[et_pb_section fb_built=”1″ _builder_version=”3.22″ da_disable_devices=”off|off|off” global_colors_info=”{}” da_is_popup=”off” da_exit_intent=”off” da_has_close=”on” da_alt_close=”off” da_dark_close=”off” da_not_modal=”on” da_is_singular=”off” da_with_loader=”off” da_has_shadow=”on”][et_pb_row _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.14.5″ _module_preset=”default” global_colors_info=”{}”]
Strategy struggling CISO? Commiserate with Sisyphus
How do I start? Ask Prometheus
Do you finish every book you begin? I learned how to read a book, years ago, from Mortimer Adler’s How To Read A Book. Combine that with Adam Robinson’s What Smart Students Know and you have blueprints and tactics to extract maximum value out of nonfiction books.
With these tools in hand, it’s a rare nonfiction book that will capture my attention for every page. My goal is to deconstruct the book and extract every bit of useful knowledge from it. Sounds more like eating than reading, doesn’t it?
Of all the dry, overcooked, under-seasoned reading offerings, the NIST SP 800-53 is a centerpiece. The plot drags, there’s too little chemistry between the protagonist and the romantic interest, and… and I may have mixed my notes up. NIST’s guidance isn’t intended to keep you up at night, rapt with attention.
Using Adler’s and Robinson’s guidance, you can consume all the caloric value from NIST and neither waste time nor leave any meat on the bone.
Let’s start with the NIST’s plan-do-check-act approach to information security: Identify, Protect, Detect, Respond, and Recover. NIST is going to open your eyes to a dynamic and pragmatic approach to information security.
If you ever took martial arts lessons, you remember that learning to step well allows you to fight well. Learning to stand well, allows you to shoot well. Learning to hold the pencil properly yields legible handwriting.
NIST will show you how to turn on your strategic instincts and validate the ones you already rely on — and practiced with Bloom, CISO! Are you ready?
[/et_pb_text][/et_pb_column][/et_pb_row][et_pb_row column_structure=”1_2,1_2″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”1_2″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]
A third-party had just concluded a review of security maturation and efficacy, a report was compiled, and our grades were these:
[/et_pb_text][/et_pb_column][et_pb_column type=”1_2″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https://lucidum.io/wp-content/uploads/2020/10/a27d24_7c5771b8c358452ab1de5dcc3fb6a069_mv2.webp” alt=”NIST phase chart” _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][/et_pb_image][/et_pb_column][/et_pb_row][et_pb_row column_structure=”1_2,1_2″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”1_2″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https://lucidum.io/wp-content/uploads/2020/10/a27d24_2840cb4e0d774618b45cb351a329faa3_mv2.webp” alt=”NIST phase chart” _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][/et_pb_image][/et_pb_column][et_pb_column type=”1_2″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]
Owing to our winning personalities, clever laptop stickers, and luxurious kitchens on every floor, the third-party rounded up our average. Final score:
[/et_pb_text][/et_pb_column][/et_pb_row][et_pb_row _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.14.2″ _module_preset=”default” text_font_size=”26px” global_colors_info=”{}”]
That is not just hand waving and being too clever by half. This is how security works. Each layer builds upon its prior foundation. As the tower grows higher, more weight and pressure are placed upon the foundational flaws. Weak foundations, like unsteady legs on a boxer, presage disaster.
[/et_pb_text][/et_pb_column][/et_pb_row][et_pb_row _builder_version=”3.25″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”3.25″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]
TRIVIA BREAK!
[/et_pb_text][/et_pb_column][/et_pb_row][et_pb_row column_structure=”1_2,1_2″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”1_2″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]
The Matryoshka “little matron” dolls are also called Russian nesting dolls. Within a single large doll is another, and so on until five, six, or more dolls are revealed in decreasing size. They are relatively modern, and their creation is attributed to Vasily Zvyozdochkin in 1890. Interestingly, a matryoshka set must be made from one piece of wood because the expansion/contraction properties, moisture content, and wood grains must remain together. Adding a unit from another set ruins the fit and can crack the pieces or stick them together.
[/et_pb_text][/et_pb_column][et_pb_column type=”1_2″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https://lucidum.io/wp-content/uploads/2020/10/a27d24_ebc7c7d3d2e24568ba9a00ac12de7dd4_mv2-1.webp” alt=”Un-nested Russian Dolls” align=”center” _builder_version=”4.14.2″ _module_preset=”default” transform_translate=”0px|63px” global_colors_info=”{}”][/et_pb_image][/et_pb_column][/et_pb_row][et_pb_row _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.14.2″ _module_preset=”default” text_font_size=”36px” global_colors_info=”{}”]
What do matryoshka dolls have to do with NIST and cybersecurity?
[/et_pb_text][et_pb_text _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]
NIST phases, matryoshka dolls, and spyglasses are all ordered subsets of the prior set. Every smaller doll fit within the larger. The entire pirate spyglass collapses into the largest cylinder. Every phase in NIST is constrained by the Identify.
[/et_pb_text][et_pb_text _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]
Let’s put this into action using an actual scenario….
[/et_pb_text][et_pb_text _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]
When I was in school, a ‘C’ was a 70%. That ‘C’ or ‘average’ grade I was given in Identify is then a 70.
Out of 100% coverage, my Identify controls hit 70%.
This is probably average. Feels good to be average here — everyone I know is really struggling. I’ll take that average and call it a win.
[/et_pb_text][et_pb_text _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]
Besides, how important can it be if everyone I know fails here but still seems okay?
[/et_pb_text][et_pb_text _builder_version=”4.14.2″ _module_preset=”default” text_font_size=”36px” global_colors_info=”{}”]
“Would you please show me what you intended to deliver to the board had I not been hired?”
[/et_pb_text][et_pb_text _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]
Then we move to Protect. It’s nested inside Identify.
So I am forced to ask myself: how well have I protected what I have not identified?
Was there a plan to protect my unknowns? How effective is it?
[/et_pb_text][/et_pb_column][/et_pb_row][et_pb_row column_structure=”1_2,1_2″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”1_2″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]
Math tells me my 70% Identify control, combined with my 70% Protect control yields a score of 49%. Seventy percent of seventy is 49%. I have lost my B+ average and I’m only 2/5ths of the way in. My ‘B’ grade in Monitor doesn’t help. Even assuming my ‘A’ grades are 100% does not raise this sinking ship. In the end, my real score is halfway to a C. I am nowhere near a B+. The cascade of failure has begun and now I am earning interest.
[/et_pb_text][/et_pb_column][et_pb_column type=”1_2″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https://lucidum.io/wp-content/uploads/2020/10/a27d24_e0548250e46c46b58664c9f120d4da73_mv2.webp” alt=”NIST phase chart” _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][/et_pb_image][/et_pb_column][/et_pb_row][et_pb_row _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]
That is not just hand waving and being too clever by half. This is how security works. Each layer builds upon its prior foundation. As the tower grows higher, more weight and pressure are placed upon the foundational flaws. Weak foundations, like unsteady legs on a boxer, presage disaster.
Now let’s red team this approach.
What would you do if you wanted to build a better boxer? You would build strong legs.
What would you do if you want to improve all your scores and build a better cybersecurity program?
You would start with Identify.
[/et_pb_text][/et_pb_column][/et_pb_row][et_pb_row _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https://lucidum.io/wp-content/uploads/2020/10/a27d24_6b98b7fd0237454499e72910ebe3f16f_mv2.webp” alt=”NIST phase chart” _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][/et_pb_image][et_pb_text _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]
Left of bang.
Shift left.
Inflection point.
Maximize return on investment.
Call it whatever euphemism clicks, I want to earn interest on a positive investment and stop earning vig on a loan to leg breakers.
In cybersecurity, because of the set and subset relationship, a ten percent improvement in Identify is inherited through the remaining controls without any direct intervention within those controls.
Did you identify a previously unknown Mac?
Now that JAMF is on it, it endpoint is caught up in the patching cycle improving Protect.
Identify a set of S3 buckets that were world-readable?
A group of engineers who had wiped the original operating system and installed Debian?
In every instance better Identify drives better Protect.
And: better Protect is constrained by not-so-good Identify.
Is this good strategy?
Does it answer the question, “What can I do now with my resources so that I’ll be in a position to make more, beneficial decisions?”
You bet it does.
[/et_pb_text][/et_pb_column][/et_pb_row][/et_pb_section]