Cybersecurity Framework Essay

No matter what an organization’s cybersecurity posture, it needs data on which to base its security decisions. However, lack of data and uncertainty about the data frequently inhibit sound corporate decisionmaking. One significant problem is the lack of standards in defining, tracking, and reporting security incidents and attacks.

Another step involves security checks upon implementation and describes agency-level threat to the business scenario or the mission. It similarly entails sanctioning the information system for processing and lastly constant monitoring of the security controls. FISMA and NIST's standards are aimed at offering the ways for agencies to achieve their identified missions with safety commensurate with the threat (United States Department of Agriculture, 2015). Together with guidelines from the Office of Management and Budget (OMB), FISMA and NIST create a framework for advancing and growing an information security scheme (SecureIT, 2008). Such framework includes control descriptions and evaluation, program development, and system certification and accreditation. The final objective involves conducting daily functioning of the agency and achieving the agency's articulated objectives with sufficient security commensurate with risk.

H.R. 1731, the National Cybersecurity Protection Advancement (NCPA) Act, is bipartisan bill passed unanimously by the Committee on Homeland Security. This pro-privacy, pro-security bill ensures the sharing of cyber threats is transparent and timely. It strengthens the NCCIC’s role as the lead civilian interface for cyber threat information sharing by: Providing liability protections for the voluntary sharing of cyber threat indicators and defensive measures with the NCCIC or private-to-private. Granting liability protections for private companies to conduct network awareness of their own information systems. Allowing companies to operate defensive measures and conduct network awareness on information systems they own or operate. The NCPA Act also ensures personal information

Among one of the missions of The U.S. Department of Homeland Security is to protect and preserve the security of the Cyberspace in the country. The principal objective of this Security Plan is to give instructions and direction for the Department’s workers and help the Homeland Security to create best practices and strategies in the IT security system.

The EO13636 chief objective is to improve the Cybersecurity Framework of principles and determine what the best practices are that may possibly be taken to decrease the threat from all cyber dangers. Under EO13636, The Department of Homeland Security (DHS), National Security Staff, and The Office of Management and Budget (OMB) will coordinate with additional investors to advance the Cybersecurity Framework. National Institute of Standards and Technology executives are asking that everyone who is involved take an active role in the development of this Framework (Fischer et al., 2013)

Cybersecurity is very important today for every company, business, enterprise, agency, and even the government. The National Institute of Standards and Technology (NIST) has developed a cybersecurity framework to help companies to comply with standards, measurements, and technology to enhance economic security (NIST.gov). NIST 's cybersecurity framework is made of thee basic elements such as Framework core, framework

This paper is to recommend that the Department of Homeland Security’s National Cybersecurity Protection System be fully implemented into all civilian and government systems without predetermined search criteria, or “signatures”.

When it comes to the protection and mitigating of any structure or organization risk analysis and vulnerability assessments must be conducts so as to know what’s to be protected, the threats manmade or natural disaster, ranking the potential of threat as well as the probability. In terms of critical infrastructure the risk analysis and vulnerability assessment has guidelines from Homeland Security Presidential Directive Number 7(HSPD-7).

The Department of Homeland Security (DHS) is Incharge of shielding our country’s crucial infrastructure from physical and cyber dangers. Of the varied kinds of infrastructure, cyberspace is crucial constituting the information regarding the government and business operations, crisis management and readiness information, and our crucial digital and process control systems. Safeguarding these critical resources and infrastructure is

49). In order for all of the leaders of the different infrastructures to be successful at eliminating or mitigating such attacks they will need a common form of communication as all of their systems have been proven to affect each other. One tool to help eliminate such communication barriers is the National Incident Management System (NIMS). This system “is a standardized management plan that provides a core set of concepts for incident command and multi-agency coordination during emergency response” (Kamien, 2012, p. 486). With such systems as NIMS the government realized that no one system can work without the other and if one fails they all fail causing wide spread panic and various other hurdles for emergency responders to respond to. It is up to the government to realize that our world is no longer ran manually, but rather digitally so that we can better prepare for possible cyber attacks on our key critical infrastructures.

I would like to consider Healthcare organization in this case study. It is an organization that handles electronic health information and patient privacy. Thus, the organization needs to be able to safeguard personal health information which is usually faced with the various attacks. Within this context, the healthcare organization can implement the NIPP (National Infrastructure Protection Plan). The NIPP offers the unifying structure for the integration of existing and future critical infrastructure security and resilience efforts into a single national program. (NICCS, 2017) NIPP allows delivering a coordinated approach that will be used to establish national priorities, goals, and requirements in order to ensure that funding and assets are

Security Officers must obtain a consensus for which mitigating controls are key, which can be a trying negotiation between the CISO, Chief Technology Officer, Cyber Threat Intelligence (CTI), Infrastructure Engineering, Audit and Assurance teams, and the Investment and Audit committees. How do you harness your entire organization to focus on a common agreed-upon list of key security controls?

The framework profiles define the set of baseline activities an organization is currently using and the desired or target capabilities they would like to achieve. The tiers facilitate the gap analysis process, which leads to a tiered implementation for cybersecurity protection. The tiers provide a context for agencies to better understand their cybersecurity risk-management practices and to rate them.

Good security management requires risk management to mitigate or reduce risk to an acceptable level within an organization. Security management’s objective is to protect the company and its assets. A proper risk analysis will identify the company’s major assets, threats that put those assets at risk, and estimate the possible damage and loss a company may endure if any of the threats were to become real. With a good risk analysis, management can determine the type of budget they want to set to mitigate threats. Risk analysis justifies the cost of the countermeasures against the threats and determines the benefit or worth of security

The purpose for an IT security policy is to provide “strategy, policy, and standards regarding the security of and operations in cyberspace, and encompasses the full range of threat reduction, vulnerability reduction, deterrence, international engagement, incident response, resiliency, and recovery policies and activities, including computer network operations, information assurance, law enforcement, diplomacy, military, and intelligence missions as they relate to the security and stability of the global information and communications infrastructure” ("Cyberspace policy RevIew", 2016).