nach oben

Erschienen in:

2019 | OriginalPaper | Buchkapitel

4. Frameworks and Best Practices

verfasst von : Brianna Keys, Stuart Shapiro

Erschienen in: Cyber Resilience of Systems and Networks

Verlag: Springer International Publishing

Einloggen

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config

KI-gestützte Suche

Aus

Abstract

The second part of the book focuses on approaches to assessment and analysis of cyber resilience. Having discussed, in the previous two chapters, perspectives on quantifying cyber resilience, we now present several chapters that assemble qualitative and quantitative inputs for a broad range of metrics that might apply to cyber resilience. Some of these approaches (e.g., most of this chapter and the next one) are largely qualitative and based on human review and judgment of pertinent aspects of systems, organization, and processes. Other is based on quantitative and often theoretically rigorous modeling and simulation of systems, networks, and processes.

The purpose of this chapter is to outline best practices in an array of areas related to cyber resilience. While by no means offering an exhaustive list of best practices, the chapter provides an organization with means to “see what works” at other organizations. It offers these best practices within existing frameworks related to dimensions of cyber resilience. The chapter begins with a discussion of several existing frameworks and guidelines that can be utilized to think about cyber resilience. Then, the chapter describes a set of “best practices” based on a selection of metrics from these frameworks. These best practices can help an organization as a guide to implementing specific policies that would improve their cyber resilience.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

über 102.000 Bücher
über 537 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Finance + Banking
Management + Führung
Marketing + Vertrieb
Maschinenbau + Werkstoffe
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 390 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Maschinenbau + Werkstoffe

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 340 Zeitschriften

aus folgenden Fachgebieten:

Bauwesen + Immobilien
Business IT + Informatik
Finance + Banking
Management + Führung
Marketing + Vertrieb
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Vorheriges Kapitel Metrics Based on the Mission Risk Perspective

Nächstes Kapitel Analysis of Dependencies

Linkov, I., Eisenberg, D. A., Plourde, K., Seager, T. P, Allen, J., & Kott, A. (2013). Resilience Metrics for Cyber Systems. Environment Systems and Decisions, 33(4), 471.

National Research Council. (2012). Disaster Resilience: A National Imperative. The National Academies Press. Retrieved from http://nap.edu/13457

Alberts, D. (2002). Information age transformation, getting to a twenty-first century military. DOD Command and Control Research Program. Retrieved from http://www.dtic.mil/get-tr-doc/pdf?AD=ADA457904

National Institute of Standards and Technology. (2014). Framework for Improving Critical Infrastructure Cybersecurity. Retrieved from http://www.nist.gov/cyberframework/upload/cybersecurity-framework-021214.pdf

Ibid.

Pfeiffer, M. (2015). Managing Technology Risks Through Technological Proficiency. Retrieved from http://blousteinlocal.rutgers.edu/managing-technology-risk/

Ibid.

We used our best judgment to place the NIST metrics in the appropriate cell.

Wind River. (2015). Security in the Internet of Things: Lessons from the Past for the Connected Future. Page 4. Retrieved from http://www.windriver.com/whitepapers/security-in-the-internet-of-things/wr_security-in-the-internet-of-things.pdf

Ibid.

U.S. Department of Homeland Security. Cybersecurity & Privacy. Retrieved from https://www.dhs.gov/sites/default/files/publications/privacy_cyber_0.pdf

Contos, B. (2015). Cyber Security Culture Is A Collective Effort. Retrieved from http://www.csoonline.com/article/2977014/security-awareness/cyber-security-culture-is-a-collective-effort.html

Ibid.

How to Create A Cyber Security Culture + Employee Security Awareness. Retrieved from http://www.hedgeco.net/blogs/2016/03/11/cybersecurity-plans/

The Financial Industry Regulatory Authority. (2015). Report on Cybersecurity Practices. Retrieved from https://www.finra.org/sites/default/files/p602363%20Report%20on%20Cybersecurity%20Practices_0.pdf

Ibid.

FitzGerald, B., & Sander, A. (2015). Opinion: Cybersecurity Collaboration Needs A Toolkit. So We Built A Prototype. Retrieved from http://www.csmonitor.com/World/Passcode/Passcode-Voices/2015/1204/Opinion-Cybersecurity-collaboration-needs-a-toolkit.-So-we-built-a-prototype

Pielocik, M. (2004). Social Engineering: The Friendly Hacker. Page 12. SANS Institute. Retrieved from https://www.giac.org/paper/gsec/3792/social-engineering-the-friendly-hacker/106104

Proffitt, T. (2007). Creating and Managing an Incident Response Team for a Large Company. Page 15. SANS Institute. Retrieved from https://www.sans.org/reading-room/whitepapers/incident/creating-managing-incident-response-team-large-company-1821

Brown, M. J., Stikvoort, D., Kossakowski, K., Killcrece, G., Ruefle, R., & Zajicek, M. (2003). Handbook for Computer Security Incident Response Teams (CSIRTs). Retrieved from http://repository.cmu.edu/cgi/viewcontent.cgi?article=1570&context=sei

Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer Security Incident Handling Guide. Retrieved from http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

Helms, M. M. Best Practices for Protecting Employee Data in the Age of Cybersecurity Issues. Retrieved from http://hrprofessionalsmagazine.com/best-practices-for-protecting-employee-data-in-the-age-of-cybersecurity-issues/

SANS Institute. (2015). SANS Securing The Human 2015 Security Awareness Report. Retrieved from https://securingthehuman.sans.org/media/resources/STH-SecurityAwarenessReport-2015.pdf

NIST. (2013). Security and Privacy Controls for Federal Information Systems and Organizations. Retrieved from http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf?n=44819

PricewaterhouseCoopers. The Global State of Information Security Survey 2016. Retrieved from http://www.pwc.com/gx/en/issues/cyber-security/information-security-survey.html

Faughnder, R., & Hamedy, S. (2014). Sony insider – not North Korea – likely involved in hack, experts say. Retrieved from http://www.latimes.com/entertainment/envelope/cotown/la-et-ct-sony-hack-inside-job-not-north-korea-20141231-story.html

Linkov, I., Poinsatte-Jones, K., Trump, B., Ganin, A., & Kepner, J. (2017) Cyber Risk and Resilience: Rules and Regulations to Minimize Cyber Threats. In A. Kott and I. Linkov (Eds). Cyber Resilience (pp. 198–217). Springer.

Krocker, G. W. (2002). Disaster Recovery Plan Testing: Cycle the Plan, Plan the Cycle. SANS Institute InfoSec Reading Room. Retrieved from https://www.sans.org/reading-room/whitepapers/recovery/disaster-recovery-plan-testing-cycle-plan-plan-cycle-56

Ibid. Page 4.

Ibid.

There are several chapters in this book that address narrower aspects of structures and components. For more information about analysis of cyber-physical systems, see Karsai, G., Koutsoukos, X., Neema, H., Volgyesi, P., and Sztipanovits, J. Simulation-Based Analysis of Cyber Resilience in Cyber-Physical Systems. In A. Kott and I. Linkov (Eds). Cyber Resilience (pp. 130–148). Springer. For more information on assessing cyber dependencies, see Evans, N. Assessing Cyber Resilience: Cyber Dependencies. In A. Kott and I. Linkov (Eds). Cyber Resilience (pp. 130–148). Springer.

Rush, G. D. (2015). Cyber Security Research Frameworks for Coevolutionary Networks Defense. Retrieved from http://permalink.lanl.gov/object/tr?what=info:lanl-repo/lareport/LA-UR-15-29293

Paquet, C. (2013). Network Security Concepts and Policies. Cisco. Retrieved from http://www.ciscopress.com/articles/article.asp?p=1998559

Ibid.

CISCO. (2015). Network Security Policy: Best Practices White Paper. Retrieved from http://www.cisco.com/c/en/us/support/docs/availability/high-availability/13601-secpol.html

Security Magazine. (2016). Majority of Businesses Lack Resources to Manage External Cyber Attacks. Retrieved from http://www.securitymagazine.com/articles/87267-majority-of-businesses-lack-resources-to-manage-external-cyber-attacks

SANS Institute. (2016). Data Breach Response Policy. Retrieved from https://www.sans.org/security-resources/policies/general/pdf/data-breach-response

Bromiley, Matt. (2016). Incident Response Capabilities in 2016: The 2016 SANS Incident Response Survey. SANS Institute. Retrieved from https://www.sans.org/reading-room/whitepapers/incident/incident-response-capabilities-2016-2016-incident-response-survey-37047

SANS Institute. Incident Detection FAQs: What are the steps to handle an incident? Retrieved from https://www.sans.org/security-resources/idfaq/what-are-the-steps-to-handle-an-incident/5/1

CISCO. (2015). Network Security Policy: Best Practices White Paper. Retrieved from http://www.cisco.com/c/en/us/support/docs/availability/high-availability/13601-secpol.html

Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer Security Incident Handling Guide. Retrieved from http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

Ibid.

Cybenko, George. (2017) Metrics of Cyber Resilience. In A. Kott and I. Linkov (Eds). Cyber Resilience (pp. 26–38). Springer.

Bankrate. 11 data breaches that stung US consumers. http://www.bankrate.com/finance/banking/us-data-breaches-1.aspx

SANS Institute. (2015). Cleaning Up After a Breach, Post-Breach Impact: A Cost Compendium. https://www.sans.org/reading-room/whitepapers/analyst/cleaning-breach-post-breach-impact-cost-compendium-36517

Federal Financial Institutions Examination Council. Reputation Risk. IT Examination Handbook Infobase. http://ithandbook.ffiec.gov/it-booklets/retail-payment-systems/retail-payment-systems-risk-management/reputation-risk.aspx

Office of Personnel Management. (2015). Cyber Security Resource Center. https://www.opm.gov/cybersecurity/

See (https://www.dhs.gov/ciscp) for more details.

Cyber Threat Intelligence Network. Resources for Information Sharing and Analysis Organizations. Retrieved from http://ctin.us/site/isaos/

The Nextware Sessions. Retrieved from http://www.nextwaresessions.org

Ponemon Institute. (2016). 2016 Cost of Cyber Crime Study & the Risk of Business Innovation. Retrieved from http://www8.hp.com/us/en/software-solutions/ponemon-cyber-security-report/

Alberts, D. (2002). Information age transformation, getting to a 21st century military. DOD Command and Control Research Program. Retrieved from http://www.dtic.mil/get-tr-doc/pdf?AD=ADA457904

Bankrate. 11 data breaches that stung US consumers. http://www.bankrate.com/finance/banking/us-data-breaches-1.aspx

Bromiley, M. (2016). Incident response capabilities in 2016: The 2016 SANS Incident Response Survey. SANS Institute. Retrieved from https://www.sans.org/reading-room/whitepapers/incident/incident-response-capabilities-2016-2016-incident-response-survey-37047

Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer security incident handling guide. Retrieved from http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

CISCO. (2015). Network security policy: Best practices white paper. Retrieved from http://www.cisco.com/c/en/us/support/docs/availability/high-availability/13601-secpol.html

Contos, B. (2015). Cyber security culture is a collective effort. Retrieved from http://www.csoonline.com/article/2977014/security-awareness/cyber-security-culture-is-a-collective-effort.html

Cybenko, G. (2017). Metrics of cyber resilience. In A. Kott & I. Linkov (Eds.), Cyber resilience (pp. 26–38). Cham: Springer.

Cyber Threat Intelligence Network. Resources for information sharing and analysis organizations. Retrieved from http://ctin.us/site/isaos/

Evans, N. (2018). Assessing cyber resilience: Cyber dependencies. In A. Kott & I. Linkov (Eds.), Cyber resilience (pp. 130–148). Cham: Springer.

Federal Financial Institutions Examination Council. Reputation risk. IT Examination Handbook Infobase. http://ithandbook.ffiec.gov/it-booklets/retail-payment-systems/retail-payment-systems-risk-management/reputation-risk.aspx

Financial Industry Regulatory Authority. (2015). Report on cyber security practices. Retrieved from https://www.finra.org/sites/default/files/p602363%20Report%20on%20Cybersecurity%20Practices_0.pdf

FitzGerald, B., & Sander, A. (2015). Opinion: Cybersecurity collaboration needs a toolkit. So we built a prototype. Retrieved from http://www.csmonitor.com/World/Passcode/Passcode-Voices/2015/1204/Opinion-Cybersecurity-collaboration-needs-a-toolkit.-So-we-built-a-prototype.

Helms, M. M. Best practices for protecting employee data in the age of cybersecurity issues. Retrieved from http://hrprofessionalsmagazine.com/best-practices-for-protecting-employee-data-in-the-age-of-cybersecurity-issues/http://hrprofessionalsmagazine.com/best-practices-for-protecting-employee-data-in-the-age-of-cybersecurity-issues/

How to create a cyber security culture + employee security awareness. Retrieved from http://www.hedgeco.net/blogs/2016/03/11/cybersecurity-plans/

Karsai, G., Koutsoukos, X., Neema, H., Volgyesi, P., & Sztipanovits, J. (2018). Simulation-based analysis of cyber resilience in cyber-physical systems. In A. Kott & I. Linkov (Eds.), Cyber resilience (pp. 130–148). Evans: Springer.

Krocker, G. W. (2002). Disaster recovery plan testing: Cycle the plan, plan the cycle. SANS Institute InfoSec Reading Room. Retrieved from https://www.sans.org/reading-room/whitepapers/recovery/disaster-recovery-plan-testing-cycle-plan-plan-cycle-56

Linkov, I., Eisenberg, D. A., Plourde, K., Seager, T. P., Allen, J., & Kott, A. (2013). Resilience metrics for cyber systems. Environment Systems and Decisions, 33(4), 471.CrossRef

Linkov, I., Poinsatte-Jones, K., Trump, B., Ganin, A., & Kepner, J. (2017). Cyber risk and resilience: Rules and regulations to minimize cyber threats. In A. Kott & I. Linkov (Eds.), Cyber resilience (pp. 198–217). Cham: Springer.

National Institute of Standards and Technology. (2013). Security and privacy controls for federal information systems and organizations. Retrieved from http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf?n=44819

National Institute of Standards and Technology. (2014). Framework for improving critical infrastructure cybersecurity. Retrieved from http://www.nist.gov/cyberframework/upload/cybersecurity-framework-021214.pdf

National Research Council. (2012). Disaster resilience: A national imperative. The National Academies Press. Retrieved from http://nap.edu/13457

Nextware Sessions. Retrieved from http://www.nextwaresessions.org

Office of Personnel Management. (2015). Cyber security resource center. https://www.opm.gov/cybersecurity/

Paquet, C. (2013). Network security concepts and policies. Cisco. Retrieved from http://www.ciscopress.com/articles/article.asp?p=1998559

Pfeiffer, M. (2015). Managing technology risks through technological proficiency. Retrieved from http://blousteinlocal.rutgers.edu/managing-technology-risk/

Pielocik, M. (2004). Social engineering: The friendly hacker. Page 12. SANS Institute. Retrieved from https://www.giac.org/paper/gsec/3792/social-engineering-the-friendly-hacker/106104

Ponemon Institute. (2016). 2016 cost of cyber crime study & the risk of business innovation. Retrieved from http://www8.hp.com/us/en/software-solutions/ponemon-cyber-security-report/

PricewaterhouseCoopers. The Global State of Information Security Survey 2016. Retrieved from http://www.pwc.com/gx/en/issues/cyber-security/information-security-survey.html

Proffitt, T. (2007). Creating and managing an incident response team for a large company. Page 15. SANS Institute. Retrieved from https://www.sans.org/reading-room/whitepapers/incident/creating-managing-incident-response-team-large-company-1821

Rush, G. D. (2015). Cyber Security Research Frameworks for Coevolutionary Networks Defense. Retrieved from http://permalink.lanl.gov/object/tr?what=info:lanl-repo/lareport/LA-UR-15-29293

SANS Institute. (2015a). Cleaning up after a breach, post-breach impact: A cost compendium. https://www.sans.org/reading-room/whitepapers/analyst/cleaning-breach-post-breach-impact-cost-compendium-36517

SANS Institute. (2015b). SANS securing the human 2015 security awareness report. Retrieved from https://securingthehuman.sans.org/media/resources/STH-SecurityAwarenessReport-2015.pdf

SANS Institute. (2016). Data breach response policy. Retrieved from https://www.sans.org/security-resources/policies/general/pdf/data-breach-response

SANS Institute. Incident detection FAQs: What are the steps to handle an incident? Retrieved from https://www.sans.org/security-resources/idfaq/what-are-the-steps-to-handle-an-incident/5/1

Security Magazine. (2016). Majority of businesses lack resources to manage external cyber attacks. Retrieved from http://www.securitymagazine.com/articles/87267-majority-of-businesses-lack-resources-to-manage-external-cyber-attacks

U.S. Department of Homeland Security. (2016). Cyber information sharing and collaboration program. Retrieved from https://www.dhs.gov/ciscp

U.S. Department of Homeland Security. Cybersecurity & privacy. Retrieved from https://www.dhs.gov/sites/default/files/publications/privacy_cyber_0.pdf

Wind River. (2015). Security in the internet of things: Lessons from the past for the connected future. Page 4. Retrieved from http://www.windriver.com/whitepapers/security-in-the-internet-of-things/wr_security-in-the-internet-of-things.pdf

Titel: Frameworks and Best Practices
verfasst von: Brianna Keys
Stuart Shapiro
Verlag: Springer International Publishing
Buch: Cyber Resilience of Systems and Networks
Print ISBN: 978-3-319-77491-6

Electronic ISBN: 978-3-319-77492-3

Copyright-Jahr: 2019
DOI: https://doi.org/10.1007/978-3-319-77492-3_4

Neuer Inhalt

Bildnachweise

VDI-Icon, Profil Icon, inhalt2, Springer Professional Modul/© Springer Fachmedien Wiesbaden GmbH, Nachhaltigkeitsaward Key Visual/© Cometis AG/Global ESG Monitor | Daniel Rupp | Generiert mit KI, Search Icon, Banner Hanser, Jonas Klose/© Pine Valley Capital GmbH, Carina Kießling von der Strategieberatung Roland Berger/© Monika Walther Fotografie | ATZ, Beijing Auto Show 2024: Deutsche Hersteller wollen angreifen./© EKH-Pictures / Generated with AI / Stock.adobe.com, Zeitschrift Wissensmanagement Cover, PatentFit-Logo/© Springer Fachmedien Wiesbaden GmbH, Zukunftswerkstatt Sales Excellence 2024/© AndreyPopov / Getty Images / iStock, 2023_Antrieb/© supervisuell, ATZ-Webinar: Prototypenfreie Entwicklung durch Offline- und Driver-in-the-Loop-HiL-Tests /© (c) VI-grade

Springer Professional

Abstract

Bitte loggen Sie sich ein, um Zugang zu Ihrer Lizenz zu erhalten.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Springer Professional "Technik"

Springer Professional "Wirtschaft"

Neuer Inhalt

Bitte loggen Sie sich ein, um Zugang zu Ihrer Lizenz zu erhalten.

Bitte loggen Sie sich ein, um Zugang zu Ihrer Lizenz zu erhalten.