NIST CSF and Security Frameworks

The NIST CSF is a voluntary framework developed by the National Institute of Standards and Technology to help organizations manage cybersecurity risk. It was created in response to Executive Order 13636 (2013) and updated to version 2.0 in 2024. The framework consists of three main components: the Core, Implementation Tiers, and Profiles.

Core: The Core is a set of cybersecurity activities, outcomes, and references organized around five functions: Identify, Protect, Detect, Respond, Recover. Each function is broken into categories and subcategories. For example, the Identify function includes categories like Asset Management, Risk Assessment, and Governance.

Implementation Tiers: Tiers describe how an organization views cybersecurity risk and the processes in place to manage it. There are four tiers:

Profiles: A Profile is a snapshot of an organization's current cybersecurity posture (Current Profile) and its desired goals (Target Profile). The gap between them guides prioritization.

Organizations use the CSF as a risk management tool. The process is: 1. Scope: Determine which systems, assets, and business processes are in scope. 2. Prioritize: Identify business objectives and high-value assets. 3. Create a Current Profile: Assess current cybersecurity activities against the Core subcategories. 4. Conduct a Risk Assessment: Identify threats, vulnerabilities, and likelihood/impact. 5. Create a Target Profile: Define desired outcomes based on risk appetite. 6. Identify Gaps: Compare Current and Target Profiles. 7. Action Plan: Prioritize and implement actions to close gaps. 8. Monitor and Improve: Continuously assess and update profiles.

NIST CSF v2.0 (2024) added a sixth function: Govern. This emphasizes that cybersecurity governance is a separate, overarching function. The six functions now are: Govern, Identify, Protect, Detect, Respond, Recover.

Other Key Frameworks for SY0-701: - ISO/IEC 27001: International standard for Information Security Management Systems (ISMS). It is prescriptive (requires specific controls) and certifiable. The controls are in Annex A. - COBIT (Control Objectives for Information and Related Technologies): Focuses on IT governance and management. It aligns IT goals with business goals. - NIST SP 800-53: Security and Privacy Controls for Federal Information Systems. It is mandatory for U.S. federal agencies. Contains over 1,000 controls organized into families (e.g., AC – Access Control, AU – Audit and Accountability). - NIST SP 800-171: Protecting Controlled Unclassified Information (CUI) in nonfederal systems. Used by defense contractors. - CIS Controls: A prioritized set of actions (20 controls) to defend against common attacks. They are more tactical and specific than the CSF. - PCI DSS: Payment Card Industry Data Security Standard – required for organizations handling credit card data.

Without a framework, organizations often have gaps. For example, an attacker might exploit a lack of asset management (Identify) by targeting an unpatched legacy server not on the inventory. Without detection capabilities (Detect), the attacker can move laterally undetected. Without a response plan (Respond), the organization fumbles containment. The CSF helps close these gaps by forcing holistic coverage.

While the CSF itself is not a tool, you can map CSF subcategories to specific tools and commands. For example: - Asset Management (ID.AM): Use nmap -sV 192.168.1.0/24 to discover devices. - Risk Assessment (ID.RA): Use vulnerability scanners like OpenVAS or Nessus. - Protect (PR.AC – Access Control): Configure iptables rules or use sudo logs. - Detect (DE.CM – Continuous Monitoring): Set up auditd on Linux or Windows Event Forwarding. - Respond (RS.CO – Communication): Use SIEM like Splunk or ELK stack. - Recover (RC.RP – Recovery Planning): Test backups with restic or Veeam.

The NIST CSF is a risk-based framework, not a compliance checklist. It helps organizations communicate about cybersecurity in a common language. For the exam, know the five (or six) functions, the tiers, and how the CSF differs from ISO 27001 and NIST SP 800-53.

Scenario 1: Ransomware Attack at a Hospital A hospital's IT team uses the NIST CSF to guide their security program. One day, the SIEM (Splunk) detects unusual encryption activity on a file server. The analyst sees thousands of 'file rename' events with a .encrypted extension. Following the Detect function, they escalate to the incident response team. The Respond team isolates the server by disabling the network port (via switch CLI command interface gig0/1 shutdown). They then use EDR tools to identify the ransomware variant (e.g., Ryuk). They restore the server from backups (Recover) and update the antivirus signatures. A common mistake is to immediately power off the server, losing forensic data. Instead, they properly image the drive for analysis. Post-incident, they update their asset inventory (Identify) and implement additional logging (Detect).

Scenario 2: Insider Threat at a Financial Firm An employee at a financial firm downloads customer data to a personal USB drive. The DLP (Data Loss Prevention) tool detects the transfer and alerts the SOC. The analyst reviews the user's activity logs (Windows Event ID 4663 – attempt to access an object) and sees the user copied files from a restricted share. The firm's CSF Profile includes a Target for 'Data Security' (PR.DS). They have a policy that requires USB ports to be disabled via Group Policy, but this user's laptop was an exception. The analyst initiates the response: revokes access, interviews the employee, and reports to HR. The mistake would be to ignore the alert because it came from a trusted employee. The firm updates its Profile to close the exception gap.

Scenario 3: Phishing Campaign Targeting a University A university receives multiple phishing emails claiming to be from IT support. The email gateway (Proofpoint) marks them as suspicious but delivers them (low confidence). A student clicks the link and enters credentials. The SIEM detects a login from an unusual IP (geolocated in Russia) within minutes. The analyst checks the user's recent logon events (Event ID 4624) and sees a successful logon from the attacker IP. The Respond team forces a password reset and enables MFA for the student. They also block the IP at the firewall. The mistake would be to only reset the password without enabling MFA, leaving the account vulnerable if the attacker had already set up a mailbox rule. The university updates its awareness training (Protect) to include phishing simulations.