Before we finish up, let's talk a little about cyber risk management,
including the importance of a cybersecurity strategy and
developing an effective cybersecurity posture.
The bad news is that there are lots of bad people out there,
but the good news is they're not all targeting you.
It is therefore important that you focus on those threats that are
likely to affect your organization and its operations. In that
regard, all cybersecurity activities,
including assurance of the security posture,
should be intelligence‑led. Understand the threat
actors that are targeting your business,
your sector, your region or country, and know the tools,
techniques, and procedures they employ to achieve their objectives.
Despite what we've seen in this course, Modbus is not the problem.
Once the threat is understood,
you should determine the potential impact to your
industrial control systems and operational technology if
they are subject to a cyberattack.
Understanding the threat and the impact to industrial operations allows the
inherent risk to your organization from cyberattack to be determined.
Organizations pursuing cyber resilience need their senior stakeholders to
proactively manage cyber risk alongside other enterprise risks. Leaders set
the organizational intent in a cybersecurity strategy, the strategy identifies
threats to the organization, and describes organizational cyber risk appetite
and risk tolerance.
The cybersecurity strategy also describes the outcomes that
are to be delivered, outcomes which are consistent with and
proportionate to the risk appetite.
These will likely be high‑level statements reflecting the degree of
confidence there should be in the ability of cybersecurity controls
to protect against and detect an attack.
Similar statements may be made about how quickly a response should be made to
interrupt or defeat a cyberattack. Knowing what outcome needs to be achieved
enables cybersecurity professionals to design and develop technical and
procedural controls that ensure the outcomes are met,
thereby ensuring that cyber risk remains within risk appetite.
Let's look at developing an effective cybersecurity posture in more detail.
There are many models,
frameworks, and standards that establish principles for effective cybersecurity,
but in general, they coalesce around the five functions of the NIST
cybersecurity framework. The functions are the highest level of abstraction
included in the framework and act as the backbone of the framework core that
all other elements are organized around.
The first function is Identify. This is about ensuring an
organization has appropriate structures,
policies, and processes in place to understand, assess, and manage
security risks. Understanding the business context,
the resources that support critical functions, and the
related cybersecurity risks enables an organization to
focus and prioritize its efforts.
Examples of good practice in the Identify function include the establishment
of an overall organizational approach to risk management,
identifying and understanding the systems and services that are required
to maintain or support critical industrial operations, and the
identification, assessment, and understanding of security risks that
arise from dependencies on external suppliers.
The Protect function establishes proportionate security measures to
ensure delivery of critical infrastructure services.
The Protect function also supports the ability to limit or contain
the impact of a potential cybersecurity event.
Examples of good practice in the Protect function include defining and
communicating organizational policies and processes to secure systems and
data that support the operation of critical systems,
controlling access to critical systems,
protecting stored or electronically transmitted data from
actions that might adversely impact industrial operations, and
building resilience against cyberattack.
The Detect function describes the range of activities needed
to identify cybersecurity events affecting or with the
potential to affect critical operations.
The Detect function enables timely discovery of cybersecurity events.
There should also be standards,
procedures, and arrangements to ensure security defenses remain effective.
Examples of good practice in the Detect function include monitoring to detect
potential security events and track the effectiveness of existing security
measures and the detection of anomalous events in critical networks and
systems that support industrial operations.
The Respond function includes the activities to be undertaken to
minimize the adverse impact of a cybersecurity incident on the operation
of critical systems and to support the ability to contain the impact of
a potential cybersecurity incident.
The Recover function identifies appropriate activities to maintain
plans for resilience and to restore critical systems and services that
were impacted by the cybersecurity incident.
The Recover function supports timely recovery to normal operations to
reduce the impact from a cybersecurity incident.
Examples of good practice in the Respond and Recover functions include
putting suitable incident management and mitigation processes in place
and learning from incidents to improve the resilience of critical
systems and services. Effective cybersecurity requires that each of
these functions makes a proportionate contribution to the overall
security regime.
If one function is deficient, then it puts greater strain on the other functions,
and the effectiveness of the entire security posture is diminished.