they are you know the monsters but but everybody else i mean can have uh flaws in their
systems that they need to patch and you can't just constantly go around doing that you have to come
up with manage sort of a risk based management system for patching your systems and that has led
to a lot of major cyber security incidents over the year having over the years having insecure
patchmen having inadequate patch management programs testing your incident response plans
testing your security team's work segmenting networks to limit the damage
when an incident occurs you don't you want to protect the you know the
the most important parts of your network uh in a way that you may not want to you know
protect something that's very relatively trivial that your organization has on its network so
having some sort of risk management program to segment your networks and treat different
components that you perceive to be more valuable differently is really important
all of these things have been raised by cisa have been raised by the bible administration over the
last six months and have been stressed and have been uh emphasized however you
know there's far more than that that of course kind of goes and that goes into risk management
absolutely well it really does seem like the nist framework could be a good place to start
for any arthur security pro or it team member who is looking at their organization saying okay we
we need to start investing in security in both you know literal dollars and also in time um
and i think it could be good to be able to look at the nist framework and say
like you have mentioned xyz applies to us but we don't need to worry about abc
or vice versa and i would think too that there was me is maybe a way that um organizations can
figure out how to build upon whatever existing infrastructure they already have would you think
would you think that's possible um absolutely i mean you've got to start where
where you're you're at and that's the interesting infrastructure right and so you need to start
building upon what you have i mean i think that goes without saying and it is you know the legacy
infrastructure is a really interesting question and there's something called technical debt that
you know kind of complicates the whole question of cyber security which means you've got a lot of
old stuff hanging around that you haven't really paid any attention to or that hasn't been brought
up to date or hasn't maybe not even appear in the asset inventory which is really common so
yeah you're exactly right great well thank you so much cynthia for calling in and joining me
today i think this was a really nice overview and definitely some actionable insights to take away
from here if if you as even you know as someone in any level of the organization looking at
whatever your um perhaps whatever your security infrastructure isn't saying you know we need
to improve this so thank you so much i really appreciate it cynthia you're welcome thank you
juliet for inviting me and thank you all so much for watching this episode of today in tech if you
liked this video you can give it a thumbs up you can also subscribe to our channel and hit the bell
icon so you're notified every single time we post a new video if you have any questions or comments
about cyber security frameworks risk management what have you please do leave us a comment in the
comment section below and if it's a question i will do my best to get back to you just a
reminder this is our last episode of 2021 so happy holidays and happy new year to anyone watching
we will be with you again in 2022 thanks again for watching and we'll see you next time