Exploring the NIST Cybersecurity Framework 2.0: What You Need to Know
Summary
TLDRこのトランスクリプトは、Windsor Technology GroupのMatt KazlowskiとArctic WolfのTodd Malletが共同で行ったウェビナーの内容を要約しています。彼らは、NISTサイバーセキュリティフレームワーク2.0について議論し、その更新点、供給チェーンのリスク管理、および新しいガバナンス機能の強化されたemphasisを説明しています。また、Arctic WolfとWindsor Technology Groupが顧客のニーズに合わせて提供するサービスと製品についても触れています。
Takeaways
- 📌 NIST Cybersecurity Framework 2.0 はまだドラフト段階にありますが、ほぼ完成品に近いとされています。
- 🛡️ Winslow Technology Group は、マサチューセッツ州のウォラムズに本社を置いており、東北部からカリフォルニアまで地域的なカバーを提供しています。
- 🤝 Arctic Wolf は Winslow Technology Group とパートナーシップを結んでおり、セキュリティ技術やサービスを提供しています。
- 🔍 NIST 2.0 は、グローバル経済や垂直統合の進展により、供給チェーンのリスクが重要視されるようになりました。
- 📈 NIST 2.0 では、6つの機能(Identify, Protect, Detect, Respond, Recover, Govern)が新たに設けられました。
- 📚 旧バージョンの NIST 1.1 から NIST 2.0 への移行は、既存のセキュリティ体制を改善するための一歩として位置付けられています。
- 💡 Arctic Wolf は、継続的な監視と事象分析を通じて、マネージドセキュリティオペレーションセンター(MDR)を提供しています。
- 🔄 NIST 2.0 は、リスク管理戦略やポリシーの重要性を強調し、組織全体のセキュリティ体制に関与する利益関係者を拡大するよう求めています。
- 🚨 セキュリティ事件への対応においては、迅速かつ計画的なアプローチが重要であり、混乱を避けるための事前準備が求められます。
- 🛠️ NIST フレームワークの評価や、リスク管理に関するサポートが必要な場合は、Winslow Technology Group が提供する無償のミニ評価を受けることができます。
Q & A
NIST Cybersecurity Framework 2.0の主要な更新点は何ですか?
-NIST Cybersecurity Framework 2.0の主要な更新点は、新しい統治機能の追加、供給チェーンのリスク管理の強化、およびCMMCに関連する制御のいくつかの変更です。
統治機能がNIST 2.0にどのように役立つのでしょうか?
-統治機能は、NIST 2.0において、他の5つの機能を組織の使命とステークホルダーの期待に関連联させることを助け、全面的なセキュリティ戦略を構築する上で欠かせない要素となっています。
Winslow Technology Groupが提供するサービスは何ですか?
-Winslow Technology Groupは、プロフェッショナルサービス、网络安全、ネットワーク、クラウドなどの分野で、技術的なエンジニアリングを提供しています。また、Arctic Wolfなどのパートナーシップを通じて、デスクトップからデータセンターまでをカバーするゲームチェンジングのソリューションと技術を提供しています。
Arctic WolfのMDRサービスとは何ですか?
-Arctic WolfのMDRサービスは、マネージドセキュリティオペレーションセンターをサービスとして提供することを指します。これは、継続的な監視、異常イベント分析、およびインシデント対応を含みます。
NIST 2.0のリリースに準備するために、どのようなアクションを取ることができますか?
-NIST 2.0のリリースに準備するために、組織は現在のセキュリティ状況を評価し、リスク管理戦略を改善し、継続的な監視とインシデント対応計画を強化する必要があります。また、GRCツールなどの支援ツールを利用して、効果的な実施を図ることも重要です。
Arctic WolfがCMMCレベル2の認定を取得しているのはいつからですか?
-Arctic Wolfは現在、CMMCレベル2の多くのコントロールを満たしており、そのほとんどを補完しています。将来的には、CMMCレベル2の正式な認定を目指しています。
FedRAMP ModerateまたはHighのクラウドセキュリティ要件を満たすために、Arctic Wolfはどのような措置をとっていますか?
-Arctic Wolfは、北米に基づく顧客に対して、北米のみのArctic Wolfの従業員と通信し、データロケールは100%アメリカ合衆国に基づいており、他の国にはトラバースされないことを保証しています。また、PII(個人を特定できる情報)は吸収せず、吸収された場合でも即座に削除する制御が設けられています。
NISTフレームワークとSOC 2の関係は何ですか?
-NISTフレームワークは、SOC 2プログラムと重複しています。NISTフレームワークは、多くのコントロールをカバーしており、SOC 2に準拠するための大きな準備をします。ただし、SOC 2はサービスプロバイダーに特化したコントロールを持っているため、NISTフレームワークとSOC 2の両方を満たすことが重要です。
Winslow Technology Groupは、NIST評価をどのように支援していますか?
-Winslow Technology Groupは、無料でミニNISTサイバーセキュリティフレームワーク評価を提供しています。これは、各機能に関する一連の質問に基づくコンサルチティブなインタビューであり、顧客がフレームワークに関する質問や一般的なセキュリティに関する質問をすることができます。評価の結果、顧客は赤、緑、黄の異なるカラーコーディングによる完全な報告を受け取ります。
GRCツールについて、どのようなアドバイスがありますか?
-GRCツールは、ガバナンス、リスク管理、コンプライアンスを管理するのに役立ちますが、エクセルなどの基本的なツールでは効果的に管理することが難しいです。Winslow Technology Groupは、GRCツールを提供しており、顧客がNIST 2.0への移行を支援することができます。
Outlines
📢 ウェルカムとNIST CSF 2.0の紹介
Matt KazlowskiがWindo Technology GroupのVPとして、Cyber Securityに関するウェビナーで登壇。Toddを紹介し、NIST Cyber Security Framework 2.0について話し合う。NIST 2.0はまだドラフト段階にあるが、已完成の製品に近い。このフレームワークの更新版には重要な情報がある。
🗓 ウェビナーのアジェンダとWindo Technology Groupの紹介
ウェビナーのアジェンダを説明し、Windo Technology GroupとArctic Wolfのサービスについて説明。参加者は質問をチャットで投じて、後半でまとめて回答する。Windo Technology Groupのローカルカバーとパートナーシップについても触れる。
🌟 Winslowの技術力とNISTフレームワークの適用
Windsor Technology Groupの技術力と、Pre-salesとPost-salesの専門家がNIST 1.0または1.1フレームワークに対応する方法について説明。GRCツールを提供し、リスク管理の様々な要素を取り入れている。
🚀 NIST CSF 2.0の更新と供給チェーンの強化
NIST CSF 2.0の更新内容について説明し、Govern機能の追加と供給チェーンのリスク管理の強化について議論。CMMCに関連する制御についても触れ、Arctic Wolfがどのように役立つかを示唆。
🔍 NIST 2.0の検出と対応機能の改善
NIST 2.0における検出過程の改善と、Arctic Wolfのマネージドセキュリティ運用センター(MDR)サービスの役割について説明。継続的な監視と事件分析の重要性に焦点を当て、Arctic Wolfが提供するサービスの背後にある理念を明確にする。
🛠️ 事故復旧計画とNIST 2.0の改善
NIST 2.0の復旧機能の焦点を事故復旧計画の実行と通信に変更することを説明。事故対応の際の分析、計画の立て方、適切な行動の重要性について強調し、Arctic WolfとWindsor Technology Groupがどのように役立つかを述べる。
🏛️ ガバナンスとNIST 2.0の全体像
NIST 2.0におけるガバナンス機能の6つのサブカテゴリーについて説明し、組織全体のセキュリティ框架に対する認識を高める。重要なのは、ガバナンスが他の5つの機能に影響を与えることである点である。
🔑 セキュリティの管理とNIST 2.0の適用
NIST 2.0の管理機能がどのように組織のセキュリティ戦略を確保し、リスク管理戦略を定義するかを説明。NIST 2.0が他のコンプライアンスに準備する際に役立つ理由を強調し、Arctic WolfがFedRAMPやCMMCの認定に向けて取り組んでいることを述べる。
📋 NIST CSF 2.0のタイムラインとQ&A
NIST CSF 2.0のドラフトのタイムラインを説明し、ウェビナーの最後にQ&Aセッションを提供する。Arctic WolfのサービスがどのようにNIST 2.0の要件に対応しているか、またGRCツールがどのように役立つかを説明。
Mindmap
Keywords
💡NIST Cybersecurity Framework 2.0
💡Risk Management
💡Supply Chain Risk
💡Governance
💡Managed Security Operations Center (MSOC)
💡Incident Response
💡CMMC (Cybersecurity Maturity Model Certification)
💡FedRAMP (Federal Risk and Authorization Management Program)
💡SOC 2 (System and Organization Controls Type 2)
💡GRC Tool (Governance, Risk, and Compliance Tool)
Highlights
Overview of the NIST Cybersecurity Framework 2.0
Introduction of Matt Kazlowski, VP of Professional Services in Cybersecurity at the Winslow Technology Group
Todd, a senior sales engineer from Arctic Wolf, joins the discussion
The framework has been in development and is close to a finished product
Updates to the NIST Cybersecurity Framework 2.0 and their importance
Agenda for the webinar covering Winslow Technology Group and their Cybersecurity Solutions
Discussion on the regional coverage and reach of Winslow Technology Group
Emphasis on customer satisfaction and outcomes as a measure of success for Winslow Technology Group
Technical Engineers at Winslow Technology Group and their combined technical experience
Introduction to Arctic Wolf and their partnership with Winslow Technology Group
Updates to the NIST Cybersecurity Framework 2.0, including the addition of the 'Govern' function
Discussion on the supply chain risks and their relevance to the NIST framework
Timeline for the rollout of NIST Cybersecurity Framework 2.0
How to prepare for NIST Cybersecurity Framework 2.0 and the offerings from Winslow and Arctic Wolf
Explanation of the six controls of NIST 2.0 and their purposes
Discussion on the importance of governance in the NIST Cybersecurity Framework 2.0
The role of the 'Govern' function in creating a comprehensive security plan for organizations
The impact of the NIST Cybersecurity Framework 2.0 on various stakeholders within an organization
The evolution of the NIST Cybersecurity Framework from version 1.1 to 2.0
The significance of the 'Improvement' category in the Identify function of NIST 2.0
Details on the Protect function and its focus on platform security and technology infrastructure resilience
The Detect function and its emphasis on continuous monitoring and adverse event analysis
The Respond function and its new categories for incident management, analysis, response reporting, and communication
The Recover function and its focus on restoring assets and operations with a well-orchestrated plan
The Govern function and its role in establishing and monitoring the organization's cybersecurity risk management strategy
The importance of understanding and managing risks in the context of the organization's mission and stakeholder expectations
The potential impact of the NIST Cybersecurity Framework 2.0 on insurance premiums and risk management
The necessity of planning and risk management in preventing future cybersecurity incidents
The offer of a free mini NIST Cybersecurity Framework assessment by Winslow Technology Group
The discussion on how the NIST framework can complement other compliance frameworks like SOC 2 and FedRAMP
Transcripts
all right good morning everyone I am
Matt kazlowski I'm the VP of
Professional Services in cyber security
at the windso Technology Group and this
morning I am joined uh with Todd uh
senior sales engineer from Arctic Wolf
networks high at top the Winslow uh
webinar
Tower uh today we're actually gonna
cover the nist uh cyber security
framework 2.0 um so this framework has
been in the works for a bit of time it
is technically still in the uh the draft
state but it's pretty close to a a
finished product and we wanted to get
some information out um there's some
really great um updates to the framework
and um some some important information
there so Todd thank you very very much
for uh for joining us this morning um
yep yep good uh next slide there uh we
can talk about the agenda bit so we'll
just give you a brief overview of the
windso Technology Group um and our cyber
Security Solutions and and portfolio
here I'm gonna pass the uh the old mic
to uh to Todd um one of our senior sales
Engineers over at Arctic networks to
talk quite a bit about um the framework
it's going to be a pretty open uh open
discussion um if people have any
questions uh during uh the presentation
the best way to do that is drop them
right in the chat um this is a uh this
is a live presentation so um towards the
end we'll uh we'll group them all up and
uh and try to answer as many as we can
um if we're not able to we'll we'll
follow up with with y'all afterwards um
so that is that Todd you can hit the
next slide there sure um thank you um
just a a little bit about the windso
Technology Group so we are headquartered
um in walam Massachusetts right outside
of um beautiful Boston Massachusetts um
I'm actually in Connecticut right
between New York City and Boston um the
windso Technology Group has local
coverage from Maine through the
Carolinas um far out in Western
Pennsylvania and and down in uh in
Nashville too um where where we can um
have you know Regional local coverage
with with truly National reach um we
carefully vet our Partnerships like that
of Arctic Wolf to really provide um
gamechanging Solutions and Technologies
from the desktop to the data center uh
through our Professional Services cyber
security uh networking uh and cloud and
we we really try to identify unique and
and truly differentiated products and
services that provide uh effective
solutions that lead uh to um fantastic
uh outcomes for our customers uh next
slide please
St um so speaking of uh of outcomes um
on staff we at Winslow have a bench uh
of technical Engineers on our pre-sales
and postsales side that truly represent
hundreds of years uh of combined
technical experience we have four
OnStaff cissps and a truly truly
dedicated team of account Executives
that have a passion for technology and
outcomes and if there's one thing uh I'd
leave you with that characterizes the
windso Technology Group and Partnerships
with arctic wolf uh it's that customer
satisfaction and outcomes are our
measure of success like our mission
truly uh is take the passion and
expertise we have uh focus on outcomes
you know deliver on uh what you know our
customers like you need uh in the space
today and and one of those uh is you
know differentiated services with our
partner um arctic wolf so I'm really
happy to um to talk with Todd a bit
today uh about um about you know the NIS
cybercity framework 2.0 again draft
State uh we can talk quite a bit about
it and go from there you can go to the
next
slide do need to uh poke fun at uh
ourselves I guess a bit at the slide
because um if you're looking at this
you're noticing it's missing uh the
governance wheel uh we haven't had time
to uh to quite update this yet and the
framework still is I guess in a draft
state but um we'll we'll update it when
uh when we come out of draft I suppose
but a point being is at the windso
Technology Group in in Partnerships with
arctic wolf and and different services
that uh we uh deliver in including a
whole portfolio of of managed service
Services um we have a a fairly
comprehensive and complete uh portfolio
of products and services to help uh
customers of all shapes and sizes really
achieve um cyber security uh you know
security if you will uh really really
helping reduce risk and and managing uh
that risk to an acceptable level um we
can help with all aspects of the nist
1.0 or 1.1 framework which you're
looking at now um bunch of Technologies
you see layered there um and the 2.0 um
so one of the tools that uh winsel has
introduced um that you know I'm excited
for as this develop uh this framework
develops is a GRC tool so we have a
governance risk and compliance tool that
we're able to provide as a service with
Consulting and a variety of other um
riskmanagement uh components go into
that so A really exciting offering there
uh Dov Tales beautifully uh into what
Todd and I are going to speak about this
morning regarding uh the updated nist uh
cyber security framework uh Todd would
you um like to uh you know introduce
yourself and introduce arctic wolf a bit
yeah thanks Matt so Todd Mallet I'm one
of the sales Engineers or sc's here in
in the New England patch um I've been
here for around four years or so uh
previous to that kind of all over the
place uh infrastructure Centric um but
uh but been here for about four years
been a great run huge growth a lot of
that growth is due to Winslow um partner
of the year I think two or three times
something like that Matt but it's it's
been a lot one of our uh uh one of our
best Partners certainly in New England
and then actually in the United States
um so with that just very very quick
agenda um and before I get started we
encourage you guys to ask questions
we'll have a Q&A session after this um
so if you do have a question please post
it in chat and we'll try to get to as
many of them as we possibly can toward
the end of the call um but the things
that we'll be going through today are
obviously the update to n CFS uh what's
changed what's moved there's been a lot
of a lot of things that have been
augmented and and kind of tweaked within
this CFS the core construct is is still
there um but that second bullet point
the Govern function is really I think
the the newest thing and and almost
creates something of an overarching idea
around nist and and kind of plays to the
rest of the five controls that we're all
used to seeing for the last couple of
years um an enhanced emphasis on supply
chain so more and more as we you know
create kind of the global economy or uh
more vertical Integrations things like
that supply chain risks have become
something that's on Forefront of a lot
of companies mind certainly that I talk
to um and that you know directly relates
to miss but also if you've heard of or
are privy to cmmc um there's a lot of
controls specific to your vendors and
and also those that you're selling to if
they have any access to systems within
your environment even if they're uh you
know dedicated systems they still need
to have um some some level of security
so so you yourself as a company entity
are protected uh throughout your supply
chain engagements we'll talk a little
about the timeline line for roll out as
Matt has mentioned this is still in
draft state so what we're talking about
today is a little bit preemptive some
stuff could change but it's very very
late stage um this has been a long
process to create n 2.0 uh the questions
if you will or suggestions were due uh
116 November 6th of this year so the
question and answer portion is closed so
we should see something finalized in the
next couple of months and then we'll
kind of wrap it up with how to get
started um wisel has some offerings uh
that can certainly help you guys through
a nist assessment which Matt will talk a
lot more about as we get through the
deck um but that's kind of how we'll end
it you know what are what are the call
the actions what can you do to get
prepared for for 2.0 um if you're
already on 1.0 certainly a lesser lift
if you're just starting to look into n
compliance um as a framework that your
company wants to try to adhere to um
this will give you a great starting
point on on how to get going with
it so this is kind of what it looks like
this is a 50,000 foot view on 1.1 and
what 2.0 will look like uh nist
originally was started in 2014 finalized
in 18 um and that's kind of where we see
those traditional five different
controls identify protect attack respond
and recover as we move into 2024 over
the last you know 10 eight eight years
Etc since we've had a new draft of this
a lot has changed uh we've seen a lot of
increase in uh malicious attacks in
cyber crime losses we've seen uh the
landscape change and pivot away from you
know just the information age we moved
over to internet of things and now we're
stuck in and trying to cope with quite
frankly Ai and ml you know what is that
going to mean for us going forward from
a security perspective and I think
that's what 2.0 was really meant to try
to address and I think again when you
look at that overarching in inside wheel
uh govern I think that's why it was
created um and again I'm pretty excited
about this I know Matt is too because
govern is now going to get some tendrils
outside of it right it's going to have
you know those of you on the line I
assume the majority are within some form
of the it or with your companies but now
it's going to have you directly
interfacing with and having stakeholder
you know people talking through nist
with you what does this mean for the
company overall Mr sea level Miss sea
level um so I think there's going to be
a lot of additional stakeholders that
are going to take interest in nist um
and start paying attention to what it
means from an overarching company
perspective and again I think that's why
govern was was created
frankly side by side look so maybe this
is a 30,000 foot view of 1.1 and 2.0 um
you can see there were a number of
changes but but the overall number of
categories and subcategories actually
decreased so we went from five functions
in one one to six functions with the
addition of governments in 20 but then
we decreased the categories and the
subcategories the reason for this was
there was a lot of consolid ation
between some of the controls within
identify protect detect respond and
recover and they were Consolidated into
some of these additional controls uh
within govern and then more further
Consolidated within the uh the
pre-existing five controls that we saw
as we get a little bit more granular
into what these changes are this is a
very chaotic slide it made my eyes bleed
as I was making it but but this is what
it looks like so when you think about
the controls themselves here's what kind
of changed or was Consolidated or what
is brand new so we see a bunch of those
different controls certainly in govern
all brand new obviously but then we saw
some things drop from identify protect
and from respond and from an actual
subcontrol perspective here's what
happened so you're going to see a lot of
arrows starting to populate this slide
but nothing was truly eliminated from
this it just made it more intuitive and
more cohesive and again a lot of things
got moved up into that that overarching
govern uh category which like I said I
think is extremely important for the go
forward plan for anyone trying to adhere
to nist because it gets a lot of
additional Buy in from a company
perspective outside of outside of it
which is where nist was typically you
know landing and and where the
responsibility used to lie I think
that'll that'll be a big change for us
going forward and a welcom one because
at the end of the day when we're talking
about security everyone is part of the
security team um at any company
regardless of size or regardless of
vertical if you're unfamiliar with nist
this these are kind of what the controls
from an overarching perspective are
meant to do so identify is is supposed
to help you determine the current cyber
security risk to the organization it's
not actually about identifying an
inflate threat if you will it's about
identifying what within your environment
potentially has gaps has risks could
create some level of an impact to your
business should you experience an
incident of event a breach you know
whatever you want to call it but that's
really what identify targets protect is
what should you and could you be using
within your environment to safeguard
yourselves and really lessen the
likelihood that you'll experience an
incident in the first place so that's
what protect is all about what controls
policies products platforms uh vendors
Etc are you leveraging to preemptively
protect yourself and make it more
difficult for your environment to get
breached or infiltrated in the first
place detect is probably the most
self-explanatory one what do you have
within your environment that is
assisting you in detecting if something
wrong is going on within your
environment this is very very
multifaceted as you guys might imagine
nist refers to a lot of different things
within a within a corporate it
environment or or any environment for
example um but but what are you using to
detect it um you know we'll talk more
about what that looks like uh what a
holistic approach looks like versus what
kind of a point product approach looks
like those types of things um and then
responding so are you how are you taking
action once you do find a thing so if
something happens what is your plan do
you have a plan and planning is
something that is now very much
emphasized in 2.0 that's something that
we at arctic wolf and Winslow have been
talking about for quite sometime you
know if you don't have an IR plan it's
something you should seriously consider
implementing and there's different
processes in which an IR plan is either
good or bad so of course we want to
highlight the good but now it's in this
now it's really really talking about
having something tangible that you can
refer to that helps you and your company
kind of stop the scramble on what is
arguably the the worst day in your life
if you do experience some kind of a
catastrophic event um recover once again
moderately self-explanatory but but
quite convoluted there's a lot of things
that go into actual recovery of an
incident depending on what the impact
was you know was it stolen data was it
ransomware did it lock up your backups
which is you know a goal of a lot of
different actors to lock your backups
because once your backups are gone they
pretty much have you so what does it
look like from a recovery perspective
for your business and then finally the
last one the new one is establish and
monitor the organization cyber security
risk management strategy expectations
and policy so once again this is org
wide what do we as a company need to do
to create this cyber security risk
strategy um and a lot of these new
controls Consolidated controls moving up
into govern um we'll we'll talk about
that and we'll we'll emphasize that so
those are the six controls now of 2.0
kind of at a very high level we'll start
jumping into now um what the individual
changes of these controls and subc
controls and categories Etc kind of kind
of mean starting with identify um again
this is meant to help you identify and
determine what your overall risk profile
looks like in the 1.1 uh table that I
have there anything that's kind of
shaded in Gray has been moved um so the
four that you see shaded have been moved
over into Improvement or or moved over
into governance so there's been a lot of
moves and changes this is not a one for
one representation of all the moves and
pivots and changes just kind of a
condensed view for you but um in 2.0 we
do see a new uh new category just called
Improvement um and what Improvement is
really here to do is to help
organizations just drive toward
improvements overall in the
organizational cyber security plan you
know what procedures do we have in place
what do those activities within those
procedures look like you know kind of
helping you create a framework on on
what identify needs to look like so your
identification of your risks within your
environment become more comprehensive
and the more comprehensive knowledge you
have of your gaps and what your risks
are the better an arctic wolf and a
Winslow can help you address those you
know with with various Solutions like
arctic wolf and a myriad of other things
of course that go into an overall cyber
security
play so that's what we saw at least in
uh in identify but but but moving even
further into the Improvement category
there are four subcategories now within
Improvement um and the first word there
in the im- 01 is continuous right this
is not a oneandone exercise and I
there's no way that I can emphasize that
enough continuously understanding your
environment via you know your own
knowledge and research but also via
continuous monitoring and having someone
there to help identify gaps with you is
the first call out in this new identify
uh excuse me Improvement subcategory and
then it moves further into actually
testing things out right are you uh you
created a plan youve maybe identified
some risks but have you have you tested
have you done exercises do you know your
findings to be true or false um so so
it's calling that out directly here as
well uh Lessons Learned so creating some
kind of a journal log Etc on what you've
learned what procedures work what didn't
work what you need to you know rethink
perhaps um and then finally a cyber
security plan um that's effective that
is communicated maintained and approved
and I think the key word there is
probably communicated right so the
entire organization understands what
should and frankly what should not
happen during some form of of an event
has gone into that Improvement category
so it can all be laid out understood and
you have a A playbook that is ready to
be executed upon you know in the in the
instance that you have have a
problem so that's the bulk of what we
saw from the identity category uh
shifting or changing or being augmented
in some way um which brings us over to
protect so protect had a had a bunch of
changes as well as you might imagine
those three uh shaded and gray there um
have been Consolidated or moved or
tweaked once again into two additional
categories that are new for the protect
in uh NIS 2.0 so we see platform
security and we see technology uh
infrastructure
resilience so starting with platform
security um this is really talking about
Hardware software firmware operating
systems all of the things that make up
your environment um physical virtual
machines are managed consistently that
we understand how they're being managed
that there's a risk strategy again
encompassing them um to protect their
integrity their availability and of
course their confidentiality and then we
can see some of the new controls uh that
are that are provided into into those
subcategories we have some around
configuration management software being
maintained um again arctic wolf sees a
lot of these things and patching is is a
total pain for anyone dealing with
patching we understand that we can help
with that but I'm glad it's being called
out uh in in the way that it is now
Hardware certainly maintenance um we see
cves pretty much constantly for for
firewalls for example so staying on top
of those types of things um certainly
lowers your overall risk profile log
records are generated and made available
for continuous monitoring this is a big
one this is referring to 247 login event
monitoring um something that arctic wolf
plus Winslow are very very good at
providing and something that I still do
not see being done anywhere near enough
in the wild um so I'm again once again
I'm glad that this is called out as
specifically as it is within the protect
function um installation and execution
of unauthorized software are prevented
I'm guilty of this quite frankly I've
installed a thing or two on my work
machine once or twice um but this is
something that you know again I
shouldn't be doing nor nor do I these
days but um you know this is something
that mist certainly calls out as well
because if something gets installed and
for for example they installed an
application that included one of the
vulnerable log forj jres a year and a
half two years ago that could have
exploited an entire company uh if it was
done so on a business machine um and
then finally securing software
deployment practices so so how are you
guys pushing XYZ to your clients what's
the update cycle look like change
Windows all those types of things uh
making sure that those get
monitored moving over one more into the
technology infrastructure resilience
subcategory um this is all about
security Arch architectures are
maintained and managed with the
organization's risk strategy to protect
asset confidentiality Integrity
availability and organizational
resilience and we can see four different
changes here um Network and environments
are protected from uh unauthorized
logical access organizations's
technology assets are protected from
environmental threats uh mechanisms are
implemented to achieve resilience uh in
normal and adverse conditions and
adequate resource capacity to ensure
availability is maintained so as you're
kind of thinking through these you know
active passive type Technologies active
active even all of these types of
decisions and Frameworks can kind of
work into into these four new controls
that they've bundled under this
technology infrastructure resilience
header um which was further
consolidation most of these all existed
in some former fashion in one one um
they're just called out a little bit
differently you can see some of the
references to formally you know XYZ in
that Top Line um so you can see where
the pivots were made uh and where they
were kind of bundled if you will will
into this new technology infrastructure
resilience
subcategory finally or not finally
detect so detect is all about again
finding and analyzing cyber attacks so
we see detection processes being kind of
moved if you will and again re rebundle
into continuous monitoring and into
adverse event analysis I am personally
pretty excited about this because that
directly ties into quite frankly what
arctic wolf is and what arctic wolf does
so um our core construct if you will and
how we kind of came to Market 10 years
ago was the idea of manage detection and
response which focuses on continuous
monitoring and adverse event analysis um
I won't get too much into this slide
guys I don't want to make this a sales
pitch but just know that arctic wolf is
a managed security operations center
that is delivered as a service one of
the services that we offer is MDR and
MDR is quite frankly 247 log ingestion
from across your entire environment
integrating with a lot of different
third party productss you may already
own like crowd strike or Defender ATP
opad Duo o365 all that stuff combining
it with Telemetry that we're generating
our own via a physical sensor that's
deployed on your network and Via an
agent that is also deployed on all of
your endpoints Cloud desktop laptop or
server aggregated under a single
umbrella acting as a single source of
Truth and then looking through all of
the events that were uh receiving from
your environment looking for anomalies
indicators of compromise things that are
flagged by third party Integrations that
we have and then responding to them so
here's what we found here's what it
impacted within your environment here's
how we get rid of it let's go um so
again if I go back one slide and and
look at continuous monitoring and
adverse event analysis that is exactly
what arctic wolf does so we're excited
to see this called out in the way that
it is called out in 2.0 because the more
customers clients that are using Arctic
wol or frankly anything else that are
monitoring and you know actually
reacting to diverse events in a correct
and and quick way the less we're going
to see from a cyber losses perspective
and there's anary benefits to that too
right like your cyber insurance premiums
maybe doubling over the last 24 months
no one's really been a huge fan of that
maybe we'll start to see that Whittle
down you know as these cyber insurance
companies hopefully you know start
paying out less because we're getting
more in tune with what needs to be done
to properly secure
environments respond how am I taking in
action during a cyber incident obviously
arctic wolf can assist in that the the r
and MDR does stand for respond but we
saw some changes here as well response
planning and improvements as you might
imagine those have been uh pivoted again
or or moved over into more of the
governance subcategory which we'll talk
about in depth in a couple minutes um
but we've created the four categories
now within response we have Incident
Management analysis response reporting
and communication and mitigation and to
kind of you know expand on that a little
bit more you can see where some of these
moves were made um a few of them were
dropped as I had mentioned but they have
been moved into other subcategories uh
we have a couple different new ones four
of them um so analysis is performed to
determine what is taken during place of
an incident finding the root cause of an
incident oftentimes is critical to
understand what gaps you have and how to
fill those gaps um what actions
performed incident data and metadata
being collected again something that
that arctic wolf can certainly assist
with as well um and then lastly the
incident magnitude and is estimated and
validated so you know what did this cost
your company and again that's a
convoluted question too and I think
oftentimes when we think of the cost of
a breach let's say it's an average of $3
million we just think of that $3 million
as ransomware but you know the
ransomware portion if it was indeed
ransomware is is typically a a small
percentage of that overall loss because
you have operational loss you have you
know loss of of man and woman hours
going into whatever the solve for the
situation happened to be and then much
harder to quantify but you have
reputational loss um depending on how
you interface with your customers as
well whether that's B2B or whether
that's B to C there's a lot of
reputational loss that comes along with
that and that can linger for months or
years um depending on on what
happened recover so this is focusing on
restoring assets and operations the
picture there you're probably reading
that and hold my beer um one of my
favorite sayings but that is basically
saying that a lot of what they have
included now in 2.0 under the new
incident recovery plan execution and
communication really are telling you to
kind of just hold your breath for a
minute analyze the situation understand
exactly what happened and then truly
create a plan around your recovery
rather than just going you know bowling
a china shop trying to fix stuff and
scrambling and not documenting and
forgetting what got fixed and what
didn't get fixed you know stop Slow Down
plan and understanding exactly what it
is that you need to do versus again just
going crazy and trying to to scramble
and fix things which again you know from
an Arctic World perspective and I'm sure
Matt can validate this too on a Winslow
side the scramble is something that's
very very hard to stop because when you
have an incident that's of a magnitude
in which you need to respond rapidly and
quickly you've got your entire Team all
just doing something scrambling without
a lot of communication and again if you
read through the recover sections of
this uh which is kind right here that's
really where the focus is um slow down
take appropriate actions um have have
this organized and and kind of ready to
go and
understood um again I won't read through
every single one of these things but and
you guys are free to have this uh slide
deck as well at the end of this but um
that's really what the recover decided
to focus on I think a lot of the
controls that were already there were
good ones a lot goes into recovery
certainly um but I think having a focus
on making sure that it's well
orchestrated um and well understood SL
doent
is a is a welcome change to T yeah Todd
if you want me just to add some color to
that so we we do have uh an incident
response practice as uh as does Arctic
Wolf and oftentimes we've responded to
incidents together um I'll say um what
tends to happen uh for folks that don't
have a plan is uh twofold one is this
just overwhelming sense of oh crap what
do we do and you know we we have our own
runbook as as does Arctic Wolf we often
work together on um on the incident
response but but this overwhelming sense
of like what do we do now usually
followed you know was followed by like
panic and people start unplugging you
know Network ports and shutting this
down and it's actually um it can really
complicate like forensic investigation
because like ultimately you want to know
how they got in who got in what's going
on do we need to report this to the
authorities So like um in the absence of
a plan uh for Recovery uh we end up
seeing uh just Panic uh you know and and
uh you're right it's like slow down have
a bit of a plan together understanding
you know what's going on I'll tell you
the next piece of this that um you know
that's more of the it CIS admin
technical side if you will the more like
executive board side of this is um you
know our systems are down uh we're
paying people they can't work we're not
bringing Revenue in our you know systems
are offline how soon are we going to be
back online that is like the number one
question that you know comes up and and
just kind of like in our combined
experience just to be realistic with
everyone on the phone I would say an
average um when we get brought into an
incident and this is just again like
averaging everything out um the time
from you know phone call till some basic
restoration has happened just just in
our experience is about three days um so
that's like three days of downtime where
uh you don't really know what's going on
to have some semblance of a restoration
plan you know of course in in the
absence of having having something
planned up front and then um from there
uh we see actual restoration when when
it's not really planned out and um you
know we're just kind of figuring it out
as we go because because this part um
wasn't really thought of um Beyond kind
of like we'll recover from backup um it
usually takes two to three months uh to
recover systems and and in that time um
we've unfortunately experienced some
organizations where they start
questioning like the viability of their
business not because they were um only
attacked but because um their recovery
mechanisms and the recovery planning and
and what needs to happen to recover
their applications data and and overall
um operational State just wasn't really
thought about so um to your point to I I
actually love seeing more attention
being spent on this end of the framework
um and um and I I feel like with you
know cyber risk and and cyber security
incidence it's it's you know this is
like very cliche it's it's not a matter
of uh if it it will be a matter of when
um attackers using AI based you know
malware and AI based um attacks are are
real it's something that technical
controls may not be able to keep up with
uh hopefully they minimize the risk and
minimize the impact of of an incident um
but everyone's going to be faced with
recovery at some point so so like really
putting some emphasis in planning and
having the right policies and procedures
in place is uh is really really critical
and um I like seeing this being uh
spiked out a bit more um in the 2.0
framework yeah those are perfect points
I mean just if you read a couple of the
1. ons they they almost seem rudimentary
compared to how 2.0 gets a little bit
more you know finite on what the ask is
um you know if you look at the kind of
the backup um it's it's interesting
right that it wasn't included to to
begin with but um you know establishing
and understanding that the backups
you're restoring are actually good
Integrity right because in storing you
know re restoring a dirty backup just
wasted a day
D I'll tell you like Todd that is such a
good example because I've like
personally been on incidents where we've
restored um you know applications I'll
just say at a broad level they had
already been tampered with and they had
um some sort of a trip wire I'll say
built into it where um if you went back
as far as you know two weeks or three
weeks or whatever to restore it they had
already been in the environment that
long and in that case it it wasn't just
like the backup system that was flawed
it was like the Integrity of that system
and you know alongside that the backup
itself was totally compromised because
if you restored um if you restored that
backup itself it was tampered with um
and you know would essentially like
reinfect the rest of the environment
once it was restored so um I I agree I
think youed like the perfect word here
too where you're talking about like the
1. one seems rudimentary and like it is
I mean you look at it and it's like
we're looking at like big you know
crayons that we're drawing with with
like a
fist right versus uh perhaps the the
Precision of a of like a number two
pencil here so I think that's a great
great Point yep absolutely I think it's
gonna help a lot just for for everyone
trying to adhere to Nest I think
everyone should at least if you're going
to pick any framework if you don't have
you know a specific form of compliance
you're mandated to do it here to this is
a this is a great place to start and
honestly if you do start with nest and
then maybe via some pivot companywide
you are now privy to some form of
compliance you must adhere to if you're
doing this you've probably satisfied 70
80 90% sometime of the controls that
that other compliance refers to um so
I'm glad it's laid out the way it's laid
out now
yeah we'll jump into govern which is the
last one kind of the new kid uh and
again you know the one that I think
myself and and I'm I'm understanding
Matt is probably the most excited about
because it does specifically speak to
organization
awareness of an overall security
framework so um a bunch of new controls
here there's six subcategories within
the Govern section um again I won't read
every single one of these uh but I
certainly encourage you to do so but
we're talking about organizational
context uh an overarching risk
management strateg strategy I talked
earlier about the supply chain risk
management and this is a big deal right
if you are doing business again B2B and
you have systems that are being accessed
by whomever you're interfacing with they
become compromised you now have or at
risk at least of being compromised as a
relation of that uh you know perhaps
database that you're sharing or that
interface that you're sharing or
whatever happens to be so understanding
your risk around your supply chain is
something that's pretty critical um
roles responsibilities and authorities
again like I said this is going to bleed
outside of it in a very very welcomed
way where the rest of your organization
um should and could be a part of your
overarching security plan gaining
awareness for those of us in the it
realm um gaining Buy in uh and and
hopefully you know having a little bit
more um versatility in what you're able
to talk about present and and you know
try to fix your gaps with um so I think
this is a very good thing uh policies
processes procedures Etc um those are
kind of table Stakes but again they've
been moved into that govern category so
it becomes like I said earlier more of
an overarching idea and then oversight
you know who's who's the one ultimately
paying attention responsible for
uh validating Etc all of these different
strategies um that we that we putting in
place via the
n2.0 so to get a little bit more into it
just kind of kind of some questions to
you know ask yourself this is really
what govern is is getting you to do is
kind of create that conversation within
your organization around you know why do
we exist and what are we trying to
accomplish some of these are are kind of
no-brainers but you know what are our
internal and external stakeholders and
what are their needs and expectations um
you know if you're a if if you're a CFO
perhaps you know maybe it isn't
something that you're necessarily diving
into at a granular level certainly
you're approving projects but um maybe
this will give you a lot more Awareness
on you know what what nist is and why
cyber secur is important in the first
place um objectives capabilities you
know that your stakeholders depend on um
does Enterprise risk management include
cyber security is that actually a
control or a thought process within your
risk management plan overall
um what's your appetite for risk and
your tolerance for risk this is a super
interesting question that I get to ask
prospects every now and then when I'm
talking to them and the answers that you
get just very wildly um and some of them
are funny some of them are depressing
but but overall it's a very very
different story from whomever you're
talking to on what their their tolerance
for risk is um have you standardized on
methods for for calculating for
documenting for prioritizing your risks
again are these something that you are
paying attention to on a daily basis and
from my experience over the last four
years I can wholeheartedly answer the
majority of people I talk to the answer
is no um because I'll be in engagements
for you know a month long two month long
three Monon long conversation with a
prospect um and during that duration of
conversations with arctic wolf or maybe
they were budget constrained or they had
never been breached before so they
haven't felt the pain of of being
breached uh historically speaking and
then they get popped in the middle of
our conversations we're engaging you
know with Winslow we're deploying IR
we're doing all these things um and it
it becomes a question of you know had we
just gotten this done this would have
never happened um and often times the
the remediation tactics and the cost
implications and all of those other
things that come along with having a
breach are are far more expensive than
the solution would have been to prevent
uh The Happening of the of the problem
um and then finally again going back to
supply chain do we understand our
suppliers and partners what their
requirements are um and how do we
address supply chain risk so what I
highlighted at the bottom here is again
kind of the the overall idea this the
Govern function helps organizations
achieve and prioritize outcomes of the
other five functions in the context of
mission and stakeholder expectations um
so like I said earlier I think it's a
really good control I love that they
made it touch everything you know kind
of made this its own Inner Circle
meaning that it has its tendrils into
the other five pre-existing controls um
because governance is something that you
know really should be paid attention to
I think first and foremost to have that
understanding of what each one of these
controls means to the entire business um
not just to those of us in
it quick example we all remember the
solar winds breach um this was uh pretty
dramatic um it's often times been quoted
by the the CEO of Microsoft as being the
most sophisticated breach we have ever
seen um and that's true in some aspects
um but to kind of go through this a
little bit you know this was something
of a supply chain breach to a degree um
we saw this in early 2020 actually late
2020 excuse me that that year just
completely Blends for me um but you know
Implement zero trust and that's
something again that that we can
certainly assist with certain aspects
with Winslow can assist with a lot of
the other aspects um but but do active
audits you know understand what changes
you've been doing in your environment um
Implement Sim and log management those
were recommendations made after this
breach occurred um fine-tune your DLP so
do you even have DLP to fine-tune maybe
that's the first place that you would
need to look but should you have a dop
plan in place you know make sure it's
tuned make sure it's actually doing what
it needs to be doing um and penetration
testing and again this is something that
wissow can assist with test your
environment if you're not testing your
environment and you've put all these
controls in you've done the things you
have a a good environment on paper if
you haven't tested the thing then you
don't know how good it actually is and
not just it you don't know how good you
actually are right how you're responding
to it at a company level who you're
engaging with um all those types of
things need to be tested on a regular
basis and I think penetration testing
tabletops red team purple teams all
those types of things um should be
should be leveraged um as much as you
see fit uh to understand your
environment and what and what it looks
like in a in a actual real world type of
an incident so I said earlier at the
beginning of this slide this was called
oftentimes Again by the CEO of Microsoft
the most sophistic at breach we've ever
seen but kind of the fun fact some of
you probably know this some of you don't
but the server that was initially hacked
by The Bad actors within solar winds the
password was solar winds 123 so while
the breach became sophisticated the
initial compromise was anything but I
mean I'm not going to say that I would
have guessed this but if you're just
using a a password spray application
it's not going to take that long to get
to solar winds 123 um this comes down to
again again the government's part of
what we're talking about within nist
password policies enumeration
complexities reusage all those things
that we all in our minds think are table
Stakes are absolutely not table Stakes
human beings again are the number one
vulnerability that any company has
regardless of vertical size industry
segment anything so simple policies like
this again are things that we can assist
with helping on Winslow can certainly
help assisting on but nist or or any
other frankly Common Sense logic could
also assist on on helping as well Matt
do you have anything to add
yourbody yeah um I I feel like it's you
know it's weird to be um excited if you
will about this but um but I feel like
um I'm personally excited about it just
because of how often uh you know myself
and my team gets involved in incident
response and like I'd like my weekends
and holidays back too you know so um by
having a bit more risk management and
governance on the front and uh it
certainly uh certainly helps uh helps us
all out um one one tip I would uh you
know implore folks attending the webinar
is like um it is very difficult to do uh
governance you know risk and compliance
management out of excel um so while you
can download this framework and other
Frameworks out of you know Excel and and
work from there um it's a real
rudimentary way to do it it is very
difficult to um co-contribute track
changes and and do things of that nature
so I would uh I would implore people to
consider like a GRC tool um you know and
and some you know services to help
people understand and digest that um we
we offer one candidly um but there are
other uh GRC tools out there too so that
that would be part one um I think part
two is um it's interesting to see this
unfold because um I believe it's was out
of necessity uh that we had to or that
we got where we are right um attackers
were smarter well know about smarter but
we're more motivated I'll say you know
financially to take organizations down
demand Ransom so on and so forth um your
it your average it CIS admin is trying
to keep the lights on you know deploy
new software for the organization so on
and so forth um it is very difficult for
that you know individual or that team of
individuals to combat the ongoing um you
know threat of incidents and what that
led to was just deploying a bunch of
tools um because we needed to like plug
the plug the holes in the dam if you
will you know uh it's like the you know
european vacation right scene where
Clark grizwalds like plugging the holes
in the dam that kind of thing um so we
had to do that out of necessity and now
um you know we're able to come back and
say hey if if we were to do this right
or wrer um what would we do and it kind
of naturally leads itself to like well
Step One is um it's very difficult to um
manage by exception it's very difficult
to manage by by just saying like well we
got this happened we're going to do this
by reaction right um so what this says
is um let's hit the pause button like
you said earlier take a step back and
really understand what our risk is first
what is our risk of a ransomware attack
what's our risk if uh our Erp system is
offline for a week what's our risk if
our self-funded employee uh health care
benefits system is compromised I don't
know there's a whole bunch of things
like even simple stuff like
um organizations have you know what they
think is a really solid practice but
maybe someone in um Finance or payroll
or whatever you know was running payroll
reports they just innocently store that
payroll report for quote unquote backup
purposes on their laptop or a network
share that wasn't you know sanctioned uh
but it wasn't you know clearly
communicated by policy that we don't
store stuff uh like that that's
considered Pi we don't store that like
locally on our machines and there is no
um software DLP solution to like even
prevent that um which which would be a
step further so um I feel like um this
whole notion of governance and like
managing by policy really sets um a bar
and a framework for all organizations to
be able to have like a common you know
internal to that organization a common
set of um practices you know procedures
um and you know rules really uh to
conduct business and and really keep
that organization or better keep that
organization cyber safe and and and
really um managing risk um versus you
know just plugging holes in the dam if
you will so sorry I didn't mean to you
know steal the old show here but um but
I feel like this is um actually like a
much needed addition to the framework
and um you know Fantastics see kind of
like this development of the framework
and see it um evolve and and morph
overtime as uh as risks and and
organizations evolve as well yeah could
agree more man you're not stealing the
show you're you're adding to it so thank
you very much sure really good points
um so I think last slide for me actually
is going to be the the timeline so again
I had mentioned and Matt had mentioned
this is still technically in draft um
but if you look at this timeline a lot
of work has been done over the last uh
about about 12 months actually um
comments were due November 6 uh which
basically means you know hey we have
some last minute edits some last minute
things we want to see um so that was due
uh you know a couple months ago so we're
right in the middle here where we should
see this finalized I'm probably
extremely close to what we've just shown
you um in the next month or two is when
we expect this to be uh officially
drafted and and two. becomes uh official
and and slash nonraft
um so with that I'm going to Pivot back
over to Matt he's going to talk a little
bit more about what Winslow does from
their nist uh evaluation perspective you
know how that could help you guys going
forward um and then we'll get into Q&A
at the end here so Matt if you want to
take it with
your yeah absolutely so um thank you
Todd so if if folks have never um gone
through any sort of a framework review
or you know pop the hood if you will on
you know nist 1.0 1.1 or even took a
look at 2.0 that's uh that's actually
totally cool like we um at wtg are happy
to offer a no cost um mini nist cyber
security framework assessment if you
will um so it's a consultative interview
um we ask a bunch of questions around
each um family or function um of the
framework it's a great time for you to
be able to ask any questions that you
have um related to the framework related
to something going on in your
environment or just general security
with the uh with the security engineer
you have um on on the call uh at the end
of it you'll get a you know full report
with red green yellow uh different color
coding you'll have all of your res