NIST Cybersecurity Framework

Welcome back to the follow on discussion to part 1 of this blog, “Solving for 4 of 5 NIST Cybersecurity Framework Core Elements“.

The National Institute of Standards and Technology (NIST) Cybersecurity framework 1.0 core consists of five elements: Identify, Protect, Detect, Respond, and Recovery. The core elements are a high-level strategy presentation of a risk-based approach to managing cybersecurity risk while providing traceability back to the business objectives. These core element categories should sound familiar because they are a result of industry standards and best practice guidelines that enable enterprises to solve for the “low hanging fruit” or as some call it the “blocking and tackling” of enterprise risk management.

While there are fundamental functions within the core elements, these can be performed in parallel and continuously based upon the framework implementation tier your organization falls into. Below ForeScout CounterACT capabilities to align matched up with the associated NIST CSF 1.0 framework core elements.

NIST CSF Functional Area & Subcategories	ForeScout CounterACT
Identify (Foundation Element) Asset Management Complete view of all devices, software and users connected to the network Understand business value and criticality of the resource Risk Assessment Understand and assess the threat and vulnerability information shared from various sources	Solving for Visibility, Automation and Collaboration Asset Intelligence Real-time clientless asset discovery, profiling, classification/prioritization. HW/SW inventory Security Intelligence/Management Control Fabric: Bi-directional information-sharing integration & control platform with market leading endpoint compliance, configuration management, vulnerability management, advanced threat detection (ATD) and GRC/SIEM tools to fully understand the threat, risk and vulnerability landscape
Protect Access Control Physical and logical control of resources: “who, what, when, and where Network integrity is protected, incorporating network segmentation Protect Technology Removable media is protected and restricted Information Protection Processes and Procedures Configuration baseline and management of information technology/industrial control systems Effectiveness of protection technologies is shared with appropriate stakeholders	Solving for Control, Automation and Collaboration Network Access Control OS vendor and infrastructure agnostic to control the “who, what, when and where” across wired, wireless or VPN. Effective with or without 802.1X: Employing VLAN steering, port-based ACL, vFirewall capabilities External Device Control Detect and control all external devices e.g. USB, flash, Bluetooth Configuration Intelligence Bi-directional information-sharing integration & control platform with market leading configuration management/CMDB solutions Ability to invoke configuration remediation techniques
Detect Anomalies and Events Anomalous activity is detected Security Continuous Monitoring Network monitoring to detect potential cybersecurity events Monitoring of unauthorized personnel, connections, devices and software Vulnerability scans are performed	*Solving for Control, Automation and Collaboration* ActiveResponse™ Patented methodology that detects and blocks the activity that precedes the attack e.g. reconnaissance Continuous Intelligence Monitoring & Control Control Fabric: Bi-directional information-sharing integration & control platform with market leading endpoint compliance, configuration management, vulnerability management, advanced threat detection (ATD) and GRC/SIEM tools to fully understand the threat, risk and vulnerability landscape Ability to evolve time-based vulnerability assessment to a event-based vulnerability assessment
Respond Mitigation Incidents are contained Incident are mitigated	*Solving for Control, Automation and Collaboration* Network Access Control OS vendor and infrastructure agnostic to control the “who, what, when and where” across wired, wireless or VPN. Effective with or without 802.1X: Employing VLAN steering, port-based ACL, vFirewall capabilities Continuous Intelligence Monitoring & Control Control Fabric: Bi-directional information-sharing integration & control platform with market leading endpoint compliance, configuration management, vulnerability management, advanced threat detection (ATD) and GRC/SIEM tools to fully understand the threat, risk and vulnerability landscape Ability to invoke configuration remediation techniques

NIST CSF Functional Area & Subcategories

ForeScout CounterACT

Identify (Foundation Element)

Asset Management

Complete view of all devices, software and users connected to the network
Understand business value and criticality of the resource

Risk Assessment

Understand and assess the threat and vulnerability information shared from various sources

Solving for Visibility, Automation and Collaboration

Asset Intelligence

Real-time clientless asset discovery, profiling, classification/prioritization. HW/SW inventory

Security Intelligence/Management

Control Fabric: Bi-directional information-sharing integration & control platform with market leading endpoint compliance, configuration management, vulnerability management, advanced threat detection (ATD) and GRC/SIEM tools to fully understand the threat, risk and vulnerability landscape

Protect

Access Control

Physical and logical control of resources: “who, what, when, and where
Network integrity is protected, incorporating network segmentation

Protect Technology

Removable media is protected and restricted

Information Protection Processes and Procedures

Configuration baseline and management of information technology/industrial control systems
Effectiveness of protection technologies is shared with appropriate stakeholders

Solving for Control, Automation and Collaboration

Network Access Control

OS vendor and infrastructure agnostic to control the “who, what, when and where” across wired, wireless or VPN.
Effective with or without 802.1X: Employing VLAN steering, port-based ACL, vFirewall capabilities

External Device Control

Detect and control all external devices e.g. USB, flash, Bluetooth

Configuration Intelligence

Bi-directional information-sharing integration & control platform with market leading configuration management/CMDB solutions
Ability to invoke configuration remediation techniques

Detect

Anomalies and Events

Anomalous activity is detected

Security Continuous Monitoring

Network monitoring to detect potential cybersecurity events
Monitoring of unauthorized personnel, connections, devices and software
Vulnerability scans are performed

Solving for Control, Automation and Collaboration

ActiveResponse™

Patented methodology that detects and blocks the activity that precedes the attack e.g. reconnaissance

Continuous Intelligence Monitoring & Control

Control Fabric: Bi-directional information-sharing integration & control platform with market leading endpoint compliance, configuration management, vulnerability management, advanced threat detection (ATD) and GRC/SIEM tools to fully understand the threat, risk and vulnerability landscape
Ability to evolve time-based vulnerability assessment to a event-based vulnerability assessment

Respond

Mitigation

Incidents are contained
Incident are mitigated

Solving for Control, Automation and Collaboration

Network Access Control

OS vendor and infrastructure agnostic to control the “who, what, when and where” across wired, wireless or VPN.
Effective with or without 802.1X: Employing VLAN steering, port-based ACL, vFirewall capabilities

Continuous Intelligence Monitoring & Control

Control Fabric: Bi-directional information-sharing integration & control platform with market leading endpoint compliance, configuration management, vulnerability management, advanced threat detection (ATD) and GRC/SIEM tools to fully understand the threat, risk and vulnerability landscape
Ability to invoke configuration remediation techniques