THE COUNTERMEASURES layer 9A

Process – Security compliance, regulation, and requirements, Governance Risk and Compliance (GRC):

Managing an organization’s overall governance, enterprise risk management and compliance with regulations. A structured approach to aligning IT with business objectives, while effectively managing risk and meeting compliance requirements.

GRC EXPLAINED

• Governance: the action or manner of governing. Policy, process and internal controls that comprise how an organization is run and decide how things get done.
• Risk: Making sure that any risk (or opportunity) associated with organizational activities is identified and addressed in a way that supports the organization’s business goals. In the IT context, Security Development lifecycle (SDLC) – from inception to decommission and the management of risk must be tied to an organization’s governance and risk tolerance.
• Compliance: Making sure that organizational activities are operated in a way that meets the laws and regulations impacting those systems. In the IT context, knowing what laws and regulations apply to the organization’s security plan.

GRC EXPLAINED

Companies in highly regulated industries are forced to adopt one or more frameworks in order to meet compliance initiatives. There are over 200 security frameworks, regulations, standards and guidelines to choose from that could impact your business at any given time. Source: https://ignyteplatform.com/top-30-security-frameworks-2019/

The Countermeasures Explained:

• Source NIST: Security countermeasures are described as protective measures prescribed to meet the security objectives (i.e., confidentiality, integrity, and availability) specified for an information system. Safeguards may include security features, management controls, personnel security, and security of physical structures, areas, and devices.
• NIST Framework – All About the Data
• Identify Protect Detect Respond Recover: What Data Do I Have? What Am I Going to do to Protect My Data? Where Is My Data Located? What Will Happen If Someone Gets My Data? Where Am I Getting My Intelligence

ABOUT MY DATA?

It is all about the data: 5 questions every company should ask:

1. What do I have that others may want, (DATA) classified, confidential, restricted, personal, private Info on mergers, stock, engineering design software programs?
2. What are you going to do to protect your data?
3. Where is my data located, data at rest (stored), use (volatile) & motion (NetFlow)?
4. What happens if someone gets my DATA; HIPPA, PCI, FTC, SEC?
5. Where are you getting your Intelligence from (DATA/INTELL) commercial, opensource, under-ground, gov.

People – Security Services

Professional services companies for hire that provide services and solutions in strategy, consulting, digital, technology and operations.

Anticipatory Content Service Providers/External TI:

• Placement of people and access to forums for intelligence gathering.
• Natural language processing (big data) finding patterns in human language to bring together.
• Access: dark web, deep web, chat room, forums, marketplace
• Annual Cyber Reports, blogs, advisories, finished intelligence reports Intel Cards.
• Cyber Playbooks, repository platforms for threat actors
• Outcome based messaging & Collect strategy.
• Dashboard platform

Digital Risk Protection Services /Attack Surface vendors:

• Acquisition and analysis – Identify, ingest, analysis, scan, inventory, monitor, and takedown.
• Non-intrusive reconnaissance discovery and analysis
• Surface mapping for board, client, domain, employer and monitor for IOCs and abuse.
• Map client’s digital footprint -mitigate risk thru rapid response.
• technology tools.
• Date Risk Protection (DRP) – analyst tool people centric, SOCMINT – social media intelligence
• Security Instrumentation Platform (SIP) – Real time monitory and notification of Passive DNS Who IS, Web social crawl, SSL Cert, Cookies, Host pawn DNS records.

Security Consulting Services:

• Multiple services such as, Strategic Consulting, Technical Consulting, Advisory Services, Assessments Compliance Services.
• Employs experienced, senior experts to define and communicate risk and security program strategy using real- world data, proven frameworks, and an understanding of industry and business.
• C- level consultants understand the complexity of building a security program that allows business to achieve objectives while meeting risk tolerance. Consultants work to define security defense architecture and make the necessary transformations in adapting to the digitalization of business.

Risk/Vulnerability/Compromise Assessment Services:

• A process of defining, identifying, classifying, and prioritizing vulnerabilities in computer systems, applications and network infrastructures and providing the organization doing the assessment with the necessary knowledge, awareness, and risk background to understand the threats to its environment and react appropriately.
• Security experts deploy tools at internet egress points and on critical servers and endpoints. They use Intelligence to identify any indicators of compromise (IOC) in your environment and comparative analysis to identify non- IOC specific anomalous behavior. Experts identify ongoing or past intrusions, assess the risk by identifying weaknesses in your security architecture and increase your ability to respond effectively to future incidents.

Technology – Edge Devices (Endpoint Protection)

• Trusted execute environment
• Secure element
• Antivirus software
• Endpoint Protection (EPP)
• Endpoint Detection & Response (EDR)
• File Integrity Monitoring (FIM)
• Application Hardening
• Email Filtering
• Application Whitelisting
• Source code obfuscation
• Mobile Device Management
• Penetration testing
• Encryption
• Sandbox

Network Protection

• Firewall
• Next Generation Firewall (NGFW)
• Intrusion Protection Systems (IPS)
• Intrusion Detection Systems (IDS)
• Data Loss Prevention (DLP)
• Managed Security Provider (MSP)
• Managed Security Service Provider (MSSP)
• Manage Detection & Response (MDR)
• Security Orchestration, Automation and Response
• Security Events Information Management (SIEM)
• Snort, YARA, STIX, Sigma containers detection indicators
• Identity Access Management (IAM)
• Federated Identity Management (FIM)
• Dev Ops automation
• Proxy/Gateway
• Public Private Key Infrastructure (PKI)
• DMARC,,DKIM,SPF,DNSSEC
• Resource PKI
• MFA
• BCP 38 Resource Rate limiting
• Response Policy zone (RPZ)
• Captcha / ReCAPTCHA

Perimeter Protection

• Cloud Workload Protection
• Cloud Access Security Broker
• Secure Web gateway