How the NIST cybersecurity framework can help secure the enterprise

The NIST cybersecurity framework can set expectations for the appropriate level of security

Now that the US National Institute of Standards and Technology has finalized the much-discussed cybersecurity framework, organizations can use it as the guideline for measuring how well their systems are secured.

One year ago, President Barack Obama directed NIST to develop a security framework that could be used as a guide to secure the country's cyberinfrastructure of basic vital services such as banking, transportation and telecommunications. Although the White House directed the development of the framework chiefly for measuring and mitigating risk in the country's cyberinfrastructure to protect airlines, roads and other vital aspects of the U.S. economy and well-being, it can be used by any organization.

Certainly, retailers that have been hit by cyberattacks, such as Target, could benefit from the framework.

To develop the framework, NIST consulted hundreds of experts in industry and reviewed feedback from thousands of additional contributors culled from multiple draft releases that were posted for review. In its final form, the framework offers a core set of activities to anticipate and mitigate against attacks on systems. It provides a set of measurements to assess to what degree an organization has implemented these core activities, which can be used as a gauge to assess how prepared the organization's systems are, in terms of being secured against an attack.

While some have criticized the 41-page framework as too vague to be of much value, it can offer a road map for organizations, some say.

The framework was written preliminarily for the higher levels of management, such as a boards of directors, chief security officers, audit committees, senior executives and others "working inside an organization who are responsible for different aspects of security and privacy," said Harriet Pearson, a partner in the Washington, D.C., office of Hogan Lovells, who was involved in the shaping of the framework.

It is a valuable indicator of what a standard of care should be, Pearson said: "A CSO might be wondering 'How do I know if I've done enough?'" The document provides a standard measure that organizations can agree on in terms of assessing risk assessment.

"While not technology specific, it points to the governance and action," Pearson said. "You don't have to use every part of the framework. It's more of the thought process."

"The framework does a really nice job of laying how organizations should apply a risk-based approach to improve security," said Andrew Wild, chief security officer of IT security firm Qualys.

Other frameworks do this as well, he pointed out, but the NIST's document is valuable in its brevity. "Someone can get a high level understanding of what is required," Wild said.

The document also includes references to other, more in-depth documents that provide more detailed instruction, such as the widely referenced Council on Cybersecurity's Critical Security Controls.

Nonetheless, Wild cautioned that the framework will not be a panacea for security issues. Most security officers already have a solid understanding of how their systems need to be secured. What they too often lack, Wild said, are the adequate resources.

Overall, cyber-infrastructure security won't be significantly improved until executive boards in organizations commit to providing more resources for risk management cybersecurity, Wild said. "How can the framework make an improvement if resources aren't provided?"

Joab Jackson covers enterprise software and general technology breaking news for The IDG News Service. Follow Joab on Twitter at @Joab_Jackson. Joab's e-mail address is Joab_Jackson@idg.com

Join the PC World newsletter!

Error: Please check your email address.

Tags National Institute of Standards and Technologysecurity

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Joab Jackson

IDG News Service
Show Comments

Essentials

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?