Cybersecurity 101:
Securing Your Digital Environment
MCNC Vital Cyber Consulting
Fall 2024
© 2024 MCNC - General Use – v1.0
2
WHO ARE WE?
Jason Shirley
Managing Consultant
jshirley@mcnc.org
Jason Folker
Senior Client Consultant
jfolker@mcnc.org
Chris Hovis
Client Consultant
chovis@mcnc.org
3
SECURING YOUR DIGITAL ENVIRONMENT
No matter where you’re starting from, this webinar provides a blueprint for building your Cybersecurity Program.
4
WHAT IS A CYBERSECURITY PROGRAM?
5
WHAT IS A CYBERSECURITY PROGRAM?
The collective effort your organization puts into protecting the confidentiality, integrity, and availability of your information assets.
6
WHAT IS A CYBERSECURITY PROGRAM?
Policies
Example: “An Acceptable Use Policy outlines what constitutes appropriate use of institutional-owned assets.”
7
WHAT IS A CYBERSECURITY PROGRAM?
Standards
Example: “A password standard specifies minimum requirements such as length, complexity, and expiration frequency”
8
WHAT IS A CYBERSECURITY PROGRAM?
Processes & Procedures
Example: “A backup procedure outlines the steps needed to schedule, perform, and verify backups.”
9
WHAT IS A CYBERSECURITY PROGRAM?
Technical Controls
Example: “Multi-factor authentication (MFA) ensures that users provide additional verification before gaining access to critical systems.”
10
WHERE TO BEGIN?
11
WHERE TO BEGIN?
Step 1. Pick a framework
12
WHERE TO BEGIN?
Step 2. Establish your
Cybersecurity Program
13
WHERE TO BEGIN?
Step 3. Catalog Existing Controls
14
OK, NOW WHAT?
15
OK, NOW WHAT?
Step 4. Start Building
Your Cybersecurity Program should include the following processes:
16
ASSET MANAGEMENT
Enterprise assets:
17
SOFTWARE ASSET MANAGEMENT
Software assets:
18
DATA MANAGEMENT
Data assets:
19
SECURE CONFIGURATION
Configurable assets:
20
ACCOUNT & CREDENTIAL MANAGEMENT
Account assets:
21
NETWORK MANAGEMENT
Network assets:
22
VULNERABILITY MANAGEMENT
Enterprise assets:
23
AUDIT LOG MANAGEMENT
Audit logs:
24
MALWARE DEFENSE
Enterprise Assets:
25
DATA RECOVERY
Assets to be backed up:
26
SECURITY AWARENESS TRAINING
Training topics:
27
SERVICE PROVIDER MANAGEMENT
Types of service providers:
28
INCIDENT RESPONSE MANAGEMENT
IR elements:
29
SUMMARY
Step 1. Pick a framework
Step 2. Establish your Cybersecurity Program
Step 3. Catalog Existing Controls
Step 4. Start Building
30
WHAT’S NEXT?
31
WHAT’S NEXT?
NCDPI K-12 Cybersecurity Webinar Series
Next Webinar
December 11, 2024, 10am
NCLGISA Strike Team Multifactor Authentication Phishing
Join Cory Rankin from the NCLGISA strike team as he steps through the complexities of MFA Phishing. Specifically, Cory will go over what it is, how it works, and how you can protect yourself.
33
34
QUESTIONS?
35
QUESTIONS RAISED
Yes, kinda. CIS developed what they call Implementation Groups - IG1, IG2, IG3. The idea is each group of controls builds upon the other. Start with IG1, then IG2, then IG3. IG1 represents “essential cyber hygiene”, the foundational set of controls/safeguards every organization should strive to achieve first.
Within the Implementation Group, the controls are not prioritized necessarily. But, CIS did develop what they call “Attack Cards” that identify the safeguards that are most effective in protecting against the top 5 most common threats - Malware, Ransomware, Web Application Hacking, Insider and Privilege Misuse, and Targeted Intrusions. The Attack Cards are part of the CIS Community Defense Model documentation located here: https://www.cisecurity.org/insights/white-papers/cis-community-defense-model-2-0
At this time there is no specific guidance. We have taken a note to look at this as part of the Cybersecurity Program Plan initiative.