Introduction to IT and Cybersecurity
Time
1 hour 27 minutes
Difficulty
Intermediate
CEU/CPE
2
Video Description
This lesson offers a summary and review of the entire module about NIST 171 which documents how we protect classified and controlled information and features 14 families of protection mechanisms.
Video Transcription
00:04
All right, let's go ahead and wrap things up. So Missed 800 Special Publication 1 71 Documented how we protect and control, uh, controlled unclassified information.
00:20
So ultimately, this document presented to us 14 families, if you will, of protection mechanisms.
00:28
So we started out with access control, which ultimately talked about how a subject can manipulate an object how we're gonna limit access, control, awareness and training. Make sure your people know the rules. Make sure they know what to expect. Make sure that they know what to do. Should they see a security incident, how to report it
00:46
as well as how to steer clear of making those mistakes.
00:50
Auditing accountability. We've gotta monitor. I need a trail, and I need to be able to match actions back to subjects.
00:59
Configuration management we talked about earlier is making sure that we documented control any changes to the standard baseline configuration of our systems
01:08
identification in authentication. We then looked at we talked about identification is making a claim. Authentication is proving it. So how we limit authorization based on authentication
01:23
incident response, how we respond to a change in state that has a negative impact on the system could be intentional or unintentional, but responding to incidents having a program in place and a trained team as well,
01:40
all right. Maintaining a system, certainly making sure that we limit in control. Who could maintain a system and that maintenance happens as scheduled on and as needed
01:51
media protection. As we move device from one system to another, making sure these portable devices are labeled, making sure that they're protected in the means dictated by S O the highest sensitivity information on that media would drive its protection.
02:09
Also making sure that media sanitized before we use
02:14
personnel security. Watch who we hire and how we fire right back down background checks and screening and then termination procedures that allow this to happen as amicably as possible while still protecting the security of the organization.
02:30
Ah, physical protection. You know what? Lock your doors. Get a security guard, watch piggybacking eight foot fence around your facility. Now again, these air just kind of some some common principles. But the bottom line is don't overlook physical security. I could include fire safety,
02:49
having plans in place for a variety of contingencies.
02:53
Uh, risk assessment.
02:55
Everything comes down to risk assessment. Look at the assets and what they're worth.
03:00
Look a threats and vulnerabilities. Then figure out probability and impact.
03:06
Look at the potential for loss versus the cost of the countermeasure and make a good business decision. Keeping in mind, though, you've got to look at things that are less tangible in nature, like a company's reputation, its credit rating, um,
03:22
bad press. You know all of those elements can have a huge impact on the organization.
03:28
All right, security assessments. We've got to test the system before certification or authorization or really before you know, moving forward with anything that we're You know, that's kind of for government environment. But in any element, we have to test the security of the system
03:45
through vulnerability assessments and pen tests.
03:47
System communications protection, protect at a wall. It's in transit but also protect at a wall. It's a rest and then last but not least, system and information integrity. Make sure that security's designed into the architecture of a system,
04:04
that it's not designed with inherent flaws, that we have means of detecting these flaws,
04:10
and we have means of detecting any type of modification. So that sums up missed 801 71. And I hope this has been helpful for you, and I would invite you to continue on in our Siri's related to miss standards and hope you find them to be equally helpful.
NIST 800-171 Controlled Unclassified Information Course
The Cybrary NIST 800-171 course covers the 14 domains of safeguarding controlled unclassified information in non-federal agencies. Basic and derived requirements are presented for each security domain as defined in the NIST 800-171 special publication.
Instructed By
Kelly Handerhan
Senior Instructor
