M2-Security-frameworks-and-controls.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## The relationship between frameworks and controls\n",
    "\n",
    "Previously, you learned how organizations use security frameworks and controls to protect against threats, risks, and vulnerabilities. This included discussions about the National Institute of Standards and Technology’s (NIST’s) Risk Management Framework (RMF) and Cybersecurity Framework (CSF), as well as the confidentiality, integrity, and availability (CIA) triad. In this reading, you will further explore security frameworks and controls and how they are used together to help mitigate organizational risk.\n",
    "\n",
    "### Frameworks and controls\n",
    "\n",
    "Security frameworks are guidelines used for building plans to help mitigate risk and threats to data and privacy. Frameworks support organizations’ ability to adhere to compliance laws and regulations. For example, the healthcare industry uses frameworks to comply with the United States’ Health Insurance Portability and Accountability Act (HIPAA), which requires that medical professionals keep patient information safe. \n",
    "\n",
    "Security controls are safeguards designed to reduce specific security risks. Security controls are the measures organizations use to lower risk and threats to data and privacy. For example, a control that can be used alongside frameworks to ensure a hospital remains compliant with HIPAA is requiring that patients use multi-factor authentication (MFA) to access their medical records. Using a measure like MFA to validate someone’s identity is one way to help mitigate potential risks and threats to private data.\n",
    "\n",
    "#### Specific frameworks and controls\n",
    "\n",
    "There are many different frameworks and controls that organizations can use to remain compliant with regulations and achieve their security goals. Frameworks covered in this reading are the Cyber Threat Framework (CTF) and the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001. Several common security controls, used alongside these types of frameworks, are also explained. \n",
    "\n",
    "##### Cyber Threat Framework (CTF)\n",
    "\n",
    "According to the Office of the Director of National Intelligence, the CTF was developed by the U.S. government to provide “a common language for describing and communicating information about cyber threat activity.” By providing a common language to communicate information about threat activity, the CTF helps cybersecurity professionals analyze and share information more efficiently. This allows organizations to improve their response to the constantly evolving cybersecurity landscape and threat actors' many tactics and techniques.\n",
    "\n",
    "##### International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001\n",
    "\n",
    "An internationally recognized and used framework is ISO/IEC 27001. The ISO 27000 family of standards enables organizations of all sectors and sizes to manage the security of assets, such as financial information, intellectual property, employee data, and information entrusted to third parties. This framework outlines requirements for an information security management system, best practices, and controls that support an organization’s ability to manage risks. Although the ISO/IEC 27001 framework does not require the use of specific controls, it does provide a collection of controls that organizations can use to improve their security posture. \n",
    "\n",
    "### Controls\n",
    "\n",
    "Controls are used alongside frameworks to reduce the possibility and impact of a security threat, risk, or vulnerability. Controls can be physical, technical, and administrative and are typically used to prevent, detect, or correct security issues.\n",
    "\n",
    "Examples of physical controls:\n",
    "- Gates, fences, and locks\n",
    "- Security guards\n",
    "- Closed-circuit television (CCTV), surveillance cameras, and motion detectors\n",
    "- Access cards or badges to enter office spaces\n",
    "\n",
    "Examples of technical controls:\n",
    "- Firewalls\n",
    "- MFA\n",
    "- Antivirus software\n",
    "\n",
    "Examples of administrative controls:\n",
    "- Separation of duties\n",
    "- Authorization\n",
    "- Asset classification\n",
    "\n",
    "To learn more about controls, particularly those used to protect health-related assets from a variety of threat types, review the U.S. Department of Health and Human Services’ Physical Access Control presentation\n",
    " \n",
    "## Key takeaways\n",
    "\n",
    "Cybersecurity frameworks and controls are used together to establish an organization’s security posture. They also support an organization’s ability to meet security goals and comply with laws and regulations. Although these frameworks and controls are typically voluntary, organizations are strongly encouraged to implement and use them to help ensure the safety of critical assets."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Use the CIA triad to protect organizations\n",
    "\n",
    "Previously, you were introduced to the confidentiality, integrity, and availability (CIA) triad and how it helps organizations consider and mitigate risk. In this reading, you will learn how cybersecurity analysts use the CIA triad in the workplace. \n",
    "\n",
    "### The CIA triad for analysts\n",
    "\n",
    "The CIA triad is a model that helps inform how organizations consider risk when setting up systems and security policies. It is made up of three elements that cybersecurity analysts and organizations work toward upholding: confidentiality, integrity, and availability. Maintaining an acceptable level of risk and ensuring systems and policies are designed with these elements in mind helps establish a successful security posture, which refers to an organization’s ability to manage its defense of critical assets and data and react to change. \n",
    "\n",
    "#### Confidentiality\n",
    "\n",
    "Confidentiality is the idea that only authorized users can access specific assets or data. In an organization, confidentiality can be enhanced through the implementation of design principles, such as the principle of least privilege. The principle of least privilege limits users' access to only the information they need to complete work-related tasks. Limiting access is one way of maintaining the confidentiality and security of private data. \n",
    "\n",
    "#### Integrity\n",
    "\n",
    "Integrity is the idea that the data is verifiably correct, authentic, and reliable. Having protocols in place to verify the authenticity of data is essential. One way to verify data integrity is through cryptography, which is used to transform data so unauthorized parties cannot read or tamper with it (NIST, 2022). Another example of how an organization might implement integrity is by enabling encryption, which is the process of converting data from a readable format to an encoded format. Encryption can be used to prevent access and ensure data, such as messages on an organization's internal chat platform, cannot be tampered with.  \n",
    "\n",
    "#### Availability\n",
    "\n",
    "Availability is the idea that data is accessible to those who are authorized to use it. When a system adheres to both availability and confidentiality principles, data can be used when needed. In the workplace, this could mean that the organization allows remote employees to access its internal network to perform their jobs. It’s worth noting that access to data on the internal network is still limited, depending on what type of access employees need to do their jobs. If, for example, an employee works in the organization’s accounting department, they might need access to corporate accounts but not data related to ongoing development projects. \n",
    "\n",
    "## Key takeaways\n",
    "\n",
    "The CIA triad is essential for establishing an organization’s security posture. Knowing what it is and how it’s applied can help you better understand how security teams work to protect organizations and the people they serve. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "![image](https://github.com/user-attachments/assets/25e855e4-371d-4f7b-b8d0-e71c2098a0c9)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## NIST Cybersecurity Framework (CSF)\n",
    "A voluntary framework that consists of standards, guidelines and best practices to manage cybersecurity risk.\n",
    "\n",
    "![image](https://github.com/user-attachments/assets/ca6dff03-658f-41c3-82a8-401cd37a948e)\n",
    "\n",
    "- **identify**, which is related to the management of\n",
    "cybersecurity risk and its effect on an organization's people and assets. For example, as a security analyst, you may be asked to monitor systems and devices in your organization's internal network to identify potential security issues. For example, as a security analyst, you and your team might encounter new and unfamiliar threats and attacks.\n",
    "For this reason, studying historical data and making improvements to policies and procedures is essential. \n",
    "\n",
    "- **protect**, which is the strategy used to protect an organization through the implementation of policies, procedures, training,\n",
    "and tools that help mitigate cybersecurity threats. \n",
    "\n",
    "- **detect**, which means identifying potential security incidents and improving monitoring capabilities to increase the speed and efficiency of detections. For example, as an analyst, you might be asked to review\n",
    "a new security tool's setup to make sure it's flagging low, medium, or high risk, and then alerting the security team about any potential threats or incidents. \n",
    "\n",
    "- **respond**, which means making sure that the proper procedures are used to contain, neutralize, and analyze security incidents, and implement improvements to the security process. \n",
    "\n",
    "- **recover**, which is the process of returning affected systems back to normal operation. For example, as an entry-level security analyst, you might work with your security team to restore systems,\n",
    "data, and assets, such as financial or legal files, that have been affected by an incident like a breach. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## More about OWASP security principles\n",
    "Previously, you learned that cybersecurity analysts help keep data safe and reduce risk for an organization by using a variety of security frameworks, controls, and security principles. In this reading, you will learn about more Open Web Application Security Project, recently renamed Open Worldwide Application Security Project® (OWASP), security principles and how entry-level analysts use them. \n",
    "\n",
    "### Security principles\n",
    "In the workplace, security principles are embedded in your daily tasks. Whether you are analyzing logs, monitoring a security information and event management (SIEM) dashboard, or using a vulnerability scanner, you will use these principles in some way. \n",
    "\n",
    "Previously, you were introduced to several OWASP security principles. These included:\n",
    "- **Minimize attack surface area**: Attack surface refers to all the potential vulnerabilities a threat actor could exploit.\n",
    "- **Principle of least privilege**: Users have the least amount of access required to perform their everyday tasks.\n",
    "- **Defense in depth**: Organizations should have varying security controls that mitigate risks and threats.\n",
    "- **Separation of dutie**s: Critical actions should rely on multiple people, each of whom follow the principle of least privilege. \n",
    "- **Keep security simple**: Avoid unnecessarily complicated solutions. Complexity makes security difficult. \n",
    "- **Fix security issues correctly**: When security incidents occur, identify the root cause, contain the impact, identify vulnerabilities, and conduct tests to ensure that remediation is successful.\n",
    "\n",
    "### Additional OWASP security principles\n",
    "Next, you’ll learn about four additional OWASP security principles that cybersecurity analysts and their teams use to keep organizational operations and people safe.\n",
    "\n",
    "#### Establish secure defaults\n",
    "This principle means that the optimal security state of an application is also its default state for users; it should take extra work to make the application insecure. \n",
    "\n",
    "#### Fail securely\n",
    "Fail securely means that when a control fails or stops, it should do so by defaulting to its most secure option. For example, when a firewall fails it should simply close all connections and block all new ones, rather than start accepting everything.\n",
    "\n",
    "#### Don’t trust services\n",
    "Many organizations work with third-party partners. These outside partners often have different security policies than the organization does. And the organization shouldn’t explicitly trust that their partners’ systems are secure. For example, if a third-party vendor tracks reward points for airline customers, the airline should ensure that the balance is accurate before sharing that information with their customers.\n",
    "\n",
    "#### Avoid security by obscurity\n",
    "The security of key systems should not rely on keeping details hidden. Consider the following example from OWASP (2016): OWASP Mobile Top 10 The security of an application should not rely on keeping the source code secret. Its security should rely upon many other factors, including reasonable password policies, defense in depth, business transaction limits, solid network architecture, and fraud and audit controls.\n",
    "\n",
    "## Key takeaways\n",
    "Cybersecurity professionals are constantly applying security principles to safeguard organizations and the people they serve. As an entry-level security analyst, you can use these security principles to promote safe development practices that reduce risks to companies and users alike. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## More about security audits\n",
    "Previously, you were introduced to how to plan and complete an internal security audit. In this reading, you will learn more about security audits, including the goals and objectives of audits. \n",
    "\n",
    "### Security audits\n",
    "A security audit is a review of an organization's security controls, policies, and procedures against a set of expectations. Audits are independent reviews that evaluate whether an organization is meeting internal and external criteria. Internal criteria include outlined policies, procedures, and best practices. External criteria include regulatory compliance, laws, and federal regulations. \n",
    "Additionally, a security audit can be used to assess an organization's established security controls. As a reminder, security controls are safeguards designed to reduce specific security risks. \n",
    "Audits help ensure that security checks are made (i.e., daily monitoring of security information and event management dashboards), to identify threats, risks, and vulnerabilities. This helps maintain an organization’s security posture. And, if there are security issues, a remediation process must be in place.\n",
    "\n",
    "#### Goals and objectives of an audit\n",
    "The goal of an audit is to ensure an organization's information technology (IT) practices are meeting industry and organizational standards. The objective is to identify and address areas of remediation and growth. Audits provide direction and clarity by identifying what the current failures are and developing a plan to correct them. \n",
    "Security audits must be performed to safeguard data and avoid penalties and fines from governmental agencies. The frequency of audits is dependent on local laws and federal compliance regulations.\n",
    "\n",
    "#### Factors that affect audits\n",
    "Factors that determine the types of audits an organization implements include: \n",
    "- Industry type\n",
    "- Organization size\n",
    "- Ties to the applicable government regulations\n",
    "- A business’s geographical location\n",
    "- A business decision to adhere to a specific regulatory compliance\n",
    "\n",
    "To review common compliance regulations that different organizations need to adhere to, refer to the reading about controls, frameworks, and compliance.\n",
    "\n",
    "#### The role of frameworks and controls in audits\n",
    "Along with compliance, it’s important to mention the role of frameworks and controls in security audits. Frameworks such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the international standard for information security (ISO 27000) series are designed to help organizations prepare for regulatory compliance security audits. By adhering to these and other relevant frameworks, organizations can save time when conducting external and internal audits. Additionally, frameworks, when used alongside controls, can support organizations’ ability to align with regulatory compliance requirements and standards.  "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "There are three main categories of controls to review during an audit, which are administrative and/or managerial, technical, and physical controls. \n",
    "\n",
    "## Control categories\n",
    "Controls within cybersecurity are grouped into three main categories:\n",
    "- Administrative/Managerial controls\n",
    "- Technical controls\n",
    "- Physical controls\n",
    " \n",
    "Administrative/Managerial controls address the human component of cybersecurity. These controls include policies and procedures that define how an organization manages data and clearly defines employee responsibilities, including their role in protecting the organization. While administrative controls are typically policy based, the enforcement of those policies may require the use of technical or physical controls. \n",
    "\n",
    "Technical controls consist of solutions such as firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), antivirus (AV) products, encryption, etc. Technical controls can be used in a number of ways to meet organizational goals and objectives.\n",
    "\n",
    "Physical controls include door locks, cabinet locks, surveillance cameras, badge readers, etc. They are used to limit physical access to physical assets by unauthorized personnel. \n",
    "\n",
    "### Control types\n",
    "Control types include, but are not limited to:\t\n",
    "1.\tPreventative\n",
    "2.\tCorrective\n",
    "3.\tDetective\n",
    "4.\tDeterrent\n",
    "\n",
    "These controls work together to provide defense in depth and protect assets. Preventative controls are designed to prevent an incident from occurring in the first place. Corrective controls are used to restore an asset after an incident. Detective controls are implemented to determine whether an incident has occurred or is in progress. Deterrent controls are designed to discourage attacks.\n",
    "\n",
    "Review the following charts for specific details about each type of control and its purpose.\n",
    " \n",
    "![image](https://github.com/user-attachments/assets/c1b9c102-52c0-4907-af18-d805227ea2bd)\n",
    "\n",
    "![image](https://github.com/user-attachments/assets/f2ef2ab6-ac9a-4034-940f-ddef5bdc7b1b)\n",
    "\n",
    "![image](https://github.com/user-attachments/assets/3ef82a91-3362-4dd8-8ebb-ebff9f08aedf)\n",
    "\n",
    "### Audit checklist\n",
    "It’s necessary to create an audit checklist before conducting an audit. A checklist is generally made up of the following areas of focus:\n",
    "#### Identify the scope of the audit\n",
    "- The audit should:\n",
    "    - List assets that will be assessed (e.g., firewalls are configured correctly, PII is secure, physical assets are locked, etc.) \n",
    "    - Note how the audit will help the organization achieve its desired goals\n",
    "    - Indicate how often an audit should be performed\n",
    "    - Include an evaluation of organizational policies, protocols, and procedures to make sure they are working as intended and being implemented by employees\n",
    "\n",
    "#### Complete a risk assessment\n",
    "A risk assessment is used to evaluate identified organizational risks related to budget, controls, internal processes, and external standards (i.e., regulations).\n",
    "\n",
    "#### Conduct the audit\n",
    "When conducting an internal audit, you will assess the security of the identified assets listed in the audit scope.\n",
    "\n",
    "#### Create a mitigation plan\n",
    "A mitigation plan is a strategy established to lower the level of risk and potential costs, penalties, or other issues that can negatively affect the organization’s security posture. \n",
    "\n",
    "#### Communicate results to stakeholders\n",
    "The end result of this process is providing a detailed report of findings, suggested improvements needed to lower the organization's level of risk, and compliance regulations and standards the organization needs to adhere to. \n",
    "\n",
    "## Key takeaways\n",
    "In this reading you learned more about security audits, including what they are; why they’re conducted; and the role of frameworks, controls, and compliance in audits. \n",
    "\n",
    "Although there is much more to learn about security audits, this introduction is meant to support your ability to complete an audit of your own for a self-reflection portfolio activity later in this course."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Audit Scope and Goals\n",
    "### Summary: \n",
    "The internal audit needs to align current business practices with industry standards and best practices. The audit is meant to provide mitigation recommendations for vulnerabilities found that are classified as “high risk,” and present an overall strategy to improve the security posture of the organization. The audit team needs to document their findings, provide remediation plans and efforts, and communicate with stakeholders.\n",
    "### Scope: \n",
    "The internal IT audit will assess the following:\n",
    "- Assess user permissions\n",
    "- Identify existing controls, procedures, and system protocols\n",
    "- Account for technology currently in use\n",
    "\n",
    "### Goals:\n",
    "The goals for the internal IT audit are:\n",
    "- Adhere to the NIST Cybersecurity Framework (CSF)\n",
    "- Establish policies and procedures to ensure compliance with regulations\n",
    "- Fortify system controls\n",
    "\n",
    "## Risk Assessment\n",
    "### Current assets\n",
    "Assets managed by the IT Department include: \n",
    "- Employee equipment: end-user devices (desktops/laptops, smartphones), remote workstations, headsets, cables, keyboards, mice, docking stations, surveillance cameras, etc.\n",
    "- Internal network: protected storage of customer, vendor, organizational data\n",
    "### Risk description\n",
    "Currently, there is inadequate management of assets. Additionally, proper controls are not in place and the organization may not be compliant with U.S. and international compliance regulations and standards. \n",
    "\n",
    "### Control best practices\n",
    "The organization will need to dedicate resources to managing assets. Additionally, they will need to determine the impact of the loss of existing assets, including systems, on business continuity.\n",
    "\n",
    "### Risk score\n",
    "On a scale of 1-10, the risk score is 8, which is fairly high. This is due to a lack of controls and adherence to necessary compliance regulations and standards.\n",
    "\n",
    "### Additional comments\n",
    "The likelihood of a lost asset or fines from governing bodies is high because the organization does not have all of the necessary controls in place and is not adhering to required regulations and standards related to keeping PII data private.\n",
    "\n",
    "### Controls Assessment\n",
    "\n",
    "![image](https://github.com/user-attachments/assets/aa7e0acc-a080-45d1-bc84-cb1f959643ab)\n",
    "\n",
    "![image](https://github.com/user-attachments/assets/d16d7fb3-c40e-416b-a062-12d65ed47a6a)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Compliance Checklist\n",
    "### General Data Protection Regulation (GDPR)\n",
    "GDPR is a European Union (EU) general data regulation that protects the processing of EU citizens’ data and their right to privacy in and out of EU territory. Additionally, if a breach occurs and a EU citizen’s data is compromised, they must be informed within 72 hours of the incident.\n",
    "#### Explanation:\n",
    "The organization needs to adhere to GDPR because we conduct business and collect personal information from people in the EU.\n",
    "\n",
    "### Payment Card Industry Data Security Standard (PCI DSS)\n",
    "PCI DSS is an international security standard meant to ensure that organizations storing, accepting, processing, and transmitting credit card information do so in a secure environment. \n",
    "### Explanation: \n",
    "The organization needs to adhere to PCI DSS because we store, accept, process, and transmit credit card information in person and online."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Glossary terms from module 2\n",
    "Terms and definitions from Course 2, Module 2\n",
    "\n",
    "Asset: An item perceived as having value to an organization\n",
    "\n",
    "Attack vectors: The pathways attackers use to penetrate security defenses\n",
    "\n",
    "Authentication: The process of verifying who someone is\n",
    "\n",
    "Authorization: The concept of granting access to specific resources in a system\n",
    "\n",
    "Availability: The idea that data is accessible to those who are authorized to access it\n",
    "\n",
    "Biometrics: The unique physical characteristics that can be used to verify a person’s identity\n",
    "\n",
    "Confidentiality: The idea that only authorized users can access specific assets or data\n",
    "\n",
    "Confidentiality, integrity, availability (CIA) triad: A model that helps inform how organizations consider risk when setting up systems and security policies\n",
    "\n",
    "Detect: A NIST core function related to identifying potential security incidents and improving monitoring capabilities to increase the speed and efficiency of detections\n",
    "\n",
    "Encryption: The process of converting data from a readable format to an encoded format\n",
    "\n",
    "Identify: A NIST core function related to management of cybersecurity risk and its effect on an organization’s people and assets \n",
    "\n",
    "Integrity: The idea that the data is correct, authentic, and reliable\n",
    "\n",
    "National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF): A voluntary framework that consists of standards, guidelines, and best practices to manage cybersecurity risk \n",
    "\n",
    "National Institute of Standards and Technology (NIST) Special Publication (S.P.) 800-53: A unified framework for protecting the security of information systems within the U.S. federal government \n",
    "\n",
    "Open Web Application Security Project/Open Worldwide Application Security Project (OWASP): A non-profit organization focused on improving software security\n",
    "\n",
    "Protect: A NIST core function used to protect an organization through the implementation of policies, procedures, training, and tools that help mitigate cybersecurity threats\n",
    "\n",
    "Recover: A NIST core function related to returning affected systems back to normal operation\n",
    "\n",
    "Respond: A NIST core function related to making sure that the proper procedures are used to contain, neutralize, and analyze security incidents, and implement improvements to the security process\n",
    "\n",
    "Risk: Anything that can impact the confidentiality, integrity, or availability of an asset\n",
    "\n",
    "Security audit: A review of an organization's security controls, policies, and procedures against a set of expectations\n",
    "\n",
    "Security controls: Safeguards designed to reduce specific security risks \n",
    "\n",
    "Security frameworks: Guidelines used for building plans to help mitigate risk and threats to data and privacy\n",
    "\n",
    "Security posture: An organization’s ability to manage its defense of critical assets and data and react to change\n",
    "\n",
    "Threat: Any circumstance or event that can negatively impact assets"
   ]
  }
 ],
 "metadata": {
  "language_info": {
   "name": "python"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}