A structural approach to Cyber Security management, using NIST CSF, the Cyber Defense Matrix mechanism, the Open Security Architecture model, etc.

1. Cyber Security Management
A structural approach
Robert Kloots, Brussels
Nov 2022
Available for Interim Management

2. Topics
 Main Cyber Security Goals
 Cyber Security controls support COBIT
 CSF policies, standards and guidelines
 Cyber Security Framework (CSF)
 CSF Quality Controls, Risk & Compliance
 Cyber Security Function Deployment
 Cyber Security Architecture
 Object type specific CSF controls
 Cyber Security Patterns
 Add Cyber Security to WoW => SSDLC
 Match NIST.SP.800-53rS Controls with deployed control measures
 Manage Cyber Security Services Deployment
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
2

3. Main Cyber Security Goals
 Confidentiality
 Integrity
 Availability
 Non-repudiation
 Audit
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
3
Provision of Trust services
Non-repudiation is the
assurance that someone cannot
deny the validity of something.
Non-repudiation is a legal
concept that is widely used in
information security and refers
to a service, which provides
proof of the origin of data and
the integrity of the data.
Audit is the mechanism
through which proof is
obtained and validated.
Logging of (trans-)
actions is actually the
source on which
auditing relies.

4. CSF policies, standards and guidelines
 Policies on right level of abstraction
 Procedures and guidelines close to WoW
 Many examples of best practices available
 Dynamic set reflecting maturity of CICD and OPS.
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
4

5. Cyber Security controls support COBIT
 Cyber Security Framework (CSF) offers pragmatic approach to incorporate
Cyber Security Controls into CICD and Operations.
 Drive for agile maturity, risk-based compliance
 CSF is compatible with and complementary to COBIT
 Similar support for ISO 27002
 Fairly easy integration into management reporting
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
5
Also check out
Cyber Security Risk
Management

6. Cyber Security Framework (CSF)
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
6
IDENTIFY
PROTECT
DETECT RESPOND
RECOVER

7. Cyber Security Framework (CSF)
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
Asset
Management
Business
Environment
Governance
IDENTIFY
Risk
Management
Strategy
Supply Chain
Management
Risk
Assessment
Identity mgt,
Authentic. &
Access Control
Awareness
and Training
Data Security
PROTECT
Maintenance
Protective
Technology
Info Protection
Processes and
Procedures
Anomalies
and Events
Security
Continuous
Monitoring
Detection
Processes
DETECT
Response
Planning
Communicati
ons
Analysis
RECOVER
Improvements
Mitigation
Recovery
Planning
Improvements
Communica-
tions
RESPOND
7

8.  Define Data/Information
classification enabling risk
analysis & reporting
 See “Cyber Security Risk
Management”
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
8
CSF Quality Controls, Risk & Compliance
Extract from NIST.SP.800-53r5
Risk
Management
Strategy
IDENTIFY

9.  Target Organisation should apply CSF & NIST.SP.800-53r5.
 NIST.SP.800-53r5 document has been converted into (Confluence) wiki
 Which facilitates both Development and Operations, as well as Audit and
Compliance to incorporate the obligatory mechanisms
 Use of capabilities and controls will evolve following the roadmap timeline.
 More discussion below
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
9
CSF Quality Controls, Risk & Compliance
AC-2(1) Account Management | Automated
System Account Management
Support the management of system accounts using [Assignment:
organization-defined automated mechanisms].
AC-2(2) Account Management | Automated
Temporary and Emergency Account
Management
Automatically [Selection: remove; disable] temporary and
emergency accounts after [Assignment: organization-defined time
period for each type of account].
AC-2(3) Account Management | Disable
Accounts
Disable accounts within [Assignment: organization-defined time
period] when the accounts:
(a) Have expired;
(b) Are no longer associated with a user or individual;
(c) Are in violation of organizational policy; or
(d) Have been inactive for [Assignment: organization-defined time
period].
AC-2(4) Account Management | Automated
Audit Actions
Automatically audit account creation, modification, enabling,
disabling, and removal actions.
AC-2(5) Account Management | Inactivity
Logout
Require that users log out when [Assignment: organization-
defined time period of expected inactivity or description of when
to log out].
Extract from NIST.SP.800-53r5
Identity mgt,
Authentic. &
Access Control
PROTECT

10. Cyber Security Function Deployment
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
10
• Take inventory of existing CySec
services and/or solutions,
• Allocate to appropriate matrix-
cell
• Repeat for asset type:
o Corporate digital assets
o Employee assets
o Customer assets
o Vendor assets
o Threat actor assets
Asset types
Operational functions
Source: CYBER DEFENSE MATRIX by Sounil Yu
Do we have something (inventory)...
That we care about (impact)...
That has weaknesses (vulnerabilities)...
That someone is after (threats)?

11. Cyber Security Architecture
 Formulate together with Business
Partners and ICT Guilds,
 Architectural view gets body, is
maturing and integrated with Asset &
Configuration Details
 Reflects “Cyber Security Service
Catalogue”
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
11
https://www.opensecurityarchitecture.org
OSA Taxonomy

12. Object type specific CSF controls
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
12
PROD on
premise
DEV
ACC/INT
EG
TEST
PROD in
Cloud
Network
controller
(FW)
Internal
Source
Applicat
ion A
Applicati
on B
External
Source
1S 3S
1T 3T
5T
6S
2T
5S
4T 4S
6T
2S
D
B
D
at
a
Bl
o
b
Cloud specs
Also check out
Cyber object types and
controls

13. Cyber Security Patterns
Make controls explicit through Security patterns
and functional grouping:
 Group Controls through function/service,
role, mandate
 Allow for reusable components
Cyber Security services are Lateral Services:
 Offer Cyber Security controls
 Allow for KPI + SLA
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
13
Server pattern
Roles and Controls

14. Add Cyber Security to WoW => SSDLC
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
14
Check for
security
updates
(CVSS) in your
SBOM
Include Threat
modelling
Follow control implementation throughout CICD

15. Add Cyber Security to WoW => SSDLC
 Use STRIDE Threat Modeling
 Finetune backlog using CVSS
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
15
Threat action Threat Definition Desired property Example
masquerading Spoofing Pretend to be someone
else
Authenticity Hack victim's email and use
Alteration Tampering Changing data or code Integrity Software executive file is
tampered by hackers
Denying Repudiation Claiming not to do a
particular action
Non-repudiability I have not sent an email to
Alice
Data Loss/Leakage Information disclosure Leakage of sensitive
information
Confidentiality Credit card informaiton
available on the Internet
Downtime Denial of Service Non-availability of service Availability Web application not
responding to user requests
Admin (root) Elevation of Privilege Able to perform
unathorised action
Authorization Normal use able to delete
admin account.

16. Add Cyber Security to WoW => SSDLC
 Convert Cyber Security controls into User stories & Epics, then code or config
 Keep track of control throughout CICD using control number.
Approximate steps:
 Threat modelling => DFD
 Software Architecture => Processing, Flows, Interfaces, APIs and IP##
 Business Analysis => user stories
 Development => software code
 Control suites => test, test, test and pentest
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
16

17. Match NIST.SP.800-53 Controls with
deployed control measures
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
17
Above numbers actually are from CIS Top 20 Critical Security Controls
Map Control to
to be deployed
security function

18. Manage Cyber Security Services
Deployment
 Understand per asset its set of vulnerabilities, and which
vulnerability is most prone to attacks, directly or through
chain of attack.
 Know per asset which (set of) mitigation measure(s)
eliminates these attack risks
 Maintain match functional security architecture with
measures deployed in operation
 (Introd)use AI and Cyber Risk methods to swiftly minimise
your exposure.
 Automatically fill Agile backlog (SECDEV/SOC/CSIRT) with
these issues, risk based priority
 Provide Opex Capex report on portfolio progress
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
18

19. Matchmaking Need and Mission
You are welcome to check my availability to provide you with relevant Cyber Security
Services matching your Needs,
You can reach me @
 robert.kloots@mediqaid.eu
 Linkedin.com.in/kloots
 Thank you for browsing this slidedeck ;-)
22/11/2022
MediqAid Trust services; © Robert Kloots and yes there are reused graphics, owned by others
19