How the NIST cybersecurity framework can help secure the enterprise

Now that the US National Institute of Standards and Technology has finalized the much-discussed cybersecurity framework, organizations can use it as the guideline for measuring how well their systems are secured.

One year ago, President Barack Obama directed NIST to develop a security framework that could be used as a guide to secure the country's cyberinfrastructure of basic vital services such as banking, transportation and telecommunications. Although the White House directed the development of the framework chiefly for measuring and mitigating risk in the country's cyberinfrastructure to protect airlines, roads and other vital aspects of the U.S. economy and well-being, it can be used by any organization.

Certainly, retailers that have been hit by cyberattacks, such as Target, could benefit from the framework.

To develop the framework, NIST consulted hundreds of experts in industry and reviewed feedback from thousands of additional contributors culled from multiple draft releases that were posted for review. In its final form, the framework offers a core set of activities to anticipate and mitigate against attacks on systems. It provides a set of measurements to assess to what degree an organization has implemented these core activities, which can be used as a gauge to assess how prepared the organization's systems are, in terms of being secured against an attack.

While some have criticized the 41-page framework as too vague to be of much value, it can offer a road map for organizations, some say.

The framework was written preliminarily for the higher levels of management, such as a boards of directors, chief security officers, audit committees, senior executives and others "working inside an organization who are responsible for different aspects of security and privacy," said Harriet Pearson, a partner in the Washington, D.C., office of Hogan Lovells, who was involved in the shaping of the framework.

It is a valuable indicator of what a standard of care should be, Pearson said: "A CSO might be wondering 'How do I know if I've done enough?'" The document provides a standard measure that organizations can agree on in terms of assessing risk assessment.

"While not technology specific, it points to the governance and action," Pearson said. "You don't have to use every part of the framework. It's more of the thought process."

"The framework does a really nice job of laying how organizations should apply a risk-based approach to improve security," said Andrew Wild, chief security officer of IT security firm Qualys.

Other frameworks do this as well, he pointed out, but the NIST's document is valuable in its brevity. "Someone can get a high level understanding of what is required," Wild said.

The document also includes references to other, more in-depth documents that provide more detailed instruction, such as the widely referenced Council on Cybersecurity's Critical Security Controls.

Nonetheless, Wild cautioned that the framework will not be a panacea for security issues. Most security officers already have a solid understanding of how their systems need to be secured. What they too often lack, Wild said, are the adequate resources.

Overall, cyber-infrastructure security won't be significantly improved until executive boards in organizations commit to providing more resources for risk management cybersecurity, Wild said. "How can the framework make an improvement if resources aren't provided?"

Joab Jackson covers enterprise software and general technology breaking news for The IDG News Service. Follow Joab on Twitter at @Joab_Jackson. Joab's e-mail address is Joab_Jackson@idg.com