1 of 50

NIST CSF

CyberSecurity Framework

Risk Assessment & Management

Federico Calzolari, Scuola Normale Superiore - EDIH Tuscany X.0

2 of 50

NIST

(US) National Institute of Standards and Technology

Presenter introduction

No matter the size of your company or organization, cybersecurity is a crucial element for continued success. This “Cybersecurity for Small Business: the fundamentals” presentation can be used to share the “how to’s” of cybersecurity as recommended by NIST, the National Institute of Standards and Technology. You, your team, your company or community group will learn the steps for understanding cybersecurity risks and the steps to mitigate them. Your particular industry may have additional and related cybersecurity, regulatory and privacy recommendations, so as a best practice, the information that follows is intended to be customizable, flexible and non-regulatory.

This material is also intended for organizations without a staff member who acts as a dedicated Chief Information Officer (CIO) or risk executive. For those organizations of sufficient maturity/size that have these resources, please refer as well to NIST Special Publication 800-39 “Managing Information Risk: Organization, Mission and Information System View,” in particular the “FARM” (Frame, Assess, Respond and Monitor) process for decision-making. https://doi.org/10.6028/NIST.SP.800-39

While many elements related to cybersecurity are technical, the goal of today’s presentation is to give you a plan of action. No one knows your business as well as you do and no one can start the process for ensuring your business is protected and resilient in the face of non-stop threats from cyber-related harm, whether accidental, criminal, or malicious.

(This content is non-regulatory, but represents road-tested advice from technical experts and people just like you.)

3 of 50

Bio

Federico Calzolari

Scuola Normale Superiore: Chief Information Security Officer, Head of HPC
CERN, CMS experiment: Higgs Boson discovery 2012 - Physics Nobel Prize 2013
EU Project Manager of European Digital Innovation Hub Tuscany X.0: AI, HPC, Cybersecurity
Tuscany C3T (Cybersecurity Competence Center) & CSIRT: Technical Scientific Committees
Consultant for IT crimes at the District Attorney's office
First exploit of the Google Ranking algorithms (2007)

Email: federico.calzolari@sns.it

Web: https://cern.ch/fede

3

4 of 50

Contents

Cybersecurity basics
Legislative Framework
Risk Assessment
Cybersecurity Framework
Risk Management

4

When we consider that the most common business in the United States is a small business, we can understand the importance of addressing the cybersecurity needs of this business segment. 75 % of US employers are micro-businesses with fewer than 9 employees, a remarkable 3.8 million micro-businesses. https://www.sba.gov/sites/default/files/508FINALAug17Microbusiness.pdf These employers likely do not have dedicated security staff but they have the same need to be cyber-aware and safe as any large enterprise organization. It’s for this type of organization that this presentation has been created.

By reading or reviewing this material, a small business owner or employee will learn about the basic concepts of cybersecurity and the topics most frequently of concern to small business owners.

When small businesses around the US were asked about the issues they are most concerned about, they mentioned* phishing schemes, ransomware attacks, financial fraud and tech support scams, as well as cybersecurity basics. Small business owners also wanted information about how to protect their company’s mobile devices, and a list of questions they should ask vendors to ensure their systems are secure.

Every small business wants to minimize the risks that might harm their ability to continue operating, cost them money or damage their company brand. Understanding cybersecurity and taking action is a best practice to mitigate risks and provide a way to recover from unanticipated threats, cyber or otherwise.

You will learn about the NIST Cybersecurity Framework, which is a flexible and understandable model that helps an organization prioritize their approach to developing a cybersecurity plan that works for them.

We’ll also include tips and advice, as well as recommendations for other materials that you can use to educate yourself and your team on a variety of related topics, like the best way to use mobile devices, and accessing networks while on the road.

Lastly, we’ll share a variety of resources from across the federal government and other partners that we think you’ll find useful as you build your plans and create policies and procedures to become safer from cybersecurity threats.

*https://www.ftc.gov/reports/engage-connect-protect-ftcs-projects-plans-foster-small-business-cybersecurity-federal-trade

5 of 50

CyberCrime Statistics

A hacker attack every 20 seconds
50.000 websites breached every day
1 billion personal data records stolen or exposed every year

Minutes to compromise, months to detect, years to recover
Average cost of a breach: $200.000
Cybercrime costs the global economy $10 trillion every year

95% of cybersecurity breaches are caused by human error
80% of attacks are not detected by victims
99% of malware is detected only once
Email is the most common method used by hackers to spread malware

5

6 of 50

The invention of the Web

Tim Berners-Lee, CERN 1989:

HTML: HyperText Markup Language
HTTP: Hypertext Transfer Protocol
URL: Uniform Resource Locator
the first Web Server: HTTPD
the first Browser: WorldWideWeb

Tim Berners-Lee:

World Wide Web Consortium (W3C)
Turing Prize 2016

6

7 of 50

Internet Rule 34

7

8 of 50

Internet Rule 34-bis

8

For every technological invention there is "at least"�one fall into the world of crime

9 of 50

Anatomy of an Attack

9

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge)

guideline for classifying and describing cyberattacks and intrusions

10 of 50

The only limit is your imagination

11 of 50

Cyberattacks Reasons

11

12 of 50

Cybersecurity Basics

Cybersecurity

Protecting electronic devices and associated data/information.

12