Latest / CYBR.Signal / Control Monitoring

Transcript

Control Monitoring · CYBR.Signal

• 0:00
  SPEAKER_00: And hello, everybody.
• 0:01
  SPEAKER_00: Happy Cyber Sunday.
• 0:02
  SPEAKER_00: Hope you're doing well.
• 0:03
  SPEAKER_00: So one of the things I have talked about in the past on here on Cyber Sunday is doing assessments.
• 0:11
  SPEAKER_00: So I've talked about assessing your larger program.
• 0:15
  SPEAKER_00: That could be security assessment, cloud security assessment, you know, any kind of governance, risk, and compliance type assessment, anything like that.
• 0:23
  SPEAKER_00: I've also talked about assessing smaller controls.
• 0:27
  SPEAKER_00: So you don't necessarily always have to assess your larger program.
• 0:32
  SPEAKER_00: You can always assess smaller controls as well, like firewall rules, that kind of thing.
• 0:37
  SPEAKER_00: And that, you know, you should do both on a regular basis.
• 0:41
  SPEAKER_00: But one of the things that you can do to cut down on how much you have to do an assessment is by monitoring those controls on a more regular basis.
• 0:53
  SPEAKER_00: And what I mean by that is just it's it's doing uh creating kind of a it's not a catalog, but basically a list of things that you need to check that control against to measure how effective it is.
• 1:06
  SPEAKER_00: So those could be KPIs, those could be whatever you want to do, whatever that list needs to be built out of, because that's gonna depend on the type of control you're talking about.
• 1:13
  SPEAKER_00: So the firewall is gonna be different than like an identity and access management control or something like that.
• 1:18
  SPEAKER_00: But you want to audit those or monitor those on a regular basis.
• 1:22
  SPEAKER_00: And more of a I don't want to say continuous because that's got weird connotations, like you know, you're constantly doing something, but you can do continuous monitoring of those through automating some type of monitoring if there's something measurable.
• 1:37
  SPEAKER_00: So you want to measure those, but or monitor those, but how you measure them is not always just the effectiveness of how well they are performing an action, whatever that may be.
• 1:51
  SPEAKER_00: Again, firewall perspective are the rules staying up to date?
• 1:55
  SPEAKER_00: Are you updating those rules uh to make sure they encompass any new threats, any kind of, you know, like you add IP ranges or you change IP ranges or something like that.
• 2:06
  SPEAKER_00: Those are things you can monitor and automate though on a regular basis.
• 2:10
  SPEAKER_00: But one thing people sometimes forget about monitoring is monitoring a control against a standard or a compliance regulation or something like that.
• 2:21
  SPEAKER_00: So when you when you're putting in a control, one of the things, or several, you should do several things, but one of the things you need to figure out how, why you put that control in the first place is it could be a compliance thing.
• 2:32
  SPEAKER_00: So let's take critical infrastructure, for example.
• 2:35
  SPEAKER_00: There's been some regulations put in place in the last few years to where identity is getting locked down, all kinds of areas of that critical infrastructure getting locked down.
• 2:44
  SPEAKER_00: And a lot of those are very specific to what some of the attacks that have happened on critical infrastructure, they've focused on those to make sure that they're locking those things down.
• 2:55
  SPEAKER_00: So some of that's reactionary, some of that's, I mean, but it's still good.
• 2:58
  SPEAKER_00: That's a whole nother conversation.
• 3:00
  SPEAKER_00: But that goes into when you're creating your controls catalog and you're figuring out what controls need to be in place.
• 3:09
  SPEAKER_00: When you're figuring out how to monitor those, you're monitoring them for effectiveness and you're monitoring them for regulations.
• 3:16
  SPEAKER_00: And maybe it's not just a regulation, maybe you don't have a regulation for that particular control, but it's just something you're doing, you're following ISO or you're following NIST CSF or whatever your control library is or your control framework, you've created that catalog based on that, and you want to measure it against that.
• 3:34
  SPEAKER_00: So you need to remember that because those things change.
• 3:37
  SPEAKER_00: So, I mean, if you go, for instance, you go look at ISO 27,000 family of the publications that they have, all of them have a 27,000 cold, you know, 2700 X, whatever that is, and then a colon, and then a date, a year behind it.
• 3:54
  SPEAKER_00: So those those are constantly getting updated.
• 3:58
  SPEAKER_00: So you've got to monitor against those, hey, if if something has changed, I'm going against that standard, somebody has figured out that there's a different way to do it or a better way to do it, or whatever, or if there's a regulation that gets updated, probably less often, but it could, especially if it says it lines up with against against one of those standards.
• 4:16
  SPEAKER_00: Some of those do.
• 4:17
  SPEAKER_00: They have some language in there that lines up against those and aligns with them.
• 4:21
  SPEAKER_00: You need to monitor for that regulation as well.
• 4:23
  SPEAKER_00: So basically, the summation is you need to assess these different controls.
• 4:29
  SPEAKER_00: You can assess them in a less thorough every all the time if you monitor them constantly and keep up to date with them, but you can't just monitor them, monitor them for technical effectiveness.
• 4:41
  SPEAKER_00: You also want to monitor them against standards or regulations if you have those and make sure you're documenting that as well.
• 4:50
  SPEAKER_00: So let me know what you think.
• 4:51
  SPEAKER_00: Talk to you next time.