Category: NIST
Systems Thinking: Part 1
Common sense tells us different problems need different solutions, having a “systematic” way of evaluating new problems can help us avoid relying too fully on our assumptions and default response. Use this introduction to systems thinking to evaluate where your problems generally land on the Cynefin Model.
Systems Thinking Part One – YouTube
ISSA hosted talk: Using the NIST Cybersecurity Framework to Align your Organization’s Risk Management Practices
Last month ISSA hosted Patrick von Schlag for a talk on Organizational Risk Management. There were difficulties with the sound and Patrick recorded this version for those who were unable to follow the original talk.
You are invited to listen to the recorded session on ISSA’s website Using the NIST Cybersecurity Framework to Align your Organization’s Risk Management Practices.
If you would like to discuss any of ideas presented in the seminar further, please bring up questions in the NCSP Mentoring Community Patrick runs on LinkedIn:
Related posts: NIST and the Art of Security Maintenance
NIST Cybersecurity Framework free webinar
ISSA and Patrick von Schlag from Deep Creek Center have teamed up to provide a free webinar on implementing NIST aimed particularly at small and medium sized businesses. Please read Patrick’s note below:
Hey all; I’m doing a free webinar with ISSA on how to effectively use the NIST Cybersecurity Framework to identify and prioritize security gaps in your organization. The links are below…hope to see you there!
FREE WEBINAR!
Join the Information Systems Security Association (ISSA) and Patrick von Schlag for this free webinar on how to use the NIST Cybersecurity Framework as a vehicle to identify, prioritize, and execute your cybersecurity risk management program, and as a roadmap to help you plan your assessments and actions.
Whether you are a small- or medium-sized business or a global enterprise, this approach can help better align cybersecurity into your overall organizational risk management program and provide a vehicle to help you build the adaptive culture you’ll need to sustain success.
December 15 @ 1:00 pm – 2:00 pm EST
Register today!
Using the NIST Cybersecurity Framework to Align your Organization’s Risk Management Practices
#cybersecurity_professionals #nistcybersecurityframework #nistcsf #nistcybersecurityawareness
Making IT Work episode 10: The Agile Mindset
If 2020 has taught us anything it is that We don’t know what we don’t know.
Welcome to the world of Agile. This year has offered the world the opportunity to learn the most important mindset lessons from Agile: listening, collaboration, progress toward solutions not fixed results.
The Agile Mindset is not limited to programming but should inform the culture of the entire business as Patrick von Schlag makes clear in this episode of Making IT Work: The Agile Mindset.
For another look at Agile please see The Great Convergence
NIST and the Art of Security Maintenance
Making IT Work: episode 9
I’ve been spending a lot of time this year working with clients beginning the long process of implementing security controls in support of the NIST Cybersecurity Framework. I’ve been feeling the need to share a few lessons learned from these early stage activities, and some implications for organizations as they progress.
- Adoption starts at the top! Organizations having the best success with the framework begin by gaining buy-in and commitment from the highest levels of the organizations; Boards of Directors and senior C-level management. Fundamentally, the value proposition of using a framework like this is in facilitating business-centered conversations, about risk, risk optimization, and investment prioritization.
Computer Security Signpost Showin - Business-side stakeholders need enough awareness of the Framework to collaborate. Ultimately the purpose of a Cyber Security Company is to enable and protect business workflows, business processes, and business information. All of these are owned by business side stakeholders; process managers, line of business managers, and customer relationship managers. These key stakeholders need to have a clear voice alongside risk and audit on how to best optimize the cost/risk/value balance and enable the organization to successfully deliver value to stakeholders. Extensive conversations between business leadership and security practitioners is absolutely essential…and these conversations must take place in business language and reflect business priorities. The NIST Framework provides the necessary language and structure to enable these conversations without devolving into technical jargon.
- An adaptive, Agile approach is necessary. Information security is necessarily always responding to new vulnerabilities, threats, risks, and issues. Security professionals benefit from adopting certain core Agile principles and practices in order to remain flexible and adaptive as the threat landscape evolves.
- The NIST Framework -really- is useful to any size organization, and adapts readily to the realities of small/medium sized businesses. Many of my customers are not huge enterprises and don’t have dozens or hundreds of personnel focused on the implementation of security practices. Many more of them, with tens or hundreds of employees, are more likely to “have a guy” who is tasked with “doing security.” Eventually one of the main benefits to using a framework like the NIST Cybersecurity Framework is to provide any-size organization with an approach to help organizations recognize that security is an organization-wide problem, that real-world constraints can and do exist, and that the most effective approach is to assess current capabilities and prioritize needs, with the goal to be establishing a functional beachhead that enables the organization to do with the most critical issues, then work using a process of continuous improvement to start iteratively chipping away at other capabilities.
As we continue to work to help organizations adopt and adapt this framework, I expect I’ll have a lot more to share. Remember, be willing to “win a little,” consolidate your gains, and do it again!
One of the resources we provide is free access to our online LinkedIn Mentoring Community, where interested professionals can ask questions, share links and information, and support one another in adoption and adaptation of the NIST CSF and various Informative References.
To gain access to the community, follow the link https://www.linkedin.com/groups/12376016/
Related posts: Agile as a Business Transformation Practice