Taking the Temperature on AI’s Impact on Cybersecurity in 2024

A cornucopia of infosec insights to chew on these Holidays. In this episode, we carve up concerns around increased specialization and silos forming between red, SecOps, and compliance teams. How can we foster collaboration across the table? What creative recipes can blend different tools into a unified platform? And how can enterprises and SMBs alike ensure all voices are heard before the tryptophan kicks in? 

Please pull up a chair and fill your plate with our expert insights from Mark Holtz (Software Engineering at Socotra) and Jeremy Embalabala (CISO at Hub International Limited).

Continue reading

NIST CSF 2.0: Making CISO’s Lives Easier with the New Govern Function

The National Institute of Standards and Technology (NIST) has recently unveiled Cybersecurity Framework 2.0 (CSF 2.0), marking a significant advancement in cybersecurity risk governance practices. This updated framework, developed through extensive collaboration among industry leaders, academics, and government agencies worldwide, introduces transformative changes that are poised to revolutionize cybersecurity programs and strategies.

Why do CISOs struggle with governance and how NIST CSF 2.0 helps?

Despite the relentless efforts of cybersecurity leaders to navigate the evolving landscape of cyber threats and mitigate risks, chief information security officers (CISOs) have long grappled with a fundamental deficiency in their cybersecurity management toolkit. The lack of structured oversight and top-level support often leaves them struggling to discern critical priorities amidst the wide and evolving scope of their responsibilities. The introduction of the Govern function marks a significant milestone for CISOs, representing a recognition of their indispensable role in the cybersecurity domain. This addition bridges gaps in their management approach, offering a lifeline for navigating the complexities of their roles with greater clarity and effectiveness. In essence, the Govern function represents more than just an incremental addition—it provides some relief in the realm of cybersecurity management. Looking at the Categories and Subcategories in the Govern function, it can easily be recognized that these are of utmost importance for effective cybersecurity management:

“GOVERN (GV) — The organization’s cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored. The GOVERN Function provides outcomes to inform what an organization may do to achieve and prioritize the outcomes of the other five Functions in the context of its mission and stakeholder expectations. Governance activities are critical for incorporating cybersecurity into an organization’s broader enterprise risk management (ERM) strategy. GOVERN addresses an understanding of organizational context; the establishment of cybersecurity strategy and cybersecurity supply chain risk management; roles, responsibilities, and authorities; policy; and the oversight of cybersecurity strategy.”

By fostering a culture of governance, organizations can effectively address regulatory challenges and mitigate emerging cyber security risks, thereby ensuring robust cyber defenses at all levels.

Additional Resources

In response to extensive feedback received during the drafting phase, NIST has broadened the core guidance of CSF 2.0 and developed supplementary resources to facilitate users’ adoption of the framework. These resources are tailored to different user groups, providing customized pathways into CSF and simplifying its implementation. It places a newfound emphasis on governance, underscoring the importance of informed decision-making in cybersecurity strategy at all levels of an organization.

To facilitate adoption, CSF 2.0 offers a variety of implementation examples and quick-start guides tailored to specific user profiles, such as small businesses and enterprise risk managers. Cybersecurity priorities are driven by strategic objectives, laws, regulations, and risk responses; integrating cybersecurity risk management with overall enterprise risk management significantly adds to both the alignment of the cybersecurity objectives with business objectives, and efficiency in making sound risk management decisions.

Looking at how NIST CSF 2.0 can help enterprise risk managers, as an example, this can be achieved by setting the target profile of the organization to align with GV.OC-01 (“The organizational mission is understood and informs cybersecurity risk management”), GV.OC-02 (“Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered”) and other relevant Govern subcategories.

Additionally, the newly introduced CSF 2.0 Reference Tool simplifies implementation processes. The framework also includes a searchable catalog of references, aiding organizations in aligning their actions with CSF guidance and referencing other cybersecurity documents, including those from NIST and ISO/IEC.

All information relevant to the new NIST CSF 2.0 can be found at: https://www.nist.gov/cyberframework

Author