Now that we've covered the basics and some regulations
and compliance, let's dive into how it's all implemented.
We talked about business needs, whether you're small--
working with a small organization
or a large organization, it all comes down to business needs.
How do we implement them, though?
Fortunately, some organizations and governments
have put together some frameworks for us,
things that they either require or things
that we can start with.
We're going to go through these frameworks-- the ISO/IEC 27000
COBIT; NIST, a cybersecurity framework;
the CIS; the US government's CMMC, and the Australian's ASD.
So ISO/IEC 27000, it comes from the International Organization
for Standardization and the International Electrotechnical
Commission.
It's part of them.
Now, their guidelines are deliberately broad in scope.
They're covering more than just privacy and confidentiality
and cybersecurity issues.
It goes into a lot of different parts.
It's a large organization that covers a lot.
So the applicability to organizations
fits no matter the size of the organization, a big one
or a small one.
It's broken down into many different publications.
But the ISO 27001 is the requirements.
It's the basis.
It's the guidelines, really.
If you're going to follow something, follow these.
And then the 27002, it's a code of practice
for how you can implement those things, very useful, used
widely around the world, and by many organizations
and governments even.
Next one we'll cover is COBIT, Control Objectives
for Information Related Technologies.
Now COBIT, created by ISACA, it's
more than just IT management, IT governance.
It covers some business goals and generic processes
for the management of IT, not just cybersecurity.
So it's kind of a bigger picture.
And it's quite useful for many organizations.
The NIST Special Publication 800-53
comes from the National Institute
of Standards and Technology in the United States.
And the US government requires it .
It's a set of-- a catalog of security and privacy controls.
It's required for all US federal information systems
except those related to national security.
So internally developed by the government for the government,
but other people can utilize it as well.
Agencies are expected to be compliant with security
standards and guidelines.
And the 800-53 Bravo provides a set of baseline security
controls and privacy controls.
It's useful to look at, is the organization that we're
assessing, that we're working with,
are they following some baselines?
Are they following some security controls already?
Because that might tell us what we need to scope out,
how our feedback can be most useful,
what we should include in our reports,
and how we should base all this back to the customer.
The Center for Internet Security,
another non-profit organization, has
a set of 18 prioritized safeguards
to mitigate and prevent cyber-attacks.
They were the most prevalent cyber-attacks.
It takes a defense-in-depth model
to help prevent and detect malware.
And they have a free tool, as well, to self-assess.
Now, this is great because it's based around internet security
by an organization that looks at what
are the most prevalent attacks and then whips up
strategies that should be implemented
by any company that's trying to prevent those things.
It's fairly straightforward.
And it's really great that they have free products as well.
We'll get into another government organization.
the US Department of Defense has their cybersecurity maturity
model certification.
And it's on version 2 right now.
It's a training certification and third party assessment
program of cybersecurity in the United States government
Defense Industrial Base.
So anyone touching the DOD, or the Defense Department
in the grander scheme, or any company
who is working with the DOD have to comply by CMMC.
And they're required to have a third party
assessor verify their cybersecurity maturation level.
This is where we start getting into maturity.
There's five different levels and 17 different capability
domains.
Now this is useful because for the US government,
they have many different levels of--
or tiers of information, if you will,
different confidentiality levels and security levels.
So depending on the maturity of the organization,
they may or may not be able to touch or work
with information at those different security levels.
And this is quite useful because you
want your most prized, most important assets really secured
in this--
especially when you're talking about national defense
in the United States and other countries,
nation states that might be interested in that information.
So while level one is performed--
so that's the baseline, are they doing security?
Level five is optimizing.
Not only are they doing security,
but they're doing so in such a way
that they're coming up with the next baselines.
They're coming up with the newest
practices for the industry and for the global community
as well.
The Australians have their Australian Cyber Security
Centre and the Australian Signals Directorate.
And they came up with the Essential Eight.
It's a baseline and structure to help organizations protect
themselves against various cyber threats, developed
to help Australians.
But anyone could implement these.
Anyone can follow them.
And it's all available publicly.
Designed to protect Microsoft Windows-based
internet-connected networks, because that's
what they had most prevalently in their government.
And there's four different maturity levels.
Depending on the level, the implementation of these eight
security controls will vary.
Similar to the other model, a small, new organization who's
just getting started in cybersecurity needs
to at least implement.
And they'll build their way up to setting best
practices for the community.
But understanding where they're at, where they need to develop,
how they need to improve is also tied into these.
That's what's useful about a maturity model
in these frameworks is they not only know, OK,
what do we need to start doing now at our level?
But how can we get to the next level?
How can we not just be secure but be better?
So what?
Why does any of this matter?
Why are we covering this?
Why are we doing auditing fundamentals
in a pen testing course?
Because your pen test is going to all
lead back to the company, to the organization, to your customer.
You need to add value to them.
And they need to get something useful that they can then
implement in their organizations themselves
to mix into their risk management; to understand,
OK, maybe you're just recommending,
hey, do this, this, and this.
Well, what if that doesn't fit their risk-management style?
What if that doesn't match the framework
that they're working with?
Maybe that doesn't match their maturity level?
So you, maybe, could tier your recommendations.
You definitely should do this.
It's highly-- it's very severe.
And it is going to possibly--
most probably lead to you having a breach
and losing information.
You should probably also implement this.
You could implement that.
And I also recommend this other thing.
Tiering your recommendations and putting severity levels
is really important.
Understanding what they're already working with,
using language that they're familiar with
is crucial to adding the most value in your reports.
Now, let's take a step and, actually, how would we
implement some auditing?
We're going to get into pen testing.
But, first, let's look at how would you
even just do an audit?
How would they, without needing a pen test, get started?
So let's dive in.