Control 14 Mapping to the NIST Cybersecurity Framework

00:00

Hey, everyone, welcome back to the core. So in the last video, we took a brief overview of CS Control 14 which again is a controlled access based on the need to know

00:09

in this video, we're just gonna take a look at how that maps up to the NIST cybersecurity framework.

00:14

So some control 14 1 That's where we segment the network based on sensitivity. So as an example, if I'm working with sensitive accounting or financial data,

00:23

Joey down in the janitorial services shouldn't have access to the same network with same data, right? So we do the network segmentation to make sure users on that network segment are only able to see the information that's applicable to them.

00:39

The other advantage of network segmentation, if you're not familiar, is if an attacker gets in. We can really,

00:46

for the most part, be able to isolate them to a certain network segment. Now that doesn't mean that they can't continue to move laterally through the network. But if we're dealing with, like, a script, kiddie or someone like that, then we can usually just keep them isolated to a certain network segment and then

00:59

lock them. I locked them down and clear up the infections, right?

01:03

It's not the attack.

01:04

Some control. 14 to what we're talking about. Firewall filtering between RV land. So that maps up to P. R. A. C Dash five in the next cybersecurity framework.

01:15

14 3 We're talking about disabling workstation to workstation communication,

01:21

and that maps up to P. R. A. C Dash five. So that's where we're talking about that network to integrity, right? So we're going back to things like the segregation and segmenting out our network

01:33

See as sub control. 14 4th We're talking about encrypting all sensitive information in transits. We talked a little bit earlier about data protection at rest. Now we're talking about also in transit Rights are protected in transit and at rest

01:47

14 5 utilizing active discovery tools to identify sensitive data. There's really not a 1 to 1 match in the cybersecurity framework for this one, but just know that's another aspect of it. And again, the overall arching thing of all of these is to help you build a better defense in depth for your organization.

02:05

Some control 14 6 Protecting the information through access control this so again Onley, allowing people to access the things they need to, right? So going back to principles of least privilege as well a separating duties. So just because I'm an administrator doesn't mean that you shouldn't put some kind of checking place. Right? So

02:23

you may have it where a couple of us administrators have to sign off on something

02:25

before I can actually access it and make a change.

02:30

Sub control 14 7

02:32

Enforcing access control through the automation of tools. Right, Because it's very difficult for me to go in manually and change your access every single time. So I just want to set

02:42

ah, a specific thing. So, for example, we could use, like, role based access control. And I could say, Okay, if you're an accountant at this company, these are the things you need access to, and this is it. You're limited on just thes things. So it makes it easier for me to automate that stuff as opposed to me having to manually say Okay. Well, Joey, who's Joey? Joey's an accountant.

03:00

Okay, let me go manually. Assigned these things

03:05

some control. 14 8 So again, going back to encrypting the sensitive information at rest

03:12

and some control 14 9 enforcing detail, logging for for people getting access or failing to log in properly, as well as any changes to that sensitive data. Because we want to track that if this change is made, why is the change made? So we could maintain integrity of that data.

03:31

So in this video, we just talk through the CIA's control 14 and how it maps to the NUS cybersecurity framework