Cyber Security

Vendor selection and contractual protections 

For those less tech savvy entrepreneurs, consider seeking out a third party to manage your information security. Budgets can be tight, but a significant cyber incident can put a small business out of business. It is worth getting support from a third party you can trust. Vendors are an affordable way to gain expertise in cybersecurity and outsource a skilled function. However, you cannot outsource liability and so it is vital you understand how to select the right vendor for your needs, and protect your organization in the event of vendor issues.

Vendor selection

• Seek a credentialed vendor with experience providing managed security services. Credentials and certifications such as the CISSP, CISM, SOC 2 Type 1 or 2 compliance report, ISO or NIST third party audit report. 
• If using an individual consultant for services, seek out references to confirm the individual’s experience is as presented in their CV. 

Contractual Protections

• Never go into business with a third party without a formal contract in place. Issues arise and no matter the sense of goodwill between both parties at the outset of the relationship, it is vital to ensure a formal contract exists that sets the parameters for disputes when they arise. This preserves a sense of order as both parties agreed to the terms prior to the engagement. 
• Seek appropriate legal advice from a legally trained individual on contracts.

Review tab on how to avoid falling victim to common social engineering threats.

Cyber Hygiene 

Depending on your responsibilities for the management of your information technology assets, vs those outsourced to a third party subject to a contract, there are some basic cyber hygiene good practices which should be regularly monitored and executed to help protect your business. These cyber basics can be used to hold a vendor to account, or to manage your own network internally. 

1. Account Security

• Do not use generic accounts, ensure that each user has their own set of credentials and that accounts are not shared. 
• Ensure that each account has a secure password/phrase, not used for other personal accounts or subscriptions, that includes more than 8 characters, a combination of letters, numbers, and symbols. 
• Ensure that access controls for endpoints, software, and network devices follow a “deny-all” policy, restricting access permissions only to those who are authorized to do so. d) Ensure that any remote access to the organizations IT assets is done so via a Virtual Privacy Network (VPN) that is also subject to Multi-Factor Authentication (MFA). 

 2. Information Protection 

• If possible, ensure that all devices used for storing information used by the organization has encryption enabled. Prioritize Mobile Devices such as Laptops and Mobile Phones, managed through an MDM Solution. 
• Take training to understand information protection good practices. 
• Be diligent when sending sensitive information via email that it does not go to unauthorized recipients. 
• Only store sensitive data in secure parts of the network. Avoid desktops or other unrestricted file locations 

Information Systems Security 

• Ensure that all endpoints have antivirus installed that is kept up to date.
• Ideally, have an EDR tool installed and is kept up to date.
• Ensure that your data is subject to regular back-ups, which are kept in a secure environment. Ideally one that is not accessible by regular business accounts directly.
• Ensure that your email solution provides a strong filtering solution. Look out for solutions that contain SPF/DKIM/DMARC filters. If possible, choose a solution that provides sandbox quarantine and detonation capabilities for incoming emails.
• Run policy compliance scans on configurations of security and network devices, and software, to ensure that your systems are running as intended following changes to those systems.

Business Impact Analysis (BIA) and Risk Assessment 

Conduct a BIA to identify and prioritize information systems and components critical to supporting the organizations business processes. How critical is each process? What systems/IT assets support those processes? What would the impact be of an outage to a system that impacts the process it supports? How long would it take to recover that system and restore the process? What resources do you require to recover systems and which systems do you recover first? 

• NIST SP 800-34 “Contingency Planning Guide for Federal Information Systems”, Section 3.2 ‘Conduct the Business Impact Analysis’: NIST 800-34, Rev 1 Contingency Planning Guide for Federal Information Systems 

Use the findings from the BIA to conduct a formal risk assessment, focused on those critical systems, to identify any potential risks, threats, or vulnerabilities which require addressing. Ensure that the organization is utilizing threat intelligence to make an informed decision on the severity rating of each threat or vulnerability. 

• NIST SP 800 – 30 “Guide for conducting risk assessments” NIST Special Publication 800-30 Revision 1, Guide for Conducting Risk Assessments. 

Cyber Security Strategy and Program Initiation 

• It is time to formalize your cyber security strategy to align with security frameworks, and establish a program to mature the cyber security posture and culture as the business grows. Start by developing cyber security related policies. Some initial policies to consider are as follows: 

1. Cyber security Policy 
2. Acceptable Use Policy 
3. Identity and Access Management Policy 
4. Vulnerability Management Policy 
5. Third Party Cyber Security Policy 

• If these policies already exist, review and update them to ensure they align with current good practice cyber security frameworks. 
• Once finalized, conduct an internal assessment to determine how the organization currently complies with its own policies. For any areas of non-compliance, take a risk-based approach to developing a list of remediation action items, and order them by priority to determine the cyber security program for the next 1-2 years. 

Vendor selection and contractual protections 

• Seek a credentialed vendor with experience providing managed security services. Credentials and certifications such as the CISSP, CISM, SOC 2 Type 1 or 2 compliance report, ISO or NIST third party audit report. 
• If using an individual consultant for services, seek out references to confirm the individual’s experience is as presented in their CV. 

Contractual Protections

• Never go into business with a third party without a formal contract in place. Issues arise and no matter the sense of goodwill between both parties at the outset of the relationship, it is vital to ensure a formal contract exists that sets the parameters for disputes when they arise. This preserves a sense of order as both parties agreed to the terms prior to the engagement. 
• Seek appropriate legal advice from a legally trained individual on contracts.

• Ensure that critical vendors are required to demonstrate that they are maintaining their credentials/certifications at least on an annual basis.
• Conduct monitoring to ensure that vendors are satisfying their SLA’s.

Review tab on how to avoid falling victim to common social engineering threats.

Ensure your organization conducts annual training that is supported by phishing campaigns to simulate real social engineering campaigns to test employee knowledge and skills.

Business Impact Analysis and Risk Assessment 

Conduct a BIA to identify and prioritize information systems and components critical to supporting the organizations business processes. How critical is each process? What systems/IT assets support those processes? What would the impact be of an outage to a system that impacts the process it supports? How long would it take to recover that system and restore the process? What resources do you require to recover systems and which systems do you recover first? 

• NIST SP 800-34 “Contingency Planning Guide for Federal Information Systems”, Section 3.2 ‘Conduct the Business Impact Analysis’: NIST 800-34, Rev 1 Contingency Planning Guide for Federal Information Systems 

Use the findings from the BIA to conduct a formal risk assessment, focused on those critical systems, to identify any potential risks, threats, or vulnerabilities which require addressing. 

Ensure that the organization is utilizing threat intelligence to make an informed decision on the severity rating of each threat or vulnerability. 

• NIST SP 800 – 30 “Guide for conducting risk assessments” NIST Special Publication 800-30 Revision 1, Guide for Conducting Risk Assessments. 

Cyber Security Strategy and Program Maturity 

• Determine which cyber security framework(s) the organization is going to align to. Ensure that the cyber security policies and standards which govern the organizations cyber security align with those security frameworks, are subject to annual review and update, and inform cyber training and awareness program activities. 
• Conduct internal assessments, regular vulnerability scans, policy compliance scans on configurations, annual penetration testing, and independent third-party audits to determine compliance with company policies and standards. Gather remediation item actions to ensure compliance, and prioritize those using a risk-based approach, to develop a cyber security program for the next year. 

Vendor Risk Management 

• Conduct annual assessments of critical third-party vendors against the policies and standards set by the organization. Establish a standard for what is considered acceptable, unacceptable, and tolerable to determine a score for each vendor, depending on their variance from the organizations policies and standards. 
• Monitor critical vendors for performance against the SLA’s defined and agreed upon in the respective contracts. 

Conduct a BIA to identify and prioritize information systems and components critical to supporting the organizations business processes. How critical are each process? What would the impact be of an outage? How long would the outage last? What resources do you require to recover systems, and which systems do you recover first? 

Use the findings from the BIA to conduct a formal risk assessment, focused on those critical systems, to identify any potential risks, threats, or vulnerabilities which require addressing. Utilize strong threat intelligence feeds when assessing findings to inform the prioritization of remediation action items using a risk-based approach. 

• NIST SP 800 – 30 “Guide for conducting risk assessments” NIST Special Publication 800-30 Revision 1, Guide for Conducting Risk Assessments. 

Frameworks offer guidance to organizations through the congregation of good practice standards which can be applied to manage cyber risk and exposure. They offer a common set of controls, procedures, and practices that allow organizations to benchmark their posture against the framework itself, and their industry peers who also align to the same framework. 

Multiple frameworks exist, each with its own merits and focus. Mature organizations will often seek to utilize practices from a range of frameworks, while those still in the earlier stages of their journey will pick one and seek to achieve a level of maturity that works for their risk management strategy. 

• NIST CSF – National Institute of Standards and Technology Cyber Security Framework. Designed for government organizations, this standard has become a leading choice for organizations across both public and private sectors. Its content is free and broken down into 5 pillars to structure practices to Identify, Protect, Detect, Respond, and Recover.
• ISO – International Organization for Standardization. While there are other standards which cater to specific practices such as cloud security, ISO 2700114/2700215 offer a foundation for organizations and are widely used by organizations who use ISO standards across other risk management areas beyond IT Security. ISO 27001 focusses on the processes for organizations to protect information assets, while ISO 27002 provides detailed control recommendations to achieve ISO 27001. Each control is supported by an objective, as well as guidance for implementation.
• CIS – Center for Internet Security. The CIS provides a list of “Critical Security Controls” which are prioritized to mitigate the most prevalent cyber-attacks against systems and networks. Safeguards are split into three categories depending on the organization. A group is allocated for all enterprises as a minimum standard (IG1), a second group for organizations with increased complexity of risk (IG2), and a final group for organizations with internal expertise available to them (IG3).
• COBIT – Control Objectives for Information and Related Technologies), from ISACA (Information Systems Audit and Control Association), provides organisations with a framework that contains four main domains: Planning and organization; acquiring and implementation; delivering and support; and monitoring and evaluation. It aligns IT security with business objectives through the delivery and management of systems.
• OWASP Top Ten from the Open Web Application Security Project provides organizations with the top ten vulnerabilities and security risks organizations face regarding their web applications

A centralized SOC, including 24/7 monitoring of a SIEM solution that captures activity across the network. 24/7 monitoring may be a stretch for smaller organizations, but it is common for threat actors to target organizations outside of business hours when they can go undetected. A SIEM solution collects log data from your endpoints, offering a single source of truth for analysis of events on the network to identify any actual or suspected malicious activity. The SIEM will learn what is normal vs suspicious, and raise alerts for the organization to investigate. 

Incident Response Plan, System Recovery Plan, and Business Continuity Plan. These documents will assist an organization to maintain order during an incident, with well defined roles and responsibilities to respond to, and recover from, an incident.  

Backups which are offline, protected by tight access controls, and subject to regular testing of integrity and recovery. As mentioned before, many actors will seek to move laterally through the environment to find an organisations most sensitive assets. Back-ups are often the difference between being able to recover from an incident, or having to pay a ransom to avoid an excruciatingly lengthy disruption to the organization as it re-builds from scratch. Ensuring that the organization has backups of all critical data, that is not accessible through the network, and the recovery from which is tested regularly to ensure that backups are working effectively, is vital to an organizations recovery, as well as to avoid payment of a ransom to a criminal organization. 

Conduct annual tabletop exercises, ransomware simulations, and information system recovery exercises. Building on the plans the organization has developed to provide instruction throughout an incident, these exercises seek to train employees in their roles and responsibilities so that the response is as smooth and efficient as possible. Ensure cross training of employees, so that the absence of one individual does not create a bottle neck.