NIST Cybersecurity Framework - NIST Identify Function. Steve Fey - Totem Buildings “Know What You Have”

2. NIST Identify Function
Steve Fey - Totem Buildings
“Know What You Have”

3. Overall Objectives
● Know what systems you have
● Understand the risks to the organization
● Establish policies and procedures to manage risk
● Assess risks and identify business impact
● Move from assessment to risk management

4. Asset Management
● What are the systems?
○ Building Automation
○ Lighting Control
○ Elevators
○ Access Control
○ Video Surveillance
○ … and many other possibilities
● High level attributes for each system type
○ Manufacturer
○ Model
○ Installing contractor / service provider
○ Network
○ Software Revision

5. Business Environment
● How dependent is the organization on the functioning of its control
systems?
● Understand what services and functions must be in place in order to
respond to a cybersecurity attack / incident
● Define the organization’s role relative to the supply chain (i.e. who owns
the problem and the response)

6. Governance
● Define and communicate the organization’s cybersecurity policy
● Establish roles and responsibilities both internally and externally
● Understand legal and regulatory requirements
● Cybersecurity processes align with the potential risks
•“…80% of breaches are because of lack of basic
processes, policies and procedures and
employee/vendor mistakes.
•www.itgovernance.co.uk

7. Risk Assessment
● Identify Control System Vulnerabilities
○ Out-of-date Software
○ Physical Location
○ Users improperly configured
○ Non-application software running on servers
● Identify Internal and External Threats
○ Malware
○ Hackers
○ Rogue Employees
● Identify business impacts and likelihoods
○ Downtime
○ Equipment damage
○ Compromised building access

8. Risk Management
● Risk Management Processes are Defined and in Place
○ Monitoring Systems (both manual and automated)
○ System and Supplier Audits
○ Life Cycle Management
○ Security Release Awareness
○ IT and OT Coordination
● Risk Tolerance and its Impact by System Type

9. Supply Chain Management
● Cybersecurity processes are defined and stakeholders identified
● Suppliers undergo risk assessment with criteria incorporated into
contracts
● Suppliers are routinely audited to ensure compliance
Cybersecurity supply chain management challenge is fundamentally more
complicated with respect to the buildings controls industry
○ Highly fragmented
○ Follows the construction value chain
○ Day to day operations largely depend on contractor involvement