-: In this lesson, we're going to discuss 2 2
why the NIST Cybersecurity Framework is valuable. 3 3
Now, the NIST Cybersecurity Framework was designed 4 4
to help businesses and organizations of all sizes 5 5
to better understand, manage, and reduce 6 6
their cybersecurity risks, 7 7
and then protect their networks and data. 8 8
All businesses and organizations have risk 9 9
to their different operations 10 10
based on their increased reliance 11 11
on information technology, operational technology, 12 12
and the networks that interconnect them. 13 13
To help provide a common language and systematic methodology 14 14
for managing cybersecurity risk, 15 15
the National Institute of Standards and Technology, 16 16
known as NIST, developed their cybersecurity framework. 17 17
Now, if you aren't familiar with NIST, 18 18
they are a governmental organization 19 19
that's part of the United States Department of Commerce. 20 20
NIST was created all the way back in 1901, 21 21
way before computers were around, 22 22
and they are a non-regulatory federal agency 23 23
that's focused on promoting US innovation 24 24
and industrial competitiveness 25 25
by advancing measurement science, standards, and technology 26 26
in ways that enhance economic security 27 27
and improve our quality of life. 28 28
Now, February 12th, 2013 is when President Barack Obama 29 29
released Executive Order 13636, which was called 30 30
"Improving Critical Infrastructure Cybersecurity." 31 31
Now, in this Executive Order, the president said, 32 32
"It's the policy of the United States 33 33
to enhance the security and resiliency 34 34
of the nation's critical infrastructure, 35 35
and to maintain a cyber environment 36 36
that encourages efficiency, innovation, 37 37
and economic prosperity, 38 38
while promoting safety, security, 39 39
business confidentiality, privacy, and civil liberties. 40 40
This Executive Order effectively established 41 41
the requirements for the NIST Cybersecurity Framework, 42 42
and it provided the initial design criteria, 43 43
including the following seven items for that framework. 44 44
First, identify security standards and guidelines 45 45
applicable across sectors of critical infrastructure. 46 46
Second, provide a prioritized, flexible, repeatable, 47 47
performance-based, and cost-effective approach. 48 48
Third, help owners and operators of critical infrastructure 49 49
identify, assess, and manage cyber risk. 50 50
Fourth, enable technical innovation 51 51
and account for organizational differences. 52 52
Fifth, provide guidance that is technology neutral 53 53
and enables critical infrastructure sectors 54 54
to benefit from a competitive market 55 55
for products and services. 56 56
Sixth, include guidance for measuring the performance 57 57
of implementing the Cybersecurity Framework. 58 58
And seventh, identify areas for improvement 59 59
that should be addressed 60 60
through future collaboration with particular sectors 61 61
and standards-developing organizations. 62 62
Now, while NIST was responsible 63 63
for getting the framework created and published, 64 64
the primary authors were actually 65 65
cybersecurity practitioners from across the United States. 66 66
These practitioners met with NIST 67 67
over five separate workshops that were held 68 68
at different locations across the United States. 69 69
Now, there were three main goals of these workshops. 70 70
First, they wanted to identify 71 71
existing cybersecurity standards, guidelines, 72 72
frameworks, and best practices 73 73
that were applicable to increasing the security 74 74
of critical infrastructure sectors 75 75
and other interested entities. 76 76
Second, they wanted to specify high-priority gaps 77 77
for which new or revise standards were needed. 78 78
And third, they wanted to collaboratively develop 79 79
action plans by which those gaps could be addressed. 80 80
Now, the result of these workshops, 81 81
and the authoring process at large, 82 82
was the first version of the Cybersecurity Framework. 83 83
This framework was called "The Framework 84 84
for Improving Critical Infrastructure Cybersecurity," 85 85
and this was released in February of 2014 as Version 1.0. 86 86
Now, the framework quickly began to be adopted 87 87
both inside the critical infrastructure sector, 88 88
where it's originally developed for, 89 89
as well as across a wide variety of other sectors. 90 90
And it became more broadly accepted and known under the name 91 91
of the NIST Cybersecurity Framework. 92 92
These days, you can find the NIST Cybersecurity Framework 93 93
being used by a large variety of different companies, 94 94
organizations, and governments across the globe. 95 95
Now, in April 2018, the latest version 96 96
of the NIST Cybersecurity Framework 97 97
was actually released as Version 1.1. 98 98
This revision focused on refining, clarifying, and enhancing 99 99
Version 1.0 for better understanding 100 100
between various stakeholders who may be using the framework 101 101
in a given business or organization. 102 102
This newer version is considered backward compatible 103 103
with the original 1.0 version of the framework, 104 104
but it does include some nice additions. 105 105
For example, in Version 1.1, 106 106
there's a new self-assessment section 107 107
that was added to this framework, 108 108
and it has a greater focus on supply chain risk management, 109 109
and we have refinements that were made 110 110
to account for better authentication, 111 111
authorization and identity proofing outcomes. 112 112
Now, in addition to this core framework, 113 113
NIST also publishes implementation guidance 114 114
for different industries and use cases 115 115
such as for federal agencies 116 116
who try to implement the framework, 117 117
or for manufacturing businesses 118 118
trying to implement it as well. 119 119
Now because the NIST Cybersecurity Framework 120 120
was created by the US Government, 121 121
it's actually published free of charge 122 122
for anyone to download and use as they want 123 123
inside their organization. 124 124
This is one of the great things 125 125
about the NIST Cybersecurity Framework. 126 126
It is provided as a public service, 127 127
and it's considered public information 128 128
that can be fully distributed, copied, or used 129 129
inside your organization. 130 130
Now, because the NIST Cybersecurity Framework 131 131
is available for use by anyone for free, 132 132
it is an extremely valuable tool 133 133
that can give your organization 134 134
an instant return on their investment. 135 135
Over the past decade, doing business on the internet 136 136
has become an essential part of our global economy, 137 137
and it's a huge growth driver 138 138
for many organizations and businesses. 139 139
For example, my company, Dion Training, 140 140
is a relatively small business 141 141
with less than 20 team members. 142 142
But due to our ability to provide our courses online, 143 143
we're able to serve hundreds of thousands of students 144 144
every year using our certification training courses. 145 145
By using the internet, we're able to help a lot more people 146 146
than we ever could if we were doing this 147 147
in a traditional classroom setting. 148 148
These days, most businesses and organizations 149 149
have at least some sort of connectivity to the internet 150 150
as part of their business operations, 151 151
and it's really hard to think back 20 or 30 years ago 152 152
before everyone was using the internet 153 153
as part of their business. 154 154
The internet is now so ingrained 155 155
in our collective business processes 156 156
that it's hard to separate that out. 157 157
Now, unfortunately, this increased scale and connectivity 158 158
does have some downsides, 159 159
because organizations are more at risk 160 160
than they ever were before 161 161
because of the rapid rise of cyber criminals 162 162
and nation-state cyber soldiers. 163 163
Every year, we see more and larger data breaches 164 164
than we have in previous years, 165 165
as well as larger and higher bandwidth 166 166
distributed denial-of-service attacks 167 167
that are being attempted against our organizations. 168 168
This exploitation of cyber risks 169 169
is going to be involved with operating online, 170 170
and this is now causing 171 171
trillions of dollars in damages annually. 172 172
For example, if we look back just a few years to 2015, 173 173
the global cost of cyber failures 174 174
and attacks of all different kinds 175 175
was estimated to be around $500 billion. 176 176
Fast forward just six years to 2021, 177 177
and that cost has now risen to $6 trillion, 12 times more. 178 178
Experts are estimating that by 2024, just three years later, 179 179
this total will reach 180 180
$10 trillion or more annually in damages. 181 181
This is a staggering amount. 182 182
And if cyber risk was considered a global economy, 183 183
like the US or China is, 184 184
it would actually become the third largest global economy 185 185
in the entire world. 186 186
That's how much $10 trillion is. 187 187
These days, it isn't a matter 188 188
of if you're going to become a victim of a cyber attack. 189 189
It is really a matter of when and how bad it's going to become. 190 190
Unfortunately, running a business in a modern economy 191 191
does come with risk, 192 192
and a large portion of that risk 193 193
is going to be related to cyber activity. 194 194
So, our organizations need to be prepared 195 195
against these cyber risks. 196 196
And by using the NIST Cybersecurity Framework, 197 197
your organization can help figure out what defenses 198 198
and incident response capabilities they need to have 199 199
to be more resilient against cyber attacks 200 200
and be able to recover more quickly 201 201
if your organization does eventually become victimized. 202 202
This'll help you reduce the cost of the incident, 203 203
and minimize your downtime 204 204
and possible harm to your reputation. 205 205
For this reason, using the NIST Cybersecurity Framework 206 206
can really provide your organization with a lot of value 207 207
without having to allocate funding 208 208
for licensing or procurement 209 209
due to the public nature of the framework.