Hello everyone! Today, let’s talk about the NIST CSF, which is the implementation of the cybersecurity framework developed by the National Institute of Standards and Technology. Many companies, especially now, are becoming more and more important. Everyone wants to know how to make this framework and how to truly implement it in their own company.
First of all, I have to tell my friends who don’t quite understand what this NIST CSF is. Simply put, it is like a big guideline, or a roadmap? It is not the kind of rules and regulations that are specific to every step, but it provides enterprises with an idea that allows enterprises to figure out where their current network security level is, what they want to achieve, what they should do in the first step, and what they should do in the second step, that's what they should do. It has five main core functions, namely identification, protection, detection, response and recovery. These five parts are like a complete chain. No one can be missing. You have to tie one link to one before you can do the security aspect well and make it solid.
So how do you start NIST CSF? I tell you that this is not something that can be done by slapping your head. You have to do it step by step and make steady progress.
1. First understand your own situation, that is, the work you need to do in the "identification" stage : see what important assets the company has? For example, servers, computers, and important data information; what are the risks faced by these assets? Is it a hacker from the Internet, or did an internal employee accidentally make a mistake in operation? Or is the device itself malfunctioning? Only after understanding all of this can you understand it and lay a solid foundation for the subsequent work. Provide global procurement services for weak current intelligent products! If this step is not done well, it will be easy to bump into like a headless fly in the future, and it will be useless.
2. Then you have to find a way to "protect" these precious assets : if you know what is important and what risks there are, you must take measures to protect them. For example, install a firewall for important systems, set a strong password for computers, and provide security training for employees regularly so that they don’t click on those unknown email links, and data. Important data must be backed up and backed up at any time. If it is lost, it can be retrieved. Yes
3. "Detection" is also particularly critical. If there is a problem, you must be able to detect it in time : protection alone is not enough. If a bad person really comes in or the system is incorrect, you must know it earlier. Therefore, you have to get some detection tools, monitor the system logs, and see if there are any abnormal situations, such as suddenly there are many abnormal login attempts, or abnormal data flow out. These must be discovered in time, and you cannot wait until there is a big problem before you realize it.
4. Then there is "response". If you find a problem, you have to deal with it quickly. Don't delay: Once a security incident is detected, you must immediately activate the emergency plan, how to stop the loss, how to drive the bad guys out, and how to restore the affected system to normal. All of these must be thought about in advance and write it down clearly. Do as you want to do it as you want and don't be in a hurry.
5. Finally, it is "recovery". After an incident, you must return to normal state as soon as possible to reduce losses: after the incident is processed, quickly restore the system and data to its normal appearance so that the business can continue to run. Moreover, the recovery is not over yet. We need to summarize the experience and lessons, see where we didn’t do it well this time, and how to avoid similar things happening again next time, so that we can make progress little by little.
After saying so many steps, someone must ask: Our company is not large in scale, not many people, and limited resources. Can we also do NIST CSF? Don't worry, NIST CSF is not static. Yes, companies can adjust according to their actual situation, start from a small aspect, do it little by little, and don't have to pursue perfection all at once. The important thing is to move first and gradually improve it. Some people also asked, do you have to buy a lot of very safe equipment to build this framework? In fact, it is not necessarily the case. Some measures do not cost much, such as formulating rules and regulations and strengthening employee training. The key is to truly implement these measures, rather than just relying on buying equipment.
During the entire NIST CSF process, there are a few more points that need to be paid special attention to. First, senior management must pay attention to it and take the lead in promoting it, otherwise it will be difficult for the people below to truly implement it; second, all departments of the company must participate together. Security is not the business of the IT department alone, and every department and everyone have a responsibility; third, this is a continuous process, not just do it once, you have to review it regularly to see how the results are, and any new risks appear, and then constantly adjust and improve it, so that this framework can truly play a role and protect the enterprise's network security!