Conforming to NIST’s Cybersecurity Framework to remove the new certainty of the digital age

Understanding the core standards set out in the Cybersecurity Framework (CSF) by the U.S. National Institute of Standards and Technology (NIST).

cybersecurity stock
Gerd Altmann (CC0)

It’s generally recognized that one of the most famous idioms in American history was first penned in 1789 by Ben Franklin, when he wrote, “In this world, nothing can be said to be certain, except death and taxes.”

Some quick fact-checking and self-awareness proves Ben’s words to remain categorically true over 200 years later. However, a third certainty could be added to that list as the digital age forges onward. Sure; death and taxes are going to happen, like it or not (most of us would fall into the “not” category). But, it’s also becoming increasingly certain that your operations—whether they are manufacturing, some other commercial entity, or a municipality—will face at least the threat of a severely damaging cyberattack.

An executive order mandating the Cybersecurity Framework

An executive order was signed on May 11, 2017 mandating federal agencies to abide by the recommendations of the Cybersecurity Framework (CSF) established by the U.S. National Institute of Standards and Technology (NIST). This action is meant to “most responsibly” secure the IT and data of the American people.

When the government gets involved, the smart business leader and savvy IT manager takes notice. A recent Gartner report estimated that the CSF is already used by approximately 30 percent of U.S. organizations and projected to reach 50 percent by 2020. What this technologically-inspired executive order really tells us, is that any organization that wants to do business with the federal government is going to have to adopt these same standards soon.

The data of the American people is simply too valuable to leave to chance. The catastrophic Equifax breach that put over 143 million Americans’ most sensitive information in malicious hands is all too timely of a reminder of this.

5 core standards of the CSF

The current system of patching legacy networks with inferior firewalls and reactive (rather than proactive) security policies just isn’t good enough anymore to ensure the technological well-being of our society. It’s costly, complex, and downright ineffective, which is most problematic. Therefore, advanced technology is needed to better secure our digital future and conform to the five core standards in the CSF, which are: identity, protect, detect, respond, and recover.

Archaic concepts that act as Band-Aids to our inherently vulnerable networks need to be replaced. Sophisticated cryptography, cloaking, and micro-segmentation need to take their place in order to enable our systems to connect faster, while keeping virtual foreign invaders, as well as domestic hackers, safely isolated and removed from the access they need to cause disruption.

HIP technology as the modern solution

Cyberattack doesn’t need to be a certainty for your business, however, because better technological options already exist. Host Internet Protocol (HIP) is a newer, ideal technology to help your operations meet CSF standards, and emerge as a socially responsible and technologically advanced organization.

HIP technology replaces the openness of the TCP/IP architecture by replacing the “spoofable” IP address with a cryptographic identity. Essentially, HIP devices can be placed at any endpoint within multiple networks to provide a layer of security previously unattainable in the form of an invisible network overlay.

HIP devices also feature unprecedented simplicity and connectivity. The technology is so intuitive and easy to implement that connections can be made faster than ever by the even least tech-savvy individuals within your organization.

There is a trickle-down effect to this transition with many benefits including ironclad security, decreased operations costs from less network downtime and less required IT expertise, and conformance to the CSF. Here’s a brief summation of how HIP can address those five core CSF standards:

  1. Identity – All HIP devices are whitelisted via their unique cryptographic identity. Therefore, no unauthorized devices can gain access to your network.
  2. Protect – Built-in security with peer-to-peer AES 256 encryption and verifiable isolation protects your network to a level almost entirely impractical with other security solutions.
  3. Detect – Simple and seamless integration of a HIP-based network with third party monitoring tools enables event-based logic, real-time isolation, mitigation, and disaster recovery.
  4. Respond – As soon as a data breach occurs, appropriate action can be taken instantly by quarantine or removal of the compromised device from hundreds of networks.
  5. Recover – HIP technology does not provide recovery functionality, but the good news is that you simply won’t need it. Risk is effectively minimized to a point that most hackers will simply look elsewhere for data intrusion. After all, why would a thief waste his time trying to break into a home with dead bolt locks, security cameras, and a rabid Rottweiler named Satan pacing menacingly off-leash in the driveway, if they can go next door and walk in through the open front door with nothing standing in their way but a toy Poodle named Snowball with a pink ribbon in her hair?

Data breaches can be particularly costly to the manufacturing industry. Any sort of systems downtime can result in a severe loss of revenue-generating production for these businesses. Manufacturers need to adopt the CSF, not only if they want to continue doing business with the federal government, but also if they want to maintain a healthy bottom-line in an extremely competitive global business environment.

Organizations in all industries should also heed to the security standards set forth in the CSF for their own livelihood. The digital age is a matter of survival, where one compromised security event can have catastrophic implications to your business. In a fast-changing world of increasingly sophisticated cyberattacks from both, foreign and domestic sources, death and taxes might suddenly look like the least of your concerns.

This article is published as part of the IDG Contributor Network. Want to Join?

Related:
SUBSCRIBE! Get the best of CSO delivered to your email inbox.