Posts

ISO 27001:2022: chapter by chapter description

/in

I’ve been asked many times by customers, especially those in automotive industry, who deal with the TISAX certification, which is based on ISO 27001,  if I can make them a summary of the ISO 27001 standard.

It turns out that there has been a while since I read it, I think it was somewhere in 2016. That was the ISO 27001:2013 and in the meanwhile, the version 2022 was released.

So, let’s start with the delta between 2013 and 2022 and then we will focus on each chapter. For each chapter, we summary explain the goal, the actions required to implement the requirement and the implementation of the controls.

 

What’s New in ISO 27001:2022

The October 2022 revision of ISO 27001 incorporates several updates and enhancements compared to the previous 2013 version. The changes were mostly cosmetic and include restructuring and refining existing requirements.

The biggest change is Annex A which specific controls derived from ISO 27002:2022.

One significant change is the increased emphasis on the context of the organization, requiring organizations to conduct more comprehensive assessments of internal and external factors that impact information security.

The Annex A controls have been restructured and consolidated to reflect current security challenges and to reflect more modern risks and their associated controls.

Additionally, there is a greater focus on leadership involvement and accountability, with explicit requirements for top management to demonstrate active participation in setting information security objectives and promoting a culture of security awareness.

The revised standard also introduces updated terminology and references to align with current industry practices and emerging technologies, reflecting the evolving landscape of information security threats and challenges.

 

Chapter 1-3: Scope, Normative References and  Terms and Definitions

These chapters set the stage: they establish a common understanding of key terms used in the standard and identify relevant standards and guidelines that complement ISO 27001 requirements.

 

Chapter 4: Context of the Organization

Goal

Understand the internal and external factors that influence the organization’s information security objectives and risk management approach.

Actions

  1. Identify internal stakeholders, including management, employees, and third-party vendors.
  2. Assess external factors such as regulatory requirements, market trends, and competitive landscape.
  3. Determine the organization’s risk tolerance and strategic objectives.

Implementation

Conduct a SWOT (Strengths, Weaknesses, Opportunities, Threats) analysis to identify internal strengths and weaknesses, as well as external opportunities and threats. Use this analysis to inform decision-making and prioritize information security initiatives.

Chapter 5: Leadership

Goal

Demonstrate commitment from top management to establish and maintain an effective ISMS.

Actions

  1. Assign responsibility for information security to senior management.
  2. Establish a governance structure to oversee the ISMS implementation.
  3. Allocate resources and provide support for information security initiatives.

Implementation

Engage senior management through regular communication and reporting on information security performance and compliance. Obtain leadership buy-in for resource allocation and organizational changes necessary to support the ISMS.

Chapter 6: Planning

Goal

Develop a strategic approach to identify, assess, and mitigate information security risks.

Actions

  1. Conduct a risk assessment to identify threats, vulnerabilities, and impacts on information assets.
  2. Develop risk treatment plans to address identified risks, including mitigation, transfer, or acceptance.
  3. Define information security objectives and performance metrics to measure the effectiveness of the ISMS.

Implementation

Establish a cross-functional risk management team to conduct risk assessments and develop risk treatment plans. Define clear objectives and key performance indicators (KPIs) to track progress and ensure alignment with business goals.

Chapter 7: Support

Goal

Provide the necessary resources, competencies, and awareness to support the implementation and operation of the ISMS.

Actions

  1. Allocate financial, human, and technical resources to support information security initiatives.
  2. Provide training and awareness programs to enhance employee competencies and promote a culture of security.
  3. Establish communication channels for reporting security incidents and seeking guidance on information security matters.

Implementation

Develop a comprehensive training and awareness program tailored to different roles and responsibilities within the organization. Implement mechanisms for reporting security incidents and provide timely support and guidance to address emerging threats.

Chapter 8: Operation

Goal

Implement and maintain controls to manage information security risks effectively.

Actions

  1. Implement security controls based on the results of the risk assessment and risk treatment plans.
  2. Monitor and review security controls regularly to ensure effectiveness and compliance with policies and procedures.
  3. Establish incident response and business continuity plans to mitigate the impact of security incidents and disruptions.

Implementation

Automate routine security tasks where possible to streamline operations and improve efficiency. Conduct regular audits and assessments to verify compliance with security policies and procedures. Continuously improve security controls based on lessons learned from security incidents and emerging threats.

Chapter 9: Performance Evaluation

Goal: Monitor, measure, analyze, and evaluate the performance of the ISMS to ensure its effectiveness and continual improvement.

Actions:

  1. Define key performance indicators (KPIs) to measure the effectiveness of information security controls.
  2. Conduct internal audits and management reviews to assess compliance with ISO 27001 requirements and identify areas for improvement.
  3. Implement corrective and preventive actions to address non-conformities and enhance the performance of the ISMS.

Implementation: Establish a performance monitoring and reporting framework to track progress against established KPIs. Use data-driven insights to identify trends, patterns, and areas for improvement. Engage stakeholders in regular reviews and discussions to foster a culture of continual improvement.

Chapter 10: Improvement

Goal: Take corrective and preventive actions to address non-conformities, enhance the effectiveness of the ISMS, and achieve continual improvement.

Actions:

  1. Implement corrective actions to address non-conformities identified during audits, assessments, or incident investigations.
  2. Identify opportunities for preventive actions to mitigate potential risks and prevent recurrence of security incidents.
  3. Document lessons learned and best practices to inform future decision-making and enhance the maturity of the ISMS.

Implementation: Establish a formal process for documenting and tracking corrective and preventive actions. Encourage proactive identification and resolution of issues to prevent their escalation. Foster a culture of innovation and collaboration to drive continual improvement across the organization.

 

What’s next?

We will focus in one of the next articles on Annex A of ISO 27001:2022.

The information security controls listed in Table A.1 are directly derived from and aligned with those listed in ISO/IEC 27002:2022, Clauses 5 to 8, and shall be used in context with 6.1.3. Information security risk treatment.

 

The post ISO 27001:2022: chapter by chapter description first appeared on Sorin Mustaca on Cybersecurity.

The ISO 27000 family of protocols and their role in cybersecurity

/in

The ISO 27000 family of protocols represent a series of standards developed by the International Organization for Standardization (ISO) to address various aspects of information security management. These standards provide a framework for organizations to establish, implement, maintain, and continually improve their information security management systems (ISMS). Each standard within the ISO 27000 family serves a specific purpose and contributes to the overall cybersecurity posture of an organization.

The highlight of the set is 27001 specifying the requirements necessary to implement, maintain and manage an ISMS, within the process of continuous improvement known as PDCA, an acronym for Plan-Do-Check-Act, in relation to the planning, doing, verifying and acting phases.

On the other hand, 27002, is a set of 114 controls, grouped into 14 domains, which aim to facilitate good practices in relation to the management of the ISMS.

Note that the titles written in Italic are industry sector specific.

ISO 27000: Overview and vocabulary

ISO 27000 provides the overview of information security management systems (ISMS). It also provides terms and definitions commonly used in the ISMS family of standards. It is applicable to all types and sizes of organization (e.g. commercial enterprises, government agencies, not-for-profit organizations).

ISO 27001: Information Security Management Systems (ISMS)

ISO 27001 is the cornerstone of the ISO 27000 family, focusing on the establishment, implementation, maintenance, and continual improvement of an ISMS. It provides a systematic approach for identifying, assessing, and managing information security risks, ensuring the confidentiality, integrity, and availability of sensitive information. ISO 27001 helps organizations align their information security practices with business objectives, regulatory requirements, and best practices in the industry.

ISO 27002: Code of Practice for Information Security Controls

ISO 27002 complements ISO 27001 by providing guidance on the selection, implementation, and management of information security controls. It offers a comprehensive set of best practices and security controls organized into categories such as information security policies, organization of information security, human resource security, and asset management. ISO 27002 helps organizations tailor their security controls to specific risks and operational requirements, enhancing the effectiveness of their ISMS.

ISO 27003: Guidelines for the Implementation of an ISMS

ISO 27003 provides guidance on the implementation of an ISMS based on the principles and requirements outlined in ISO 27001. It offers practical recommendations for planning, executing, monitoring, and improving the implementation process, helping organizations navigate the complexities of establishing a robust ISMS. ISO 27003 assists organizations in defining project objectives, roles and responsibilities, and implementation milestones to ensure a successful ISMS deployment.

ISO 27004: Information Security Management Measurement

ISO 27004 focuses on the measurement and monitoring of information security performance within an organization. It provides guidance on defining, implementing, and evaluating key performance indicators (KPIs) and metrics to assess the effectiveness of security controls and the overall ISMS. ISO 27004 enables organizations to gather actionable insights into their information security posture, identify areas for improvement, and demonstrate the value of their security investments to stakeholders.

ISO 27005: Information Security Risk Management

ISO 27005 provides guidelines for conducting risk assessments and managing information security risks effectively. It offers a systematic approach for identifying, analyzing, evaluating, and treating information security risks based on organizational objectives, context, and risk tolerance. ISO 27005 helps organizations prioritize risk mitigation efforts, allocate resources efficiently, and make informed decisions to protect their information assets from potential threats.

ISO 27006: Requirements for ISMS Certification

ISO 27006 specifies requirements for organizations seeking certification of their ISMS against ISO 27001. It outlines the criteria for certification bodies to assess the conformity of an organization’s ISMS with the requirements of ISO 27001 and ensure impartiality, competence, and consistency in the certification process. ISO 27006 provides assurance to stakeholders that an organization’s ISMS meets internationally recognized standards for information security management.

ISO 27007: Guidelines for Information Security Management Systems Auditing

ISO 27007 provides guidelines for auditing information security management systems (ISMS) based on the requirements specified in ISO 27001. It offers recommendations for planning, conducting, and reporting ISMS audits to ensure their effectiveness and compliance with ISO 27001 standards. ISO 27007 helps organizations evaluate the performance of their ISMS, identify areas for improvement, and demonstrate conformance with regulatory requirements and industry best practices. This standard is crucial for ensuring the integrity and reliability of ISMS audits, providing assurance to stakeholders about the effectiveness of information security controls.

ISO 27008: Guidelines for Auditors on Information Security Controls

ISO 27008 provides guidance to auditors on assessing the effectiveness of information security controls within an organization. It offers a framework for evaluating the design, implementation, and operation of security controls based on established criteria and best practices. ISO 27008 helps auditors ensure the adequacy and appropriateness of security controls in mitigating information security risks and safeguarding sensitive information assets. By following the guidelines outlined in ISO 27008, auditors can provide valuable insights and recommendations to organizations for strengthening their information security posture.

ISO 27009: Sector-specific Application of ISO 27001

ISO 27009 provides guidance on the sector-specific application of ISO 27001 for organizations operating in specialized industries or sectors. It offers recommendations for tailoring the requirements of ISO 27001 to meet the unique needs, challenges, and regulatory requirements of specific sectors such as healthcare, finance, telecommunications, and government. ISO 27009 helps organizations enhance the relevance and effectiveness of their ISMS by addressing sector-specific risks and compliance obligations. By aligning with ISO 27009 guidelines, organizations can streamline the implementation of ISO 27001 and achieve greater consistency in information security management across sectors.

ISO 27010: Information Security Management for Inter-sector and Inter-organizational Communications

ISO 27010 provides guidelines for managing information security in inter-sector and inter-organizational communications. It offers recommendations for establishing secure communication channels, sharing sensitive information, and collaborating with external partners, suppliers, and stakeholders. ISO 27010 helps organizations mitigate the risks associated with exchanging information across different sectors and jurisdictions, ensuring confidentiality, integrity, and availability throughout the communication process. By adhering to ISO 27010 guidelines, organizations can enhance trust, transparency, and security in their inter-organizational relationships and collaborations.

ISO 27011: Information Security Management Guidelines for Telecommunications Organizations

ISO 27011 offers guidelines for implementing information security management systems (ISMS) in telecommunications organizations. It provides recommendations for addressing sector-specific risks, threats, and regulatory requirements related to information security in the telecommunications industry. ISO 27011 helps telecommunications organizations enhance the resilience of their networks, systems, and services against cyber threats, ensuring the confidentiality, integrity, and availability of critical communications infrastructure. By following ISO 27011 guidelines, telecommunications organizations can strengthen their security posture, build customer trust, and maintain compliance with industry standards and regulations.

ISO 27012: Guidelines for Cybersecurity

ISO 27012 provides guidelines for managing cybersecurity risks within organizations. It offers recommendations for establishing cybersecurity policies, procedures, and controls to protect against cyber threats and vulnerabilities. ISO 27012 helps organizations develop a proactive approach to cybersecurity, focusing on prevention, detection, and response to cyber incidents. By aligning with ISO 27012 guidelines, organizations can enhance their resilience against evolving cyber threats, minimize the impact of security breaches, and safeguard sensitive information assets. ISO 27012 also promotes collaboration and information sharing among stakeholders to strengthen cybersecurity capabilities and mitigate common threats across sectors.

ISO 27012: Guidelines for Cybersecurity Information Sharing

ISO 27012 provides guidelines for organizations to establish frameworks for sharing cybersecurity information effectively. It offers recommendations for developing policies, procedures, and technical mechanisms to facilitate the exchange of threat intelligence and incident data among stakeholders. ISO 27012 aims to improve situational awareness, enhance threat detection and response capabilities, and foster collaboration within the cybersecurity community. By adhering to ISO 27012 guidelines, organizations can strengthen their cybersecurity posture, mitigate emerging threats, and contribute to a more resilient and secure cyber ecosystem.

ISO 27013: Guidance on the Integration and Implementation of ISMS with ISO 20000-1

ISO 27013 offers guidance on integrating and implementing an Information Security Management System (ISMS) with the requirements of ISO 20000-1, which focuses on IT service management. It provides recommendations for aligning information security practices with service management processes, ensuring consistency and effectiveness in managing IT services and information security risks. ISO 27013 helps organizations enhance the synergy between their ISMS and IT service management initiatives, resulting in improved service delivery, risk management, and customer satisfaction.

ISO 27014: Governance of Information Security

ISO 27014 provides guidance on establishing and maintaining effective governance structures for information security management within organizations. It offers recommendations for defining roles, responsibilities, and decision-making processes related to information security governance, ensuring accountability and oversight at all levels of the organization. ISO 27014 helps organizations establish a culture of security, align information security practices with business objectives, and promote continuous improvement in information security governance. By adhering to ISO 27014 guidelines, organizations can enhance their resilience against cyber threats, improve regulatory compliance, and build trust with stakeholders.

ISO 27015: Information Security Management for Financial Services

ISO 27015 offers guidance on implementing information security management systems (ISMS) in the financial services sector.

ISO 27016: Information Security Management for the Banking and Financial Services Sector

ISO 27016 provides guidance on implementing information security management systems (ISMS) specifically tailored to the banking and financial services sector.

ISO 27017: Cloud Services Security

ISO 27017 provides guidelines for implementing information security controls in cloud computing environments. It offers recommendations for cloud service providers and cloud customers to address security risks associated with cloud services, including data confidentiality, integrity, and availability. ISO 27017 helps organizations establish trust in cloud computing by addressing common security concerns and ensuring compliance with regulatory requirements. By following ISO 27017 guidelines, organizations can enhance the security of their cloud-based systems and data, mitigate risks associated with cloud adoption, and realize the benefits of cloud computing securely.

ISO 27018: Protection of Personally Identifiable Information (PII) in Public Clouds

ISO 27018 focuses on the protection of personally identifiable information (PII) in public cloud environments. It provides guidelines for cloud service providers to implement measures for protecting PII and ensuring privacy compliance in cloud-based services. ISO 27018 helps organizations address privacy concerns associated with cloud computing, establish trust with customers, and demonstrate compliance with data protection regulations. By adhering to ISO 27018 guidelines, cloud service providers can enhance transparency, accountability, and control over PII processing activities, thereby improving customer confidence and satisfaction in cloud services.

ISO 27019:  Information security controls for the energy utility industry

ISO 27019 provides guidance based on ISO/IEC 27002:2013 applied to process control systems used by the energy utility industry for controlling and monitoring the production or generation, transmission, storage and distribution of electric power, gas, oil and heat, and for the control of associated supporting processes.

 

Interplay and Importance in Cybersecurity

The ISO 27000 family of protocols works together synergistically to provide a holistic approach to information security management.

The importance of these standards in cybersecurity cannot be overstated. By adopting the ISO 27000 family of protocols, organizations can strengthen their resilience against evolving cyber threats, enhance their regulatory compliance, and build trust with customers, partners, and regulators.

These standards promote a risk-based approach to information security, enabling organizations to identify and mitigate potential risks proactively, rather than reactively.

Overall, the ISO 27000 family of protocols plays a critical role in elevating cybersecurity practices and promoting a culture of security and resilience in organizations worldwide.

 

Additional resources

 

The post The ISO 27000 family of protocols and their role in cybersecurity first appeared on Sorin Mustaca on Cybersecurity.

Building Resilient Web Applications on AWS: A Comprehensive Approach to Security

/in

 

I have been asked by friends and customers what is the best way to implement a web based application with minimum costs and good security. Of course, the best way is to define exactly what you want to achieve and let professionals do it, while keeping an eye on the Secure Software Development Lifecycle.

But, this article is not about SSDLC, it is about how to start web application development having also security as a top priority. Securing a classical web application involves a multi-layered approach, addressing the presentation, business logic, and database layers.

Most important thing to keep in mind when engaging into such an enterprise is: don’t try to do everything by yourself – use existing tools and services, which come with a more than decent security built-in.

This article explores how to architect a secure web application on AWS, but it can be applied very well to other cloud based services provider,  and conduct a thorough risk assessment at each level.

A good security approach is to practice defense in depth, meaning that you should check and validate the security of the components used as well. This means that we need to perform at least a high-level risk assessment of these components as well.

 

 

Securing the Presentation Layer

At the forefront of user interaction, the presentation layer demands robust security measures. Amazon CloudFront serves as a reliable content delivery network, ensuring low latency and protection against DDoS attacks.

AWS Identity and Access Management (IAM) steps in to control access to resources at this layer, while AWS Web Application Firewall (WAF) safeguards against common web exploits and secures APIs.

The Presentation layer hosts the UI of the application, typically a website written in HTML5 or a combination of HTML, php, JS, or some high level programming languages that can produce HTML as output.

Such web UIs must be uploaded on a AWS S3 bucket read accessible to everyone and then configure the CloudFront to distribute it.

Risk Assessment at the Presentation Layer

  • Regularly review and adjust IAM policies to mitigate the risk of unauthorized access.
  • Conduct penetration testing on the web application to identify and address vulnerabilities.
  • Monitor CloudFront logs for unusual patterns indicative of a security threat.
  • Make sure nobody has unrestricted access to your S3 bucket hosting the web content

Security practices

  • If you collect data, make sure it is encrypted using AWS Secrets Manager;
  • Do not encrypt using your own keys, hardcoded in your application.
  • Do not invent yourself some “encryption” mechanism, which in the end is just an obfuscation.

Securing the Business Logic Layer

The business logic layer is the heart of a web application, where critical processes take place. Containerizing application logic using AWS Elastic Container Service (ECS) or AWS Fargate ensures enhanced isolation.

AWS Lambda, offering serverless computing, executes sensitive business logic securely. AWS Secrets Manager manages and rotates sensitive API keys and tokens.

Risk Assessment at the Business Logic Layer

– Regularly audit and review AWS Lambda functions to maintain the security of business logic.
– Conduct static and dynamic code analysis to identify vulnerabilities in the application logic.
– Implement AWS CloudWatch for real-time monitoring and alerting on anomalous Lambda function behavior.

Securing the Database Level

The database, housing crucial data, requires robust security measures. Amazon RDS provides secure and scalable relational databases with automatic backups and encryption.

Fine-grained access control through IAM roles and policies is essential for secure database access. AWS Key Management Service (KMS) handles encryption of data at rest within the database.

 

Risk Assessment at the Database Level

– Regularly audit and review database access controls and IAM roles to prevent unauthorized access.
– Implement automated vulnerability scanning tools for the database to identify potential weaknesses.
– Set up AWS CloudTrail to log and monitor all database-related API activity.

 

Continuous Monitoring and Response

Ensuring the ongoing security of a web application involves continuous monitoring and a robust incident response plan. AWS Security Hub acts as a centralized monitoring tool, while AWS Config rules automate the assessment and remediation of non-compliance.

An incident response plan with specific procedures for each layer of the web application architecture ensures a swift and effective response to security incidents.

 

In the next post: risk assessment for the Amazon services used in this article:

  • AWS IAM
  • AWS Elastic Container Service (ECS)
  • AWS Fargate
  • AWS Key Management Service (KMS)
  • AWS Lambda
  • AWS CloudTrail
  • AWS Secrets Manager
  • AWS CloudFront
  • AWS S3

Conclusion

By adopting a comprehensive security strategy across the presentation layer, business logic, and database levels, small organizations can build resilient and cost aware web applications on the AWS platform.

This approach, coupled with regular risk assessments, establishes a solid foundation for web application security, safeguarding against common cybersecurity threats.

The post Building Resilient Web Applications on AWS: A Comprehensive Approach to Security first appeared on Sorin Mustaca on Cybersecurity.

Evolving beyond your core expertise: it’s time to add security

/in

This post is for creators of digital services like optimization tools,  VPN solutions, Backup and Disaster Recovery tools, Parental control tools, Identity protection tools, Privacy tools, Email clients, Browsers and many others.

Your products are doing a good job in the dynamic landscape of digital services, and it is amazing of how much commitment and work is invested in providing top-notch tools. However, in this era of escalating cyber threats, there’s a pivotal evolution taking place —a shift that you have seen it coming already : it is time to integrate robust security measures into your existing offerings.

Are you curious why? Read on …

 

Threat landscape evolved way beyond your core expertise

The digital world is witnessing an unprecedented surge in cyber threats. Malware, ransomware, data breaches—the risks are multifaceted and affect your users’ security and privacy. Your customers, while benefiting from your solutions, now seek a more comprehensive shield against these threats, ideally coming from the same producer or from a single product.

 

Customer expectations are higher

Your customers are discerning individuals who are continuously looking at the market. They expect a comprehensive approach to their digital safety. Strengthening your service portfolio with robust cybersecurity measures aligns with their evolving needs and fortifies their trust in your brand.

 

Competitive Edge Through Diversification

By diversifying into the security space, you’re not merely meeting customer demands; you’re cementing your competitive position in the market. Companies that offer a holistic suite of security solutions distinguish themselves as leaders in a crowded market.

 

Value of Integrated Solutions

Integrated security solutions that seamlessly blend with your services create an all-encompassing safety net for users. Presenting a unified platform that prioritizes both speed and security establishes a compelling value proposition, attracting customers seeking efficiency without compromising on safety.

 

In conclusion, embracing the integration of cybersecurity measures into your existing services isn’t just an option; it’s a strategic decision that must be taken.

This evolution ensures not only meeting customer expectations but also securing a more competitive edge in an industry that demands continuous innovation and adaptability.

 

The post Evolving beyond your core expertise: it’s time to add security first appeared on Sorin Mustaca on Cybersecurity.

Balancing functionality and privacy concerns in AI-based Endpoint Security solutions

/in

The integration of Artificial Intelligence (AI) in endpoint security has revolutionized the way organizations protect their devices and data.

Ok, let’s take a break here: have you read the article about Artificial Intelligence vs. Machine Learning ?

 

By leveraging AI and machine learning models that analyze user behavior on devices, organizations can detect anomalies and potential security threats more effectively.

However, this advanced approach to endpoint security raises significant privacy concerns, as it necessitates the collection of user activity data, sometimes in real time.

One thing needs to be clear: if you want to do anomaly detection, you need to train your ML model with what “normal” is first – this is called “baseline”. And this means that data needs to be collected from the user.

Now the question remains, how can we reduce the privacy concerns?

This short article explores the privacy challenges I think are associated with using AI models that require user data(behavior), discusses potential solutions, and suggests ways to deploy AI on devices while minimizing privacy concerns.

What are the privacy concerns when data is collected for training an ML model?

Data Collection and Usage


Collecting user data for AI-driven endpoint security involves monitoring and logging user activities on devices.

This process includes:

  • capturing information about the applications used (URLs accessed, CPU usage, memory usage),
  • websites visited and items clicked
  • files accessed
  • applications installed
  • applications started
  • time of login, logout, inactivity
  • webcam usage
  • microphone usage
  • biometrics

This data is essential for creating baselines of normal behavior and identifying deviations that might indicate security threats.

This extensive data collection raises concerns about user privacy, as it creates a comprehensive profile of a user’s digital activities.

AI-based endpoint security solutions can infer or predict sensitive information from non-sensitive forms of data, such as user preferences, interests, or behaviors.

This can enable the systems to provide personalized or customized services or recommendations, but it can also violate the privacy or autonomy of the users or the owners of the devices or networks.

For example, someone’s keyboard typing patterns can be analyzed to deduce their emotional state, which includes emotions such as nervousness, confidence, sadness or anxiety

 

Data Security

Safeguarding the collected user data is critical, as it contains sensitive information about an individual’s online behavior.

The risk of data breaches or unauthorized access to this information poses a significant privacy threat.

Where is this data stored, how long, how is it stored, who has access to it, how is it going to be used/processed and by who, are just a few questions that need to be asked.

GDPR has made clear which are the responsibilities of the controller and processor(s) of the data.

 

Transparency and Consent

A good user experience of a security product means that users will be as unaware as possible that their activity data is being collected for security purposes.

Ensuring transparency and obtaining explicit user consent for data collection is critical. Without clear communication, users may feel their privacy is being violated.

 

Data Retention

Storing user data indefinitely can compound privacy concerns. Organizations should establish clear data retention policies, specifying how long the data will be retained and under what circumstances it will be deleted.

 

User Profiling and Discrimination

The detailed user activity data collected for AI analysis can lead to user profiling, which may be used for purposes beyond cybersecurity, such as targeted advertising.

AI-based endpoint security solutions can make automated decisions or recommendations based on the data they analyze, such as blocking access, flagging anomalies, or prioritizing alerts.

Discriminatory decisions and practices can arise from the insights drawn from user behavior data. However, these decisions or recommendations can be discriminatory, unfair, inaccurate, or biased, if the data or the algorithms are flawed, incomplete, or skewed.

For example, people can be misclassified, misidentified, or judged negatively, and such errors or biases may disproportionately affect certain demographics.

 

Solutions to address privacy concerns

The solutions to address these concerns are actually not new, they are covered pretty good by the GDPR and other privacy laws world-wide.

They are :

Data Minimization

Organizations should adopt a data minimization approach, collecting only the data necessary for security purposes.  This is definitely not as easy as it sounds.

In Security, you usually collect as much as possible, because the more you know about your target, the better it is for the ML model (better detection, less false positives).

However, the Compliance dept. should be involved from the early stages of developing the product in order to control what is being collected.

 

Anonymization

Anonymizing user data can be a privacy-enhancing technique. By removing personally identifiable information from collected data, the risk of individual users being identified is reduced.

This works good when data is collected from many computers, but when the solution works on a single computer, it usually needs time to “learn” the user’s behavior.

There is nothing anonymous there and this is usually OK, as long as this data is not sent to the backend for further processing and analysis.

 

Encryption

Encrypting the data collected for AI analysis ensures that even if a breach occurs, the information remains unreadable and inaccessible to unauthorized parties.

When “cleaned up” data needs to be sent, it is mandatory to send it encrypted and keep it at rest encrypted all the time.

 

Informed consent

Transparently informing users about data collection and obtaining their explicit consent is a fundamental step in addressing privacy concerns.

Users should have the option to opt in or out of data collection at any time. It is mandatory for the ML models to be able to cope without any datasets, because they could disappear at any time.

 

Data deletion

After the data is no longer needed for security analysis, organizations can ideally erase the data, and if this is not possible, then it should remove any direct or indirect associations with individual users.

Balancing Security and Privacy

Balancing AI-based endpoint security and privacy is essential. Organizations can adopt the following strategies to minimize privacy concerns:

  • Implement Strong Privacy Policies

Establish comprehensive privacy policies that clearly define data collection, usage, retention, and disposal procedures. These policies should adhere to legal and regulatory requirements for the region where the users reside (GDPR, CPA, etc.).

This can by itself be a challenging task, because no company is willing to block access to potential customers.

 

  • Regular risk assessment and impact analysis

Conduct periodic risk assessment and impact analysis to ensure that data collection and analysis practices align with privacy policies and legal requirements and correct any deviations promptly.

The audits should be first performed internally, in order to have time to fix any deviations. If an external audit body finds any irregularity, the company can be fined with large sums of money.

 

  • Third-Party Vetting

When using third-party AI solutions, organizations should thoroughly vet the security and privacy practices of these providers.

 

  • Ongoing Monitoring

Continuously monitor the effectiveness of privacy protection measures and adjust them as needed to address emerging privacy concerns.

 

Conclusion

AI-based endpoint security is a powerful tool for protecting devices and data from cyber threats. However, it should not come at the cost of user privacy or well-being.

Organizations must strike a delicate balance by implementing privacy-enhancing measures, obtaining informed consent, and adhering to transparent data collection and usage practices.

 

 

PS: The image of the post was generated using DALL-E.

 

The post Balancing functionality and privacy concerns in AI-based Endpoint Security solutions first appeared on Sorin Mustaca on Cybersecurity.

Thoughts on AI and Cybersecurity

/in

Being an CSSLP gives me access to various emails from (ISC)2. One of these announced me that there is a recording of a webinar about AI and Cybersecurity held by Steve Piper from CyberEdge.

Very nice presentation of 1h, and I found out that there is a sequel to that on November 1st.

So, following Steve’s article, I did some research, read a lot and used ChatGPT to summarize some of my findings.

This article explores the multifaceted ways AI is transforming cybersecurity, from threat detection to incident response and beyond. It also looks into What it means actually to use AI in some of these fields. What is the impact on privacy and confidentiality?

Important to keep in mind that any AI must first learn (trained) in order to be able to understand the system and then potentially predict what is happening.

 

  1. Threat Detection

One of the primary applications of AI in cybersecurity is threat detection. Traditional rule-based systems are no longer sufficient to identify and combat sophisticated attacks.

AI-driven technologies, such as machine learning and deep learning, can analyze massive datasets to detect anomalies and potential threats.

Here’s how:

a. Anomaly Detection: AI algorithms can establish a baseline of normal behavior in a network or system. Any deviation from this baseline can trigger an alert, indicating a potential security breach.

b. Behavioral Analysis: AI can analyze user and entity behavior to detect patterns that may indicate malicious activity. This is particularly useful for identifying insider threats.

c. Malware Detection: AI can scan files and code for patterns consistent with known malware or recognize behavioral patterns of malicious software.

We’ll talk more in the future on this topic.

 

  1. Predictive Analysis

AI-driven predictive analysis enhances cybersecurity by identifying potential threats before they become full-blown attacks.

By crunching vast amounts of historical data, AI systems can predict emerging threats, trends, and vulnerabilities. This early warning system allows organizations to preemptively shore up their defenses.

It would have to gather huge amounts of data, crunch them (preprocess, normalize, structure), creating an ML model and then based on the chosen technology train the system.

Here we can think of supervised (pre-categorized data, requiring feature to be defined) and unsupervised learning (non categorized data, basically being restricted to Anomaly detection).

There is a huge warning here, because :

a) such huge amounts of data has to come from somewhere and

b) predictions can be influenced by specially crafted training data, for unsupervised training models.

 

  1. Automation and Orchestration

AI can automate routine cybersecurity tasks and workflows, reducing the workload on human analysts and minimizing response times. AI-driven systems can:

a. Automatically quarantine infected devices or isolate compromised areas of a network to prevent lateral movement by attackers.

b. Investigate and analyze security incidents, rapidly categorizing and prioritizing alerts.

c. Initiate predefined incident response procedures, such as patching vulnerable systems or resetting compromised user accounts.

 

Automation:

Automation involves the use of technology, such as scripts, workflows, or AI-driven systems, to perform routine and repetitive tasks without human intervention. In the context of cybersecurity, automation can significantly improve efficiency and response times by handling various operational and security-related processes automatically. Here’s how it works:

a. Incident Response: When a security incident is detected, automation can trigger predefined actions to contain, investigate, and mitigate the threat. For example, if a system detects a malware infection, an automated response might involve isolating the affected device from the network, blocking the malicious IP address, and initiating a forensic investigation.

b. Vulnerability Patching: Automation can be used to deploy security patches and updates to systems and software as soon as they are released. This reduces the window of vulnerability and helps prevent attacks that target known vulnerabilities.

c. Log Analysis and Alerts: Automation can continuously monitor logs and events from various systems. It can detect and respond to predefined security events, generating alerts or triggering specific actions when unusual or malicious activity is detected.

 

Orchestration:

Orchestration is a broader concept that focuses on integrating and coordinating various security tools, processes, and workflows into a unified and streamlined system. It enables organizations to create end-to-end security workflows by connecting different security solutions and ensuring they work together cohesively. Here’s how it works:

a. Workflow Integration: Orchestration systems allow the creation of predefined security workflows that link multiple tools, such as firewalls, intrusion detection systems, antivirus software, and incident response platforms. For example, when a malware alert is triggered, orchestration can coordinate the response by isolating the affected system, collecting forensic data, and alerting the incident response team.

b. Information Sharing: Orchestration enables the sharing of critical information among security tools. This ensures that all relevant security solutions have access to the latest threat intelligence, allowing for more effective threat detection and mitigation.

 

  1. Phishing Detection

Phishing attacks remain a prevalent threat. AI can help identify phishing attempts by:

a. Analyzing email content and sender behavior to identify suspicious emails.

b. Scanning URLs for malicious domains or suspicious patterns.

c. Inspecting attachments for known malware signatures.

d. Recognizing social engineering techniques and language used in phishing emails.

 

  1. Network Security

AI-driven intrusion detection systems (IDS) and intrusion prevention systems (IPS) monitor network traffic for anomalies and threats.

They can identify and block malicious traffic in real-time, protecting the network from various attacks, including DDoS attacks and data exfiltration.

 

  1. Threat Intelligence

AI can be used to aggregate and analyze threat intelligence from various sources, including open-source feeds, dark web monitoring, and industry-specific data.

This aggregated intelligence can help security teams stay informed about emerging threats and vulnerabilities.

 

  1. Endpoint Security

AI-driven endpoint security solutions provide real-time protection for individual devices.

They can identify and mitigate threats at the device level, even when the device is not connected to the corporate network. This is especially crucial for remote workers and mobile devices.

This raises another red flag for me: complete monitoring of user’s actions on the device. What happens to the data gathered, is the model trained locally on in the cloud? And many other such concerns.

I will write a dedicated post about AI and Privacy very soon.

The post Thoughts on AI and Cybersecurity first appeared on Sorin Mustaca on Cybersecurity.

Authentication vs. Authorization

/in

These two fundamental concepts play a pivotal role in ensuring the integrity and security of digital systems.

While these terms are often used interchangeably, they represent distinct and equally essential aspects in the world of identity and access management (IAM), which safeguards sensitive information and resources .

Executive summary

Authentication confirms that users are who they say they are. Authorization gives those users permission to access a resource.

The relationship between authentication and authorization is symbiotic. Authentication precedes authorization, as it’s imperative to confirm an entity’s identity before permitting or denying access.

 

Details

Authentication: Proving Identity

Authentication is the process of verifying the identity of a user, system, or entity attempting to access a particular resource, system, or network.

It aims to answer the fundamental question: “Who are you?” and “Are you who you say you are?”.

In other words, the purpose of authentication is to ensure that the entity requesting access is indeed who they claim to be.

A successful authentication process provides a digital identity, often represented by a username or user ID, that can be used for subsequent authorization.

For answering these questions, authentication typically relies on one or more factors, categorized as:

  1. Something you know: This factor involves information only the user should know, such as a password, PIN, or passphrase.
  2. Something you have: This includes possession of a physical object like a smart card, token, or mobile device.
  3. Something you are: Also known as biometrics, this factor uses unique physical or behavioral attributes like fingerprints, retinal scans, or voice recognition.

 

Authorization: Granting Permissions

Authorization takes place after a successful authentication.

Authorization is the process of determining what a user, system, or entity can do after they’ve been authenticated.

It answers the question: “What are you allowed to do?”.

To implement this, authorization is typically implemented through access control policies, which dictate which actions a user is allowed to perform, what data they can access, and the extent of their privileges.

Access control decisions can be based on various factors, including user roles, permissions, and the context in which a request is made.

 

Have a look for more demystifying terms:

Demystifying cybersecurity terms: Policy, Standard, Procedure, Controls, Framework, Zero Trust

 

 

The post Authentication vs. Authorization first appeared on Sorin Mustaca on Cybersecurity.

Demystifying cybersecurity terms: Policy, Standard, Procedure, Controls, Framework, Zero Trust

/in

I am often asked what is the difference between Policy, Standard, Procedure in cybersecurity.

Well, here it is:

1. Cybersecurity Standard

A cybersecurity standard is a set of guidelines, criteria, or best practices that organizations follow to ensure that their security controls and procedures align with industry standards or regulatory requirements. Standards provide a benchmark for measuring security maturity and often serve as a reference for audits and assessments. Common cybersecurity standards include ISO 27001, NIST Cybersecurity Framework, and CIS Controls.

2. Cybersecurity Framework

A cybersecurity framework is a structured approach to managing and improving an organization’s cybersecurity posture. It’s a comprehensive set of best practices, guidelines, and tools designed to help organizations assess, develop, and enhance their cybersecurity programs. Frameworks provide a strategic perspective and often include a collection of policies, procedures, controls, and standards. Prominent frameworks include NIST Cybersecurity Framework, CIS Critical Security Controls, and ISO 27001.

As can be seen, a standard often doesn’t come alone, it comes with a framework, which allows the implementer to start quickly and create a basis for the cybersecurity implementation.

3. Cybersecurity Policy

A cybersecurity policy is a foundational document that sets the overarching principles and guidelines for an organization’s security posture. It is a high-level, strategic document that outlines the organization’s commitment to security, the roles and responsibilities of individuals and departments in safeguarding assets, and the consequences of non-compliance. Cybersecurity policies are essential for aligning security efforts with business goals and regulatory requirements.

4. Cybersecurity Procedure

While policies provide a high-level framework, procedures are the detailed step-by-step instructions that help employees or security personnel implement the policies effectively. Procedures are specific and actionable, often detailing how to respond to security incidents, configure software securely, or conduct security audits. They ensure consistency and best practices are followed in day-to-day operations.

5. Cybersecurity Control

Controls are measures, safeguards, or countermeasures that organizations put in place to protect their information systems and data. Controls can be technical, administrative, or physical in nature. They are designed to mitigate risks by preventing, detecting, or responding to security threats. Examples include firewalls, access controls, encryption, and antivirus software.

In summary, these four terms play distinct but interrelated roles in the world of cybersecurity. Policies set the overarching goals and principles, procedures provide the detailed instructions for implementation, controls are the measures and safeguards in place to protect against threats, and standards offer a reference point to ensure compliance with established best practices.

Effective cybersecurity requires a holistic approach that encompasses all these elements. By establishing clear policies, well-documented procedures, robust controls, and adherence to industry standards, organizations can better defend themselves against the ever-evolving threat landscape and protect their sensitive data and digital assets.

6. Zero Trust

Zero Trust in Cybersecurity: from myth to the guide

 

7. Authentication and Authorization

https://www.sorinmustaca.com/authentication-vs-authorization

 

The post Demystifying cybersecurity terms: Policy, Standard, Procedure, Controls, Framework, Zero Trust first appeared on Sorin Mustaca on Cybersecurity.

Zero Trust in Cybersecurity: from myth to the guide

/in

Every single day I read news on various portals and on LinkedIn and I encounter a lot of buzz words.

Most of the time I just smile recognizing the marketing b**it, and continue to scroll…

This time, I found an article from the Germany’s Federal Bureau of Information Security (BSI) and it was about Zero Trust (DE). Note, this is summary, meant to be full of buzzwords, not a guide or anything similar.

I have to say that Zero Trust used to be a lot more prominent in the Corona years, between 2020 and 2022 than it is now. This shows also the history on IT Security News and Google Trends.

 

What is Zero Trust?

Zero Trust is a cybersecurity framework designed to address the limitations of traditional perimeter-based security models. Oh, if you didn’t read the article on cybersecurity framework, go there and give it a try.

In the past, companies would rely on firewalls and trust the inside network while treating the outside as a potential threat.

Zero Trust, on the other hand, assumes that threats can originate from both inside and outside the network. It promotes a “never trust, always verify” approach or how we usually say, to be politically correct, “trust is good, but control is better”.

 

Core principles

1. Identity Verification

Before granting access every user, device and application attempting to access network resources must go through a verification process.

2. Limited Access Privileges

Users and systems should only have access to the resources, for their tasks; nothing

3. Micro Segmentation

The network is split into separate sections to limit the spread of threats.

4. Continuous Monitoring

Constantly observing and analyzing network activity, user actions and system well being, in time.

5. Flexible Access Control

Access permissions can adjust dynamically depending on the users actions, device security status and contextual factors.

 

Why Zero Trust is such a popular term

Zero Trust is not exclusive to any industry or company size. It can be implemented by any organization looking to enhance its cybersecurity posture. Whether you’re a business or a multinational corporation Zero Trust can be tailored according to your requirements.

Due to the COVID 19 restrictions, all companies had to increase the reliance on cloud services, implement remote work, and proliferate mobile devices, which resulting in an expanded traditional network perimeter.

This transformation has made organizations more vulnerable to cyberattacks.

To summarize, these are the main reasons why Zero Trust has become so popular:

1. Changing Nature of Cyber Threats

With cyber threats becoming advanced and unpredictable organizations need to take measures to defend against them.

2. Impact of Remote Work

The COVID 19 pandemic has accelerated the adoption of work rendering traditional network perimeters ineffective.

3. Embracing Cloud Services

As businesses shift towards cloud computing, data and applications are no longer limited to, on premises environments.

4. Adherence to Data Privacy Regulations

Compliance with data privacy regulations like GDPR and CCPA necessitates the implementation of data protection measures.

Implementing the Zero Trust framework

There is nothing new here, the same steps apply as to any other cybersecurity framework and ISMS.

I will not go into details about it, just go back and read these articles on ISMS and NIS2.

1. Identify and classify your digital assets

2. Implement strong user authentication methods, verify their identities before granting access

3. Ensure that users and systems have the minimum necessary access permissions.

4. Segment your network into smaller zones to limit lateral movement in case of a breach.

5. Deploy real-time monitoring and analysis tools to track anomalies

6. Implement Adaptive Access Control

7. Encrypt data both in transit and at rest

8. Conduct regular security audits

9. Educate employees about the importance of security

10. Develop an Incident Response Plan

 

The post Zero Trust in Cybersecurity: from myth to the guide first appeared on Sorin Mustaca on Cybersecurity.

NIS2: 3.Establish a cybersecurity framework

/in

We wrote here https://www.sorinmustaca.com/how-to-nis2-eu-directive/ that the 3rd  step in implementing the requirements of the directive is to establish a cybersecurity framework.

If you haven’t read what a cybersecurity framework means, then you should read article: https://www.sorinmustaca.com/demystifying-cybersecurity-terms-policy-standard-procedure-controls-framework/ .

 

Establishing a cybersecurity framework is critically important for organizations of all sizes and types because it is the basis on which you build your cybersecurity. The cybersecurity framework is the basis of the ISMS, which represents the plan of your cybersecurity strategy.

 

Why it is essential to have a cybersecurity framework

In case you still wonder if you need a cybersecurity framework, here are several key reasons why it is essential:

  1. Protection against Cyber Threats
    Cyber threats are constantly evolving and becoming more sophisticated. A cybersecurity framework provides a structured approach to identifying and mitigating these threats, reducing the risk of data breaches, cyberattacks, and other security incidents.
  2. Risk Management
    Cybersecurity frameworks help organizations assess their cybersecurity risks and prioritize their efforts to address the most critical vulnerabilities. This risk-based approach ensures that resources are allocated where they are needed most.
  3. Compliance and Legal Requirements
    Many industries and regions have specific cybersecurity regulations and legal requirements that organizations must adhere to. A cybersecurity framework provides a roadmap for meeting these compliance obligations, reducing the risk of fines and legal repercussions.
  4. Business Continuity
    Cybersecurity incidents can disrupt business operations, leading to downtime, financial losses, and damage to reputation. A well-structured cybersecurity framework helps organizations prepare for and respond to incidents, minimizing their impact and ensuring business continuity.
  5. Protection of Sensitive Data
    Organizations store vast amounts of sensitive and confidential data, including customer information, financial records, and intellectual property. A cybersecurity framework helps safeguard this data from unauthorized access or theft.
  6. Preservation of Reputation
    A security breach can seriously damage an organization’s reputation and erode customer trust. Implementing a cybersecurity framework demonstrates a commitment to security, which can enhance the organization’s reputation and instill confidence among customers, partners, and stakeholders.
  7. Cost Savings
    Proactively addressing cybersecurity through a framework can ultimately save an organization money. Preventing security incidents is more cost-effective than dealing with the aftermath of a breach, which can involve significant financial and legal expenses.
  8. Consistency and Standardization
    Cybersecurity frameworks promote consistency and standardization of security practices across an organization. This is especially important in larger enterprises with multiple locations, business units, or teams, ensuring that security measures are applied uniformly.
  9. Continuous Improvement
    Cyber threats and technology evolve rapidly. A cybersecurity framework emphasizes the importance of ongoing monitoring, assessment, and improvement, helping organizations stay ahead of emerging threats and vulnerabilities.
  10. Competitive Advantage
    Having a robust cybersecurity framework can be a competitive advantage. It can differentiate an organization in the eyes of customers, partners, and investors who prioritize security when choosing business partners.

Steps to Choose or Create a Cybersecurity Framework

Choosing a cybersecurity framework is a tedious process and potentially long. If you want to succeed, then you need to plan for it. In order to create a project plan, follow these milestones:

  1. Assess Organizational Needs and Objectives
    Begin by understanding your organization’s specific cybersecurity needs, objectives, and goals. Consider the industry you operate in, the types of data you handle, and your organization’s size and complexity.
  2. Identify Relevant Regulations and Standards
    Determine which cybersecurity regulations, standards, and compliance requirements are applicable to your organization. These may include GDPR, HIPAA, ISO 27001, NIST, CIS Controls, TISAX, ISO 21434 and industry-specific regulations.
  3. Conduct a Risk Assessment
    Perform a comprehensive risk assessment to identify potential cybersecurity threats, vulnerabilities, and the potential impact of security incidents. This assessment will help you prioritize security measures.
  4. Define Your Scope
    Clearly define the scope of your cybersecurity efforts. Consider which systems, data, and assets are in scope for protection and compliance efforts. Document this scope in detail.
  5. Research Existing Frameworks
    Investigate existing cybersecurity frameworks and standards that align with your organization’s needs and objectives. Consider well-established frameworks like NIST Cybersecurity Framework, ISO 27001, CIS Controls, and others.
    Have a look here to view a comparison. Consider country-specific frameworks like the recommendations or requirements from your country’s information security agency.
  6. Evaluate Framework Alignment
    Evaluate how closely each candidate framework aligns with your organization’s requirements, risk assessment findings, and compliance obligations. Consider factors like ease of implementation and ongoing maintenance.
  7. Customization vs. Adoption
    Decide whether to adopt an existing framework as-is or customize it to fit your organization’s specific needs. Customization may be necessary to address unique risks or industry-specific requirements.
  8. Engage Stakeholders
    Involve key stakeholders, including senior leadership, IT teams, compliance experts, and legal advisors, in the decision-making process. Ensure their input and buy-in throughout the framework selection or development process.
  9. Develop Framework Documentation
    If you choose to customize or create a framework, develop comprehensive documentation that outlines the framework’s policies, procedures, controls, and guidelines. This documentation serves as a roadmap for the implementation of the ISMS.
  10. Implement and Test
    Begin implementing the selected or customized framework within your organization. Test its effectiveness in addressing cybersecurity risks and compliance requirements.
  11. Training and Awareness
    Train employees and raise awareness about the cybersecurity framework, its policies, and best practices. Ensure that everyone in the organization understands their role in maintaining security.
  12. Continuous Monitoring and Improvement
    Establish ongoing monitoring and assessment processes to ensure the framework’s effectiveness. Regularly review and update the framework to adapt to evolving threats and technology.

 

Key Considerations When Choosing or Creating a Cybersecurity Framework

There are some things to keep in mind when implementing the project plan for choosing the cybersecurity framework. The project can easily go out of scope because of the security landscape continuously changing.

Please review regularly these considerations and make sure you go through the list before taking any big decisions.

  1. Alignment with Objectives: Ensure that the chosen framework aligns with your organization’s cybersecurity objectives, risk profile, and compliance requirements.
  2. Applicability: Consider the framework’s applicability to your industry and specific business needs.
  3. Resource Requirements: Assess the resources (financial, human, and technological) required for framework implementation and maintenance.
  4. Scalability: Determine whether the framework can scale with your organization’s growth and evolving cybersecurity needs.
  5. Integration: Ensure that the framework can integrate with existing security technologies and processes within your organization.
  6. Cost vs. Benefit: Evaluate the cost-effectiveness of implementing and maintaining the framework relative to the expected security benefits and risk reduction.
  7. Accessibility of Expertise: Consider the availability of expertise and training resources related to the chosen framework.
  8. Audit and Certification: If compliance or certification is a goal, verify that the framework is recognized and accepted by relevant certification bodies or authorities.
  9. Legal and Privacy Considerations: Ensure that the framework supports compliance with relevant data protection and privacy laws.
  10. Flexibility: Assess the framework’s flexibility to adapt to changing threat landscapes and emerging technologies.

 

Conclusions

Having a robust cybersecurity framework can be a competitive advantage. It can differentiate an organization in the eyes of customers, partners, and investors who prioritize security when choosing business partners.

Remember that selecting or creating a cybersecurity framework is not a one-size-fits-all process. It should be a thoughtful and strategic decision that aligns with your organization’s unique needs and circumstances.

Establishing a cybersecurity framework is essential to protect an organization’s digital assets, manage risks effectively, comply with legal requirements, and maintain the trust of stakeholders.

 

The post NIS2: 3.Establish a cybersecurity framework first appeared on Sorin Mustaca on Cybersecurity.