applying nist csf to a cv deployment€¦ · conceptual cv cfp. csf – functions. core. nist cyber...

APPLYING NIST CSF TO A CV DEPLOYMENT ITS World Congress 2018 TS50 : SECURITY September 20, 2018 Ray Resendes Volpe National Transportation Center U.S. Department of Transportation

Upload: others

Post on 13-Aug-2020

19 views

Category:

Documents

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: APPLYING NIST CSF TO A CV DEPLOYMENT€¦ · Conceptual CV CFP. CSF – FUNCTIONS. CORE. NIST Cyber Security Framework . SUMMARY OF SUBCATEGORY PRIORITIES BY MISSION OBJECTIVE. 9

APPLYING NIST CSF TO A CV DEPLOYMENTITS World Congress 2018TS50 : SECURITY

September 20, 2018Ray Resendes

Volpe National Transportation CenterU.S. Department of Transportation

Page 2: APPLYING NIST CSF TO A CV DEPLOYMENT€¦ · Conceptual CV CFP. CSF – FUNCTIONS. CORE. NIST Cyber Security Framework . SUMMARY OF SUBCATEGORY PRIORITIES BY MISSION OBJECTIVE. 9

PROGRAM STRATEGY

Purpose: The program’s objective is to:• Help organizations apply the principles and best practice of risk management to improving the

cybersecurity and resilience of critical transportation infrastructure. • The Privacy Research Analysis achieving freedom from conditions that can create problems for individuals

with unacceptable consequences that arise from transportation systems that process PII.

Strategic Direction: By applying cybersecurity and privacy guidance in a systematic manner to a connected vehicle environment, USDOT and stakeholders have the opportunity to create a set of detailed guidelines and tools that are specific to connected transportation and those organizations that deploy, operate, and maintain the network and systems.

NIST CYBERSECURITY FRAMEWORK

CYBERSECURITY FRAMEWORK COMPONENTS

Page 5: APPLYING NIST CSF TO A CV DEPLOYMENT€¦ · Conceptual CV CFP. CSF – FUNCTIONS. CORE. NIST Cyber Security Framework . SUMMARY OF SUBCATEGORY PRIORITIES BY MISSION OBJECTIVE. 9

CYBERSECURITY FRAMEWORK PROFILE DEVELOPMENT STEPS

Define the Scope of the Profile Completed

Determine Initial Scope of the Profile Completed

Conduct stakeholder workshops• Conduct Mission Objective

Development• Conduct Mission Objective

Scoring

Completed

CSF Profile Post-Workshop Analysis• Analyze Category Scoring• Develop & Share Draft Mission

Objectives & Category Scoring• Develop Subcategory selection• Develop Summary Subcategory-

Level Matrix• Develop Detailed Matrix

Completed

Develop Profile and Guidance Document In-Progress

Page 6: APPLYING NIST CSF TO A CV DEPLOYMENT€¦ · Conceptual CV CFP. CSF – FUNCTIONS. CORE. NIST Cyber Security Framework . SUMMARY OF SUBCATEGORY PRIORITIES BY MISSION OBJECTIVE. 9

DEVELOP MISSION OBJECTIVES

AACVTEAll ConsensusKEY:

Perform Communications, Outreach, and

Education

Develop Application

Requirements

Operate and Maintain System

Provide Economic

Opportunity

Manage data collection,

storage, and analysis

Plan Network Architecture

Manage AssetsProcure

Components & Select Suppliers

Develop/Design Installation

Guides & Verification Procedures

Specify Components

Maintain Personnel

Safety

Install Devices

Recruit Participants

Test & Certify Devices

Evaluate Performance

and Compliance

Assure System Safety

Maintain Data Other Mission Objectives?

Support Data Analyses

Support Mobility

Capabilities

Provide Transportatio

n Efficiency for

Commercial Vehicles

Define Security

Architecture

Provide protections for system and data

trustworthiness

Assure Data Transport

Page 7: APPLYING NIST CSF TO A CV DEPLOYMENT€¦ · Conceptual CV CFP. CSF – FUNCTIONS. CORE. NIST Cyber Security Framework . SUMMARY OF SUBCATEGORY PRIORITIES BY MISSION OBJECTIVE. 9

RANKING THE MISSION OBJECTIVES BY TRANSPOSING MISSION TO CYBER

Mission Objectives

Assure Data Transport

Assure System Safety

Provide Economic

Opportunity

Manage Assets

Manage data collection,

storage, and analysis

Provide protections for

system and data trustworthiness

Provide Transportation Efficiency for Commercial

Vehicles

Support Mobility Capabilities

CYBERSECURITY FRAMEWORK PROFILE POST-WORKSHOP ANALYSIS

Conceptual CV CFP

CSF – FUNCTIONSCORE

NIST Cyber Security Framework

SUMMARY OF SUBCATEGORY PRIORITIES BY MISSION OBJECTIVE

Page 11: APPLYING NIST CSF TO A CV DEPLOYMENT€¦ · Conceptual CV CFP. CSF – FUNCTIONS. CORE. NIST Cyber Security Framework . SUMMARY OF SUBCATEGORY PRIORITIES BY MISSION OBJECTIVE. 9

FRAMEWORK SUBCATEGORIES

Page 12: APPLYING NIST CSF TO A CV DEPLOYMENT€¦ · Conceptual CV CFP. CSF – FUNCTIONS. CORE. NIST Cyber Security Framework . SUMMARY OF SUBCATEGORY PRIORITIES BY MISSION OBJECTIVE. 9

NEXT STEPSNIST Cyber Security Framework

• Draft under review September 2018• Webinar November 2018• Public Release January 2019• Public Workshop February 2019

• Initiate development for an ITS-wide Profile January 2019

Page 13: APPLYING NIST CSF TO A CV DEPLOYMENT€¦ · Conceptual CV CFP. CSF – FUNCTIONS. CORE. NIST Cyber Security Framework . SUMMARY OF SUBCATEGORY PRIORITIES BY MISSION OBJECTIVE. 9

STAY CONNECTED

For more information, contact…

Ray ResendesVolpe National Transportation CenterU.S. Department of [email protected]

Kevin GayITS Joint Program OfficeU.S. Department of [email protected]

Website: http://www.its.dot.gov

mailto:[email protected]

Walk This Way: CIS CSC and NIST CSF is the 80 in the 80/20 rule

White paper series Issue 5 - CCDCOE...2.2. CSF Structure The NIST Cybersecurity Framework (CSF) consists of three main components: • Core • Implementation Tiers • Profiles Framework

APPLYING NIST CSF TO A CV DEPLOYMENT · APPLYING NIST CSF TO A CV DEPLOYMENT ITS America Annual Meeting 2018 SS24: CYBERSECURITY CHALLENGES FOR CAVS . June 6, 2018. Kevin Gay. ITS

APPLYING NIST CSF TO A CV DEPLOYMENT · APPLYING NIST CSF TO A CV DEPLOYMENT Transportation Research Board Annual Meeting 2018. January 9, 2018. ... • Application of the NIST Cybersecurity

CADRE DE CYBERSÉCURITÉ DU NIST€¦ · 4 Cadre de cyersécurité du IS Une approche intégrale de la cybersécurité 2.2. Structure du CSF Le Cybersecurity Framework (CSF) se compose

NIST Cybersecurity Framework · 2020. 4. 23. · Why NIST CSF? •Intent –Voluntary –Adaptable and flexible •Leverages standards, methodologies, and processes –Not a compliance

NIST CSF Internal Controls - Home - Springer978-1-4842-3060-2/1.pdf · NIST CSF Internal Controls Category Subcategory Internal Control Access Control PR.AC-1: Identities and credentials

NIST サイバーセキュリティフレームワーク (CSF)...セキュアなクラウドの採用 2 ガートナー社によれば、 CSF は米国の民間セクターの約

CSF Support for HIPAA and NIST Implementation and Compliance Presented By Bryan S. Cline, Ph.D. Presented For HITRUST

ٟك٠رم٤ا ٟنولا ٙعملا اإ NIST ة١نقلاٚ ر١٠اعملل (CSF ......1 ϒدϭتسϥϠا رϯϭϥجϠا ةϵϕϵϜ ϳϔ ϦϮرωϩϴ ϧϴذϠا ةϥωϩϥϠا ϖاυϨ

Comparing the CSF, ISO/IEC 27001 and NIST SP 800-53 Brochure

NIST Framework Core · 2019-11-21 · Technology Cybersecurity Framework (NIST CSF) as the standard for educational agencies. At the center of the framework is the Core, which is

Choosing an Information Risk Management Framework: The Case for the NIST … · 2020-03-16 · Technology (NIST) Cybersecurity Framework (CSF) Once a healthcare organization decides

Lessons Learned from the NIST CSF

The NIST Cybersecurity Framework (CSF) · The NIST Cybersecurity Framework (CSF) Unlocking CSF - An Educational Session Robert Smith Systemwide IT Policy Director . ... Case Study

CYBER RESILIENCE REVIEW (CRR) · Cyber Resilience Review (CRR): NIST Cybersecurity Framework Crosswalks Cyber Resilience Review (CRR) to NIST Cybersecurity Framework (CSF) Crosswalk

Contents · Risk Assessment Risk Management Identify A three-minute tour of the NIST CSF Let’s start with a “CliffsNotes” overview . Like an apple, at the core of the CSF is,

NIST Critical Security Framework (CSF)

CISMカンファレンスNISTとCOBITフレームワークとの互換性を強調 IPAのNIST CSF翻訳も参考に使用サイバーセキュリティ翻訳活動② “NIST Cybersecurity

Protecting Your Most High-Value Assets with the NIST ......PROTECTING YOUR MOST HIGH-VALUE ASSETS WITH THE NIST CSF 3 Executive Summary The Trump administration is doubling down on

Sean Sweeney, Information Security Officer of the NIST CSF •Executive Order 13636, Improving Critical Infrastructure Cybersecurity, Feb. 2013 –Directed NIST to work with stakeholders

Technical Implementation of NIST/FFIEC CSF Detailed ... · NIST/FFIEC CSF –Detailed Hardening and Vulnerability Management Techniques Jeff Roth, CISSP-ISSEP, CISA, CGEIT, QSA

MANAGING THE EFFECTIVENESS OF A CYBER SECURITY PROGRAM THROUGH A NIST … - Gestionando la... · 2016. 11. 3. · The NIST CSF is not proscriptive! The NIST CSF does not include any

NIST Cybersecurity Framework (CSF) Web Services – NIST Cybersecurity Framework Page 3 Contents Introduction 5 Security Benefits of Adopting the NIST CSF 6 AWS Services that Enable

CSF Support for HIPAA and NIST Implementation and Compliancehitrustalliance.net/.../uploads/2014/03/CSF-Support-for-HIPAA-and-NI… · Part of risk management, incorporates threat

Comparing the CSF, ISO/IEC 27001 and NIST SP 800-53 · Comparing the CSF, ISO/IEC 27001 and NIST SP 800-53 Why Choosing the CSF is the Best Choice June 2014

NIST Cybersecurity 101 - Tigsus · • NIST defined the controls and organized them into a catalog. • CSF defined an information security framework to serve as a guide for developing

HITRUST CSF to NIST Relationship Matrix v3hitrustalliance.net/content/uploads/2014/07/CSF-NIST-Matrix-v3.pdf · HITRUST CSF to NIST Relationship Matrix v3 Scope This matrix is provided

Protecting Your Toll System: RFP Survey Findings › sites › default › files › ... · NIST CSF Overview 08 September 2017 3 Foundation NIST Guidelines SABSA ISO Industry APTA

Statewide Information Security Plan - Oregon€¦ · the NIST Cyber Security Framework (CSF) and the ISO 27001 & ISO 27002 framework. Other frameworks, such as COBIT, ISA, and NIST

NIST Framework for Improving Critical Infrastructure ... CSF WP.pdf · Below is a sample mapping of the NIST Framework for Improving Critical Infrastructure Cybersecurity against

HITRUST NIST CSF RFI Response

NIST Cybersecurity Framework (CSF)

Microsoft Azure Compliance Offerings · CIS Controls map to many established standards and regulatory frameworks, including the NIST Cybersecurity Framework (CSF), NIST SP 800-53,

A RIPE Implementation of the NIST Cyber Security … RIPE Implementation of the NIST Cyber Security Framework Adding the How-To to the NIST CSF Perry Pederson October 2014 The Langner