How the NIST cybersecurity framework can help secure the enterprise

The NIST cybersecurity framework can set expectations for the appropriate level of security

Now that the US National Institute of Standards and Technology has finalized the much-discussed cybersecurity framework, organizations can use it as the guideline for measuring how well their systems are secured.

One year ago, President Barack Obama directed NIST to develop a security framework that could be used as a guide to secure the country's cyberinfrastructure of basic vital services such as banking, transportation and telecommunications. Although the White House directed the development of the framework chiefly for measuring and mitigating risk in the country's cyberinfrastructure to protect airlines, roads and other vital aspects of the U.S. economy and well-being, it can be used by any organization.

Certainly, retailers that have been hit by cyberattacks, such as Target, could benefit from the framework.

To develop the framework, NIST consulted hundreds of experts in industry and reviewed feedback from thousands of additional contributors culled from multiple draft releases that were posted for review. In its final form, the framework offers a core set of activities to anticipate and mitigate against attacks on systems. It provides a set of measurements to assess to what degree an organization has implemented these core activities, which can be used as a gauge to assess how prepared the organization's systems are, in terms of being secured against an attack.

While some have criticized the 41-page framework as too vague to be of much value, it can offer a road map for organizations, some say.

The framework was written preliminarily for the higher levels of management, such as a boards of directors, chief security officers, audit committees, senior executives and others "working inside an organization who are responsible for different aspects of security and privacy," said Harriet Pearson, a partner in the Washington, D.C., office of Hogan Lovells, who was involved in the shaping of the framework.

It is a valuable indicator of what a standard of care should be, Pearson said: "A CSO might be wondering 'How do I know if I've done enough?'" The document provides a standard measure that organizations can agree on in terms of assessing risk assessment.

"While not technology specific, it points to the governance and action," Pearson said. "You don't have to use every part of the framework. It's more of the thought process."

"The framework does a really nice job of laying how organizations should apply a risk-based approach to improve security," said Andrew Wild, chief security officer of IT security firm Qualys.

Other frameworks do this as well, he pointed out, but the NIST's document is valuable in its brevity. "Someone can get a high level understanding of what is required," Wild said.

The document also includes references to other, more in-depth documents that provide more detailed instruction, such as the widely referenced Council on Cybersecurity's Critical Security Controls.

Nonetheless, Wild cautioned that the framework will not be a panacea for security issues. Most security officers already have a solid understanding of how their systems need to be secured. What they too often lack, Wild said, are the adequate resources.

Overall, cyber-infrastructure security won't be significantly improved until executive boards in organizations commit to providing more resources for risk management cybersecurity, Wild said. "How can the framework make an improvement if resources aren't provided?"

Joab Jackson covers enterprise software and general technology breaking news for The IDG News Service. Follow Joab on Twitter at @Joab_Jackson. Joab's e-mail address is Joab_Jackson@idg.com

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags National Institute of Standards and Technologysecurity

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Joab Jackson

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?