Control 13 Mapping to the NIST Cybersecurity Framework

00:00

Hey, everyone, welcome back to the course. So in the last video, we took a look at control number 13 which is data protection. In this video, we're gonna see how that maps up to the next cybersecurity framework.

00:12

So some control 13 1 We just need to maintain an inventory of what is a sensitive information that we have, right? So whether that's information on the network data that we're storing

00:21

do we do handle credit card transactions? Do we store sensitive healthcare data? Do we store sensitive intellectual property data? What kind of sensitive information do we have in our organization

00:32

and that maps up to the i. D. A. M Dash five for the Knicks cybersecurity framework.

00:37

Some control 13 2 We're talking about remote, sensitive data or systems that are not regularly excess to buy the organization.

00:45

So we want to make sure that if we're needing to transfer information, if we're removing information, how are we actually managing that type of stuff? Right? So if we take a a endpoint off our network, what are we doing with that hardware device, for example?

01:00

Are we just given that away to some charity or we actually sanitizing it before we

01:06

get rid of it.

01:08

Some control 13 3 is what we're talking about. Blocking the network traffic. That's unauthorized, right? So not only monitor, but we want to block it as well because we don't want this to be in a ah, place where Attackers can exfiltrate data. All right, so we part of that data loss prevention, or DLP, as you'll probably commonly see it in the industry

01:29

we want to protect against any type of data. Loss

01:34

some control. 13 4 This is where we only allow authorize access to our cloud storage or email providers, and this again is just really protecting against that data leak. It's right, and there's many different third party applications that you can use to help with Data loss Prevention.

01:55

13 5 is monitoring detecting any on unauthorized use of encryption. So again, if we if we've got coming from a certain I P address that we think is militias and it's coming through on https or something like that, we want to try to decrypt that traffic and see what's actually inside those packets.

02:15

Some control. 13 6 That's where we're talking about encrypting the hard drive of all mobile devices, so a lot of times will do. The laptops and desktops will use the full disk encryption, but we forget about the mobile devices themselves. So again, that's just going back to If I steal that device from you as a bad person, I can't access that data. Or or at least it becomes more difficult

02:35

for me to access that data. You haven't rest stored on that device

02:40

Some control 13 7

02:43

because what we're talking about managing our USB devices. So we need to make sure if you are using US bees, that you've implemented certain procedures to make them a little more secure and certain policies that people have to follow to use them. Right? So maybe they have to get permission first from the I T department before they can plug in the USB to their computer.

03:00

So these are just layers of protection. We try to put in place

03:07

some control 13 8 where we're talking about other external removable media and so basically the read write configurations, right, So, as an example, if I come plug up an external storage to the war computer, will I be able to have some malicious software on that external storage device that then can launch

03:24

on that work computer thing could change some of the data

03:28

or vice versa. Right? Maybe the external storage is fine, and that's where I keep the sensitive data. But I plug it into the work device in it. The hardware advice, my end point. And it manipulates a day to somehow. So we just want to make sure that we are protecting the data as well as restricting what our end users can actually do.

03:47

Some control. 13 nines where we're talking about encrypting the data on USB storage devices. So don't just have it sitting there that anyone can access. If I steal that USB from you, you need to make it difficult for me to actually get that data.

04:01

So in this video, we just took a look at control number 13 which again is data protection. We took a look at how that maps to the NUS cybersecurity framework