The NIST Cybersecurity Framework 2.0

Identify (ID)

Help determine the current cybersecurity risk to the organization.

Asset Management (ID.AM)

Assets (e.g., data, hardware software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization’s risk strategy.

Forescout automatically generates and updates inventories of assets, systems and services, as well as detailed mappings of the organization’s network communications and data flows internally and externally. It ensures these inventories are kept up to date throughout the equipment’s lifecycle. It considers historical data, such as change and configuration management and risk timelines. Assets are systematically prioritized according to their classification, criticality, exploitability and potential impact on the business. This comprehensive approach leads to improved decision making, enhanced compliance and asset utilization — and proactive risk management. The Platform revolutionizes asset discovery and vulnerability management by combining passive and active techniques to continuously monitor and profile networked systems, regardless of their operating system or form factor. This approach ensures a comprehensive inventory of the organization assets that is automatically updated to reflect new installations or configurations. Forescout provides detailed visualizations of the devices connected to the network and their interactions and helps identify security boundaries and associated device groups through a dynamic traffic flow matrix. This provides deep insight into communication patterns, including protocols, ports and traffic volumes. The Platform extends its monitoring to external systems and services, ensuring that they comply with the organization’s security standards and facilitating access management based on roles or security status. By automatically categorizing resources by role, classification and criticality, Forescout empowers organizations to effectively manage their entire digital ecosystem and improve security and operational efficiency across IT, OT, IoT, BAS and IoMT domains.

Risk Assessment (ID.RA)

The organization understands the cybersecurity risk to the organization, assets, and individuals.

Forescout improves risk management by automating the identification of threats, assessing their potential impact and likelihood — and enabling the prioritization of risks. The platform equips security teams with comprehensive tools for vulnerability lifecycle management, threat monitoring, analyzing network and system designs for cybersecurity weaknesses, and documenting changes and exceptions for risk assessment. Forescout provides organizations with complete visibility into the converged attack surface, identifying, quantifying, and controlling cyber threats across the entire extended IT/OT environment, from endpoints (managed and unmanaged) to ICS, embedded, virtual and cloud systems, external services, CCTV, access control, HVAC and building management automation systems (BMS/BAS). Each connected asset and system receive a risk score based on its configuration, function and behavior, enabling immediate action or automated remediation by Forescout’s policy engine. The multifactor risk score prioritizes risks based on a continuous assessment that incorporates vulnerability assessment data, asset criticality, misconfigurations, exposure to the internet, exploitability, compliance and environmental context to optimize orchestration and patching processes. The Forescout Vistaro™ platform supports organizational risk management decisions, enabling security teams to identify and prioritize threat response and initiate fully automated remediation and mitigation workflows in real time. Leveraging open-source technologies, such as NVD and MITRE, and proprietary intelligence from Forescout’s Vedere Labs, Forescout contextualizes organizationspecific
threats to increase operational efficiency and reduce response times.

Improvement (ID.IM)

Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all Framework Functions.

The Forescout Vistaro™ platform provides security insights, risk and performance indicators that enable organizations to improve their cybersecurity risk management processes with data-driven evidence for decision making across all functions. Key metrics include: The number of compliant assets, vulnerability distribution, change and configuration management efficiency, likelihood of threats, their impact, incident response times, etc. This helps to better understand the current exposure and effectiveness of existing security measures and to prioritize risk mitigation actions. Using these metrics improves the risk management process and leads to a more robust cybersecurity posture, optimized resource allocation and improved regulatory compliance. Forescout automates the incident response process and helps with system recovery and rebuilding after a crisis. The platform enables a continuous monitoring strategy that utilizes ICS-specific threat indicators for real-time control assessments and security effectiveness against advanced threats. In addition, Forescout enables the creation of customized analytics and dashboards as well as reporting to communicate key security metrics and KPIs to ensure a comprehensive assessment of cyber and physical security controls. The Platform supports (and automates) the incident response process and provides critical information for testing the recovery and rebuilding of the system to a known state after a catastrophic event.

Protect (PR)

Use safeguards to prevent or reduce cybersecurity risk

Identity Management Authentication and Access Control (PR.AA)

Access to physical and logical assets is limited to authorized users, services, and hardware, and is managed commensurate with the assessed risk of unauthorized access (formerly PR.AC).

Forescout orchestrates information sharing and automates workflows between many security tools to actively reduce the risk of cyberattacks behind the misuse or compromise of identities and credentials. The Platform enables the implementation of granular access policies and dynamic segmentation rules based on the device’s risk score and the principles of least privilege and separation of duties. Forescout streamlines the development, management, enforcement and review of an organization’s policies and procedures and continuously validates the identity and integrity of each connected device to detect modifications or changes that could alter the risk posture. The Platform continuously detects, profiles and monitors devices and users accessing the organization’s digital environment to quickly identify and automatically respond to threats and prevent unmanaged privileged accounts. In addition, Forescout provides audit trails, details and logs for all user activity, along with usernames, user privileges, type of event, severity, date, and time. Forescout integrates with third-party solutions (e.g. IDM systems) to proactively manage the entire identity authentication lifecycle and uniquely identify and authenticate organizational and nonorganizational users.

Awareness and Training (PR.AT)

The organization’s personnel are provided cybersecurity awareness and training so they can perform their cybersecurity-related tasks.

Our Professional Services offer end-user training aimed at assisting customers design, plan, deploy and optimize a comprehensive information security program through the Forescout Vistaro™ platform. In addition, Forescout’s analytics and insights facilitate the regular evaluation of security issues, such as common security breaches, threat scenarios or historical incidents. This enables the creation of tailored awareness training for different roles and responsibilities based on real security events and use cases, improving security awareness and readiness of the organization.

Data Security (PR.DS)

Data is managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, an availability of information.

Forescout helps customers monitor and manage access to sensitive or confidential data when it is stored or transmitted. With complete visibility of network access and data flow, customers can easily detect unauthorized connections, insecure communication channels, unauthorized changes and attempts to exfiltrate data. The combined use of NAC and segmentation with a Zerto Trust approach provides multiple layers of defense against unauthorized access and data breaches, significantly improving the overall protection of sensitive data. This also ensures a more resilient network architecture capable of surviving and recovering from cyber incidents while maintaining data confidentiality, integrity and availability. With complete visibility into network access and data flow, customers can easily detect unauthorized connections, unauthorized changes and attempts at data exfiltration. This is particularly useful in ICS environments where data protection mechanisms are often not in place.

Platform Security (PR.PS)

The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization’s risk strategy to protect their confidentiality, integrity and availability.

Forescout provides comprehensive device lifecycle management that includes robust configuration, change and risk management measures. The Platform automatically discovers devices and maps communication and data flows with users, roles and responsibilities for organizational and external entities. Based on this inventory, Forescout creates and maintains a baseline configuration for assets and systems and enables real-time monitoring and updating of changes. This comprehensive strategy ensures that software and hardware are appropriately maintained, updated or decommissioned depending on the associated risk. Moreover, Forescout blocks unauthorized software installations and executions. In addition, it works with its correlation engine, to automatically report on alerts on events related to change control,
authentication activities, user privileges, access provisioning and malware executions. The platform’s user-friendly interface allows security analysts to easily navigate through device information timeline, detect non-compliant devices, deviations from baseline configurations — and identify security issues with minimal effort to improve the overall
security posture.

Technology Infrastructure Resilience (PR.IR)

Security architectures are managed with the organization’s risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience.

Forescout enables organizations to increase the resilience of their infrastructure through visibility and control over every system, component and service spanning IT, OT, IoT, IoMT networks and physical systems, including CCTV, building management, HVAC and controls for water, power, temperature and humidity, and more. This provides granular control over device risk and compliance, network access and communication patterns. It helps implement robust segmentation policies to effectively minimize and restrict access to what is absolutely necessary. Forescout accelerates Zero Trust segmentation across different digital landscapes, users, services and device types by performing real-time assessments of the security posture of endpoints before granting access to resources. This increased visibility of the network and data flow also helps identify single points of failure or bottlenecks in traffic within systems and infrastructures, increasing operational resilience, supporting incident containment and improving network performance.

Detect (DE)

Find and analyze possible cybersecurity attacks and compromises.

Continuous Monitoring (DE.CM)

Assets are monitored to find anomalies, indicators of compromise and other potentially adverse events.

Forescout automatically discovers and monitors users, assets and systems, including access control, CCTV, HVAC and building automation to detect anomalies, indicators of compromise and other potentially adverse events. The Platform combines various protection mechanisms, including: Network traffic and behavior analysis, automatic or on-demand device scanning, code and configuration integrity checking, monitoring of local and remote maintenance activities, and file exchange to detect potentially dangerous scenarios. This capability extends across the network, operations and industrial process to detect not only security events but also operational issues that could pose a potential threat to the delivery of the industrial process or the security of information. To provide even more effective protection, threat and risk detection is constantly being improved with IoC and IoA derived from research conducted by Vedere Labs, Forescout’s threat intelligence research center. The monitoring capabilities extend to hardware and software components with an asset inventory that includes details about the device’s operating system, firmware inventory, registry keys, shared and encrypted folders for software or network adapters, asset IDs, X.509 certificates, physical drives, motherboards, CPUs, monitors and display devices for the hardware. In addition, Forescout helps organizations establish a baseline of acceptable system behavior and set precise thresholds for event detection. This allows security professionals to customize alert settings and automate incident response to optimize the overall security posture.

Adverse Event Analysis (DE.AE)

Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents (formerly DE.AE, DE.DP-02)

Forescout uncovers known and unknown cyber threats using several techniques and deploying thousands of specific, proprietary checks and Indicators of Compromise (IOCs) to detect cyber and operational events and prioritize them according to urgency and potential business impact. The platform is characterized by precise detection, drastic minimization of false positives, and advanced event classification. Events are automatically categorized into groups (security, networking, operational, anomalies) and several subcategories (including data breaches, DoS attacks, IOC matches, malware activity, etc.), enabling quick identification of events and accelerating analysis and remediation workflows. Additional event information with full details and actionable data, including underlying events and historical context, triggers, causes, impacts, TTP’s MITRE ATT&CK mapping and playbooks, are available to security teams to facilitate cross-team and cross-role communication and improve alert triage and incident response. The Platform implements role-based access so that the groups that are allowed to access incident information or handle alarms can be precisely defined. It is also possible to forward or export detection data to other tools such as SIEM or ticketing and service solutions. The detection and classification of events is enhanced by threat intelligence from Vedere Labs. This enhancement not only improves threat detection capabilities, but also provides key insights to contextualize events that detail attackers’ behaviors, strategies and tactics in executing cyberattacks.

Respond (RS)

Take action regarding a detected cybersecurity incident.

Incident Management (RS.MA)

Responses to detected cybersecurity incidents are managed (formerly RS.RP).

Forescout enhances incident response by offering an integrated capability that includes detection, analysis, containment, eradication and recovery. The Platform uniquely combines advanced threat identification with effective incident classification and prioritization leveraging Tactics, Techniques and Procedures (TTPs). This enables security analysts to manage events more efficiently through data correlation, automated incident categorization and attacker behavior monitoring. By integrating essential SOC technologies into a unified, cloud-native platform, Forescout simplifies management from a single console and enables automated response and orchestration via NAC, segmentation, SIEM and TDR. This approach enhances detection, streamlines analysis, and supports faster recovery. By prioritizing incidents based on scope, impact and urgency, Forescout facilitates comprehensive investigations, tracks the status of incidents and produces detailed, evidence-based reports for broader security collaboration.

Incident Analysis (RS.AN)

Investigation is conducted to ensure effective response and support forensics and recovery activities.

Forescout helps security analysts respond to incidents by giving them the tools they need to analyze alerts and uncover systemic root causes within a single user interface. The Platform enables a detailed investigation into the timeline of the incident showing which assets and resources were involved in each event. Analysts can also identify the vulnerabilities, threats and TTPs that were directly or indirectly involved, providing a full view of the incident’s dynamics. Forescout also facilitates the collection and retention of all relevant data and metadata related to an incident from multiple sources, enabling responders to preserve the integrity of evidence and automatically scan other potential targets of the incident to look for indicators of compromise and signs of persistence.

Incident Response Reporting and Communication (RS.CO)

Response activities are coordinated with internal and external stakeholders as required by laws, regulations or policies.

Forescout contributes significantly to improving incident reporting and communication strategies. The platform collects detailed incident data and provides in-depth analysis, forensic details and key insights into what happens during and after cybersecurity incidents. Forescout’s ability to deliver this information in a consistent language and reporting format is essential for analyzing the details and nuances of each incident. This promotes a consistent understanding of the impact of the incident and subsequent actions by all parties involved and supports legal, regulatory or policy requirements for coordinated response activities with internal and external stakeholders.

Incident Mitigation (RS.MI)

Activities are performed to prevent expansion of an event and mitigate its effects.

Forescout’s robust integration with various IT and security systems enables security teams to streamline and accelerate cybersecurity incident response across third-party solutions. The Platform provides end users with the flexibility to either automate or manually initiate a range of containment and eradication actions to effectively isolate or remediate compromised endpoints. From detection to remediation, enhanced incident management enables organizations to quickly and deftly manage security incidents, reduce their impact with limited resources and strengthen resilience against future attacks. The Platform enables shorter system recovery times and increases cyber security. This approach not only mitigates the immediate impact of incidents but also strengthens defenses against future threats and ensures a more resilient infrastructure.

Recover (RC)

Restore assets and operations that were impacted by a cybersecurity incident.

Incident Recovery Plan Execution (RC.RP)

Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents.

The Forescout Vistaro™ platform significantly improves the execution of incident recovery plans, a critical component to the resilience and reliability of an organization’s cybersecurity infrastructure. Forescout provides security teams with comprehensive access to historical data, including device configurations, communication patterns and process behavior. The Platform allows thorough review of the integrity and normal operation of assets, systems and services post-recovery. This comprehensive insight is instrumental for restoring operations and for ensuring that the restored environments are free of vulnerabilities or threats that could lead to future security breaches.

Incident Recovery Communication

Restoration activities are coordinated with internal and external parties.

Forescout equips asset owners with a range of features that streamline the recovery process and facilitate coordination and communication between internal and external stakeholders. The platform highlights incidents by providing actionable insights and evidence that are essential for documentation and reporting purposes. Each step of the operational recovery process can be closely tracked, allowing a detailed comparison between the previously established baseline and the status to monitor progress. In addition, Forescout uses standardized language and terminology (e.g. MITRE ATT@CK event mapping) to effectively articulate and share details of attacker tactics and incident specifics across all organizational levels. This approach ensures that threat information is communicated clearly and comprehensively, improving the organization’s
incident response and communication strategies.