We may wonder whether the increasingly popularity of cybersecurity is a benefit or a problem itself? Sometimes when awareness raises, there is also an increasing in considering a very serious discipline which impacts technical and legal issues as a mere buzzword. In order to avoid such a risk, a solid methodological and operational framework might be useful.

A suggested methodology can include the three following phases to build a Cyber Security Framework:

Asset mapping: in this first phase the enterprise assets must be identified, as well as the tools dedicated to the cybersecurity issues, the related alerts (early warnings of Security Asset are the most important) and finally also the security processes and management. This assessment phase could also help the evaluation the integrated security policies.

Assessment of the threats: the second phased is focused on the assessment of the tecnological and human-related cyber risk by an extensive security testing activity (Penetration Test, Vulnerability Assessment and Network scan) and by Phishing Attack Simulation campaigns.

Security KPIs’s identification: during this following step the Security KPIs’s are defined; the ones already in use, those to be immediately applied and those to be optionally adopted in order to have security solutions at a preventive, proactive and predictive level which can achieve the business objectives of the organization.

Once you have defined the Framework, two additional phases are required:

GAP Analysis: the Gap Analysis is useful to compare the as-is status of the Cyber Security Framework to the industry’s best practices, to the existing regulatory issues and to the internal KPIs’ target level (to-be status).

Road Map: it defines the required actions and tasks to be planned in order to obtain the maximum cyber resilience. Alongside the roadmap, you must define the required new standards at organizational and technological level, including know-how, policy and procedures.

Source: https://www.cybersecurity360.it/nuove-minacce/democratizzazione-della-cyber-security-best-practice-per-non-sottovalutare-il-rischio-cyber/

CRC Team