With cybersecurity incidents increasing on a global scale, and updated cybersecurity regulations, it’s imperative that organizations prioritize and improve their security posture. But, the path to building a cybersecurity program (much less implementing it) can appear long and taxing. So, where can you turn to get a straightforward set of standards and guidelines, regardless of where you are in your security journey? In this blog, we’ll introduce the NIST Cybersecurity Framework and explain why it’s a credible jumping off point for a SaaS data protection strategy and managing cybersecurity incidents.
NIST Cybersecurity overview
Published by the National Institute of Standards and Technology (NIST) in 2014 (and updated in 2018), the NIST Cybersecurity Framework (NIST CSF) is a living document for organizations to understand their cybersecurity risk, along with recommendations on how to amp up their protection and recovery efforts. The Framework is meant to serve as a uniform set of standards that can be used by any company, regardless of industry. While the Framework is voluntary, its well-established credentials make it a strong benchmark for cybersecurity posture assessment. It’s important to note that NIST's definition of a cybersecurity incident specifically refers to "availability" and "integrity", which relates directly to data loss (unavailability) and data corruption (loss of integrity).
Five functions of the NIST Cybersecurity Framework
The NIST CSF is composed of five high-level functions: Identify, Protect, Detect, Respond, and Recover, which we will unpack below:
Identify
The Identify function helps organizations determine their cybersecurity risk based on standard operations. Between physical and software assets, people, systems, data, and the business environment, there are many vulnerable areas for cybercriminals to take advantage of. With this information as a baseline, organizations can identify which processes and assets need protection and start building a risk management plan accordingly.
Protect
Taking the proper protection precautions should not be overlooked. According to the NIST CSF, the Protect function outlines ways to limit and manage a cybersecurity incident. This includes regular backups, managing access permissions to sensitive systems and assets, conducting awareness training for all staff members on cybersecurity threats, and performing regular maintenance to ensure that all protection systems are up to date.
Detect
Being able to spot cybersecurity risks comes with strong detection capabilities. The NIST CSF recommends regular monitoring of computers, devices, and software for any unauthorized access, along with a deeper dive into unusual network or staff activity. You should also identify if there have been unauthorized users or connections on your network. Within the Detect function, organizations can increase the chances that they discover cybersecurity incidents as they happen, which is crucial to extinguishing them.
Respond
With the uptick in cybersecurity incidents, your organization needs to know how to respond when (not if) an incident occurs. The NIST CSF believes that a proper plan should ensure business continuity, effective communication with law enforcement and external stakeholders about the event, and mitigating the impact of an incident. Keep in mind that these plans should be tested regularly; you don’t want to learn the shortcomings of your response tactics in a time when every minute counts.
Recover
Post-incident, it’s up to an organization to get back on its feet as quickly as possible. The Recover function of the NIST CSF says that organizations need to know how to restore systems and assets impacted by the cybersecurity incident and improve existing strategies based on what they learned from the incident. Recover also includes internal and external communication plans for how the cybersecurity incident will be conveyed, both during and following recovery.
Given that Recovery is such a critical component of a cybersecurity incident, NIST created a guide solely focused on recovery planning. NIST's Guide for Cybersecurity Event Recovery follows the CSF and describes Recovery in two phases: Tactical Recovery and Strategic Recovery. Tactical Recovery focuses on the immediate situation and uses the recovery playbook constructed before the incident, while Strategic Recovery is aimed at continuously improving an organization's readiness to manage future incidents.
The importance of the NIST Cybersecurity Framework
As cybersecurity incidents grow in volume and frequency, the NIST CSF helps you take an objective look at your protection decisions and investments and how you prioritize your security posture. Do your current processes and assets have adequate protection? Will your response techniques be enough when an incident strikes? Are you detecting a potential cybersecurity incident in a timely manner? If your answers have you questioning your current policies, NIST CSF can help. It can also inform, encourage, and shape conversations with stakeholders, who will have the ultimate say if plans become policy.
The NIST Cybersecurity Framework meets SaaS data
It’s no surprise that the NIST CSF has remained a trusted standard for building and maintaining a cybersecurity program. But, NIST CSF doesn’t provide specific guidance around particular types of infrastructure, like SaaS.
To bridge this gap, Own created the Data Recovery Readiness and Response (DR3™ ) cycle. DR3™ puts the five NIST CSF functions into a SaaS context to help organizations bolster and exercise SaaS data resiliency. While the NIST CSF applies to any industry, DR3™ is most relevant to financial services companies, insurance companies, healthcare providers, and life sciences and other organizations that must comply with regulations that require backup and recovery.
DR3™ also helps organizations mature their protection initiatives. As a cycle of continuous improvement, DR3™ recognizes that growing SaaS data means growing opportunities for loss and corruption, and therefore, protection measures require regular assessment.
This strategic phase, which aligns with the NIST Guide for Cybersecurity Event Recovery, includes Own Technical Account Managers (TAMs) performing a DR3™ Readiness Assessment with a customer to improve their DR3™ Maturity Level. It can also involve the Security and Governance team performing Security Risk Assessments (SRAs) and using Own Secure to fix the root cause of data recovery events, reducing the risk of occurrence in the future.
Eoghan Casey, Own’s Vice President of Cybersecurity Strategy & Product Development, recently discussed DR3™ at The London Enterprise Tech Meetup event ‘Ransomware! From Strategy to Reality’ on February 28, 2023. Casey conducted an audience-interactive tabletop exercise with other expert panelists, emphasizing the importance of preparation and establishing ransomware resilience. Key elements of resilience are having a well practiced response plan to manage a cybersecurity incident, and assessing the scope of damage and the reliability of backups to ensure that remediation and recovery operations are successful. This event highlighted how DR3™ can help organizations circumvent the damage of data loss and corruption in the cloud.
Want to learn how to get ahead of cybersecurity incidents involving SaaS data? Own has you covered.
