Instructor: In this lesson, we'll be talking 2 2
about step seven in the real world. 3 3
Step seven is the monitor step. 4 4
The purpose of the monitor step 5 5
is to maintain ongoing situational awareness 6 6
about the security and privacy posture of the system 7 7
and organization to support risk management decisions. 8 8
When we look at the monitor step, 9 9
we are really focused on five main outcomes. 10 10
First, the system and environment 11 11
of operation is going to be monitored 12 12
in accordance with the continuous monitoring strategy. 13 13
Second, ongoing assessments 14 14
of control effectiveness are conducted 15 15
in accordance with the continuous monitoring strategy. 16 16
Third, the output of continuous monitoring activities 17 17
is analyzed and responded to. 18 18
Fourth, there's a process in place 19 19
to report security and privacy posture to your management. 20 20
And fifth, ongoing authorizations are conducted 21 21
using the results of continuous monitoring activities. 22 22
So as you can see, when it comes to step seven, 23 23
we are really focused on this whole idea 24 24
of monitoring to be able to continuously monitor 25 25
your controls that have been implemented 26 26
earlier on in the RMF process. 27 27
This means we understand all of the risk 28 28
to our system and we understand 29 29
what controls we put in place 30 30
and we're verifying those controls 31 31
remain effective against those different risks. 32 32
At this point in the risk management framework process, 33 33
you're basically doing all the work 34 34
of a cybersecurity analyst to make sure 35 35
your risk controls are meeting the need 36 36
and giving you the desired outcome 37 37
that you're trying to achieve. 38 38
This makes sure that people aren't breaking 39 39
into your network and that everything 40 40
is working properly and if it's not, 41 41
you want to be able to catch that, 42 42
go ahead and figure out what's going wrong, 43 43
and what risks are being realized, 44 44
and then you could select new controls 45 45
to mitigate those risks and implement 46 46
those controls by going back to step three 47 47
by selecting your controls and going into step four 48 48
to implement those controls. 49 49
This is really what we're focused 50 50
on by doing this all in a continuous manner. 51 51
Now, when it comes to RMF and specifically step seven, 52 52
this is where you really want to pair RMF 53 53
with the NIST cybersecurity framework. 54 54
Because the NIST cybersecurity framework 55 55
is really focused on the life cycle of an incident. 56 56
And so this whole idea of monitoring 57 57
is really useful as it ties 58 58
from the risk management framework 59 59
into the NIST cybersecurity framework. 60 60
If you look at the NIST cybersecurity framework, 61 61
it really is a five step process 62 62
that focuses on identification, 63 63
protection, detection, response, 64 64
and recovery from a given incident. 65 65
Now, when you're looking 66 66
at the NIST cybersecurity framework, 67 67
the first step is that identification step. 68 68
This really links to steps one and two 69 69
inside the risk management framework 70 70
of prepare and categorize, 71 71
because we're going to see what our systems are, 72 72
and what type of data they're holding and processing. 73 73
Then we move into the second step 74 74
of the NIST cybersecurity framework, 75 75
which is protection. 76 76
When we're in the protection step, 77 77
we are really focused on selecting our controls 78 78
and then implementing those controls 79 79
and assessing those controls. 80 80
By doing all of that 81 81
we are really looking at steps three, 82 82
four, and five of the risk management framework. 83 83
Then if we move into step three 84 84
of the NIST cybersecurity framework, 85 85
we are looking at the detection stage. 86 86
This really links to step seven 87 87
of the risk management framework, 88 88
where you are monitoring all 89 89
of your controls and seeing how effective they are. 90 90
If you're monitoring a control and you see 91 91
that somebody has broken that control, 92 92
this means that you now have detected 93 93
some kind of an incident and you would move 94 94
into the instant response part 95 95
of the NIST cybersecurity framework, 96 96
moving from step three of detection 97 97
into steps four and five of response and recovery. 98 98
Now, you may have noticed 99 99
that the risk management framework, step six, 100 100
which is the authorization step, 101 101
wasn't really covered as part 102 102
of the NIST cybersecurity framework. 103 103
And the reason for that 104 104
is the NIST cybersecurity framework tends 105 105
to be used as an ongoing daily basis type of thing, 106 106
whereas the risk management framework 107 107
is more of a one time setup 108 108
when you're going through steps one through six 109 109
and getting that authorization to operate or ATO. 110 110
Once you've done that and you move into step seven, 111 111
that really is where you're focusing on steps three, 112 112
four, and five of the NIST cybersecurity framework 113 113
with detection, response, and recovery. 114 114
So I know I covered that pretty quickly 115 115
in terms of the NIST cybersecurity framework, 116 116
and the reason for that is because we already 117 117
have an entire course dedicated 118 118
to the NIST cybersecurity framework. 119 119
So if you want to learn more 120 120
about implementing the NIST cybersecurity framework, 121 121
I recommend you join our course called 122 122
"Implementing the NIST Cybersecurity Framework," 123 123
which really focuses on each of those five steps 124 124
in depth and covers multiple hours worth of information. 125 125
So you can apply the NIST cybersecurity framework 126 126
in your own organization 127 127
and it comes with everything you need, 128 128
including templates on how to implement it 129 129
in the real world. 130 130
(electronic tone buzzing)