00:00:01NIST Cybersecurity Framework 2.0 Update
00:06:46Intersection of Privacy and Security Frameworks
ABOUT THIS EPISODE
Could the addition of 'Govern' to the NIST Cybersecurity Framework 2.0 be the game-changer in how we approach cybersecurity governance? We unravel the significant evolution of the framework, now bolstering enterprise risk management with a holistic approach that's essential for any organization, big or small. We dissect the interplay of the six functions—Identify, Protect, Detect, Respond, Recover, and the new kid on the block, Govern—and how this integration across the entire lifecycle of protection can redefine the conventional cybersecurity steps. No stone is left unturned as we debate the necessity of maintaining distinct cybersecurity and privacy frameworks in the face of increasing overlap, a question that is becoming more pertinent as the digital age advances.
English
United States
SHOW NOTES 🔗
TRANSCRIPT 🔗
WEBVTT
00:00:01.467 --> 00:00:05.282
I have to go Chain, chain food.
00:00:07.427 --> 00:00:07.849
I'll thank you.
00:00:07.849 --> 00:00:12.109
Ladies and gentlemen, welcome to another episode of Privacy, please.
00:00:12.109 --> 00:00:16.446
I'm your host, cameron Ivy, alongside my other host, t'chcape Gums.
00:00:16.446 --> 00:00:18.169
We don't do co-hosts anymore, we're just hosts.
00:00:18.169 --> 00:00:19.451
You know what You're just hosts.
00:00:19.451 --> 00:00:20.271
I just made that up.
00:00:20.271 --> 00:00:22.155
Right now we're going to fly with it.
00:00:22.600 --> 00:00:27.708
That's how it works, though, Like if you just it said it is now true, it is a statement.
00:00:28.240 --> 00:00:31.850
Yeah, I don't want to tire saying co-hosts, because you know we're one and the same.
00:00:32.521 --> 00:00:33.484
No one says co-parent.
00:00:33.484 --> 00:00:34.307
Does anyone say co-parent?
00:00:34.307 --> 00:00:34.951
I guess they do.
00:00:35.353 --> 00:00:36.076
I don't like it either.
00:00:36.076 --> 00:00:37.119
Yeah, if you're gonna.
00:00:37.119 --> 00:00:39.148
So either you say it as an adjective or a verb.
00:00:39.148 --> 00:00:43.630
Right like, but as a noun co-parent as a noun doesn't work.
00:00:43.799 --> 00:00:50.353
You just, you just call them parents Like this is, this is my mom and my co-parent, and I'm sorry, I meant dad.
00:00:50.353 --> 00:00:54.884
Dad looks down at you like what did you?
00:00:54.884 --> 00:00:56.710
Just, I'm well, how are you sir?
00:00:57.280 --> 00:00:58.944
Good man Got some.
00:00:58.944 --> 00:01:03.314
You know, life life continues to go.
00:01:04.141 --> 00:01:05.128
It does, it does.
00:01:06.617 --> 00:01:10.331
We uh Sun continues to shine and yeah, you know.
00:01:11.061 --> 00:01:12.025
Comes up another day.
00:01:12.561 --> 00:01:14.507
NIST security framework continues to change.
00:01:14.507 --> 00:01:18.164
It does, and we have questions it does it does.
00:01:18.203 --> 00:01:19.186
That is today's topic.
00:01:19.186 --> 00:01:20.731
200th episode yes.
00:01:22.801 --> 00:01:23.688
There's a button for that.
00:01:23.688 --> 00:01:25.120
If you want me to use it, use the button.
00:01:25.120 --> 00:01:27.670
I gotta go live with it, though.
00:01:27.670 --> 00:01:31.444
Oh, it won't.
00:01:31.444 --> 00:01:33.471
It won't, let me go live with it.
00:01:33.471 --> 00:01:35.259
No, that's all right.
00:01:35.259 --> 00:01:35.620
All right, so okay.
00:01:36.165 --> 00:01:36.792
Post production.
00:01:36.792 --> 00:01:37.519
That's what post productions are.
00:01:37.519 --> 00:01:42.292
For those of you that have listened to the show long enough know what we mean when we say post production.
00:01:42.292 --> 00:01:47.269
Oh yeah, we really start 200th episodes.
00:01:47.269 --> 00:01:47.953
So that happened this week.
00:01:47.953 --> 00:01:49.620
There's the button Big times.
00:01:50.603 --> 00:02:04.414
Also also just as significant in in the security framework, security and privacy world, nist released version 2.0 of the cybersecurity framework, nist cybersecurity framework 2.0.
00:02:04.414 --> 00:02:05.620
It's been a long time coming.
00:02:05.620 --> 00:02:10.620
It's been many, many years into making there's been a lot of comments.
00:02:10.620 --> 00:02:13.188
I mean the way the entire process works is they.
00:02:13.188 --> 00:02:16.620
They solicit comments from the industry, from experts.
00:02:16.620 --> 00:02:26.599
There are no shortage of experts that are also already engaged in working on this project in particular, both inside and out, so it's very much a collective effort.
00:02:26.599 --> 00:02:30.560
Nist, of course, is a government entity.
00:02:30.560 --> 00:02:33.233
It is.
00:02:33.233 --> 00:02:34.620
It is funded and backed by the US government.
00:02:36.703 --> 00:02:46.560
Well, they say here, it's now added as the sixth the government function which emphasizes the cybersecurity is a major source of enterprise risk and a consideration for senior leadership.
00:02:47.664 --> 00:02:50.620
And so that is the significant update to the 2.0 framework.
00:02:50.620 --> 00:03:10.599
So, for those of you who just don't have the NIST cybersecurity framework memorized, it encompassed five sections prior to this update Identify, protect, detect, respond, recover as it pertains to your environment, infrastructure, data, etc.
00:03:10.599 --> 00:03:26.073
Identify the things that require protection, protect them, apply detective measures such that you know, when, not doing anything, when naughty things are happening, respond to any naughty things that are happening and recover from any naughty things that may have happened.
00:03:26.073 --> 00:03:36.668
So the the the additional, the update to the NIST cybersecurity framework is governed, but they didn't add it as another step or another wedge.
00:03:36.668 --> 00:03:43.741
They added it as an overlay across all of those other components, which I think is good.
00:03:43.741 --> 00:03:52.795
I think that sends the right message, namely that govern isn't somehow distinct from detection, protection, responding, etc.
00:03:52.795 --> 00:03:59.519
But that governance is an activity that must occur throughout the entire life cycle of protection.
00:03:59.519 --> 00:04:02.594
I'll call it the life cycle of protection.
00:04:02.875 --> 00:04:04.617
I like that Coin it.
00:04:04.617 --> 00:04:08.144
Coin it Trademark, that's mine.
00:04:08.183 --> 00:04:08.525
There it is.
00:04:08.525 --> 00:04:12.700
That's how it works, isn't it now, I guess?
00:04:13.413 --> 00:04:17.728
I mean, you heard it here, that's how it works now.
00:04:17.728 --> 00:04:19.795
So questions from this.
00:04:19.795 --> 00:04:31.615
Obviously, I know the one that jumped up in your mind is well, isn't there a security framework opposite of this or, I'm sorry, a privacy framework?
00:04:31.615 --> 00:04:35.875
Apologies, yeah, but why is that separate?
00:04:37.230 --> 00:04:38.456
And it has been for some time.
00:04:38.456 --> 00:04:43.922
So NIST also has a privacy framework.
00:04:43.922 --> 00:04:47.500
It is currently in version, I think, 1.1.
00:04:47.500 --> 00:04:52.161
, but 1.0 was released back in January of 2020.
00:04:52.161 --> 00:04:58.297
It is a privacy framework and we've talked a lot about why.
00:04:58.297 --> 00:05:05.939
We've always felt that there's a lot of overlap between the two, but not really certain that they should be that wholly distinct from each other.
00:05:05.939 --> 00:05:20.723
And in this update of the NIST Cybersecurity Framework 2.0, I find myself questioning even further why NIST chooses to keep cybersecurity as a distinct framework from the privacy framework.
00:05:20.723 --> 00:05:33.862
Now, for what it's worth, nist actually addresses this right up front In the 2.0, in the updated cybersecurity framework, right on page 12, it does explicitly state the following.
00:05:33.862 --> 00:05:46.279
I'm going to read this verbatim Privacy risk While cybersecurity and privacy are independent disciplines, their objectives overlap in certain circumstances, as illustrated in Figure 6.
00:05:47.310 --> 00:06:09.737
Figure 6 is a Venn diagram and on the left it's cybersecurity risk, which are associated with cybersecurity incidents arising from loss of confidentiality, integrity or availability, and the right side of this Venn diagram is privacy risk associated with privacy events arising from data processing, and in the middle of that are cybersecurity-related privacy events.
00:06:09.737 --> 00:06:21.021
So let me go on to read Cybersecurity risk management is essential for addressing privacy risk related to the loss of confidentiality, integrity and availability of individuals' data.
00:06:21.021 --> 00:06:24.399
For example, data breaches could lead to identity theft.
00:06:24.399 --> 00:06:30.041
However, privacy risk can also arise by means that are unrelated to cybersecurity incidents.
00:06:30.041 --> 00:06:31.173
So there's the smoke and gut.
00:06:31.173 --> 00:06:45.031
That sentence is the reason why the NIST body still sees privacy as a separate framework Because, quote, privacy risk can also arise by means that are unrelated to cybersecurity events.
00:06:46.470 --> 00:06:51.059
I am further confounded, confused and maybe even a little grumpy about that statement.
00:06:51.059 --> 00:07:09.377
Cybersecurity framework includes physical protections to things like data centers, so it obviously acknowledges that you can have an impact to confidentiality, integrity, availability that are not really the cybersecurity that are.
00:07:09.377 --> 00:07:19.482
Simply, someone walked into a data center and removed a hard drive, there was a natural disaster and a location is offline.
00:07:19.482 --> 00:07:25.041
Those are not cybersecurity incidents, but yet we cover them under the cybersecurity framework.
00:07:25.041 --> 00:07:28.098
Yes, they are not distinct.
00:07:28.098 --> 00:07:34.199
There are other frameworks that talk explicitly about disaster recovery, so, no, I'm not attempting to conflate those things either.
00:07:34.199 --> 00:07:39.600
What I'm failing to understand here is we know that you cannot have privacy without security.
00:07:39.600 --> 00:07:40.362
It is not a thing.
00:07:40.362 --> 00:07:56.122
You can, indeed, have security without privacy, but you cannot have privacy without security, and so I'm very much failing to understand why these two are separate, especially if you added the ring of governance to include governance as one of the key pillars.
00:07:56.629 --> 00:08:00.242
Well, maybe that's a question we'll ask NIST when we tag them.
00:08:01.810 --> 00:08:02.471
I need an answer.
00:08:02.471 --> 00:08:06.095
I'm just curious how we arose to that decision.
00:08:06.095 --> 00:08:12.096
The document clearly does point out why it thinks that with that anecdotal blur.
00:08:12.096 --> 00:08:24.237
But I think part of the problem with both privacy and security is that as long as we continue to treat them as these distinct practices, we're going to end up with the outcomes we have.
00:08:24.237 --> 00:08:26.690
Here's a really good example of that.
00:08:28.004 --> 00:08:34.517
We treat ransomware as largely a confidentiality risk, namely data loss.
00:08:34.517 --> 00:08:49.312
Now, those of us following along at home would have remembered that the Verizon Databrige Investigation Report from last year 2023, very accurately points out that availability is the number one impact of ransomware.
00:08:49.312 --> 00:08:51.687
It crossed the threshold Two years ago.
00:08:51.687 --> 00:08:53.928
Data loss was, no longer is the case.
00:08:53.928 --> 00:08:56.745
Availability is the number one impact.
00:08:56.745 --> 00:08:57.889
Where am I going with this?
00:08:57.889 --> 00:09:02.634
Cybersecurity is still treating ransomware incorrectly.
00:09:02.634 --> 00:09:12.716
If the impact is availability, then encrypting your data doesn't protect against availability attacks, because if I re-encrypt the data, you've also lost access to it.
00:09:12.716 --> 00:09:23.048
You know why this is a problem Because we keep separating CIA confidential integrity and availability across this line of security and privacy.
00:09:23.048 --> 00:09:31.067
This Venn diagram should be one circle, One circle.
00:09:31.067 --> 00:09:40.511
The cybersecurity framework and the privacy framework I do not, do not genuinely think, should continue to exist as two distinct entities.
00:09:41.333 --> 00:09:42.846
Yeah, now is this.
00:09:42.846 --> 00:09:55.376
It says that the 2.0 version now applies to all audiences, industry sectors and organizations, instead of just critical infrastructure owners.
00:09:55.376 --> 00:09:57.029
I didn't know that.
00:09:57.985 --> 00:10:00.374
I think that's a great update.
00:10:00.374 --> 00:10:14.556
So a lot of times, nist documents are published with an intended audience of critical infrastructure owners, both public and private, and that can be everything, of course, from banks to other government entities.
00:10:14.556 --> 00:10:23.817
There are government banks, so yeah, nonetheless public and private sector, but largely critical infrastructure.
00:10:23.817 --> 00:10:34.452
I really do appreciate that this has expanded itself to include all verticals, because everyone suffers from cybersecurity incidents these days.
00:10:34.452 --> 00:10:36.049
Everyone does.
00:10:36.049 --> 00:10:54.220
If you now acknowledge that the cybersecurity framework covers all entities, not just critical infrastructure, you've also just included all of the entities that are responsible for individuals data.
00:10:56.458 --> 00:11:06.345
So to add on to that game, the framework added emerging threats rooted to artificial intelligence and quantum computing too.
00:11:06.345 --> 00:11:07.827
What does this mean?
00:11:09.937 --> 00:11:26.164
I'm hopeful that it means that we now have a framework that others can use when thinking about threats against artificial intelligence and quantum computing.
00:11:26.164 --> 00:11:41.618
Or I should say, on the second, the inverse of that, how quantum computing can affect what we already do today and the threats that will emerge from successful quantum computing, the primary risk there, of course, being a privacy one right.
00:11:41.618 --> 00:11:51.524
Like everyone's worried that quantum computers will lead to the ability to decrypt information that is currently otherwise very well protected.
00:11:51.524 --> 00:11:54.860
A privacy issue, a privacy issue.
00:11:56.636 --> 00:12:01.996
There's no secure network period.
00:12:01.996 --> 00:12:03.061
Right, you can't.
00:12:03.061 --> 00:12:10.644
I mean, there's no way to get around, like, even if you have a VPN, you mean that assumption of compromise that I love to go back to.
00:12:10.664 --> 00:12:13.741
Yeah, yeah, I think it's.
00:12:13.741 --> 00:12:23.049
It is mostly a foregone conclusion with many security folks that the assumption of compromise is the best way to treat your networks.
00:12:23.049 --> 00:12:33.847
I say most security people because not everyone is adopted a zero trust mentality, much less the framework, another framework put forth by this zero trust right.
00:12:33.847 --> 00:12:37.865
Reauthenticate all the things, right Like nothing should get.
00:12:37.865 --> 00:12:42.760
There should be no implicit or inherent trust throughout the systems and the network.
00:12:42.760 --> 00:12:49.547
One should assume that compromise can and or does already exist, and so you should compartmentalize and check those things.
00:12:49.547 --> 00:12:59.563
That assumption of compromise is, I think, very alive and well in this part of the conversation.
00:12:59.563 --> 00:13:05.366
Hmm, should zero trust be a separate framework than CSF?
00:13:05.366 --> 00:13:15.086
Now that we're talking about it, I I understand the differences between what they are intended to to do and describe.
00:13:15.086 --> 00:13:24.722
One is implicitly just about infrastructure and the other is a much larger component of that.
00:13:26.386 --> 00:13:28.711
Yeah, I'll just continue to be grumpy about the privacy and security.
00:13:28.711 --> 00:13:32.672
Look, maybe it's because that's what we do here.
00:13:32.672 --> 00:13:37.293
This is, this show is rooted in privacy and security.
00:13:37.293 --> 00:13:40.889
Not security, not privacy, but privacy and security, for a reason.
00:13:40.889 --> 00:13:45.966
What we really dig into here is where that intersection of those two things live, and I think there's.
00:13:45.966 --> 00:13:55.839
We will continue to see failures and be able to protect ourselves, even against ransomware, when the number one threat is availability.
00:13:55.839 --> 00:14:00.649
The number one threat posed by ransomware is availability and we keep treating it like a confidentiality problem.
00:14:00.649 --> 00:14:07.808
Fail when we keep treating privacy as something separate and distinct and the cybersecurity necessity fail.
00:14:08.504 --> 00:14:20.678
In your opinion, what kind of challenges do you think organizations, especially like smaller firms, might face when implementing a framework like the 2.0?
00:14:20.678 --> 00:14:22.150
Do you have any concerns there?
00:14:22.465 --> 00:14:23.005
Really it's not.
00:14:23.005 --> 00:14:27.216
It's not a lot of small organizations won't be audited against it.
00:14:27.216 --> 00:14:35.038
I think it is difficult for many small organizations to implement the cybersecurity framework.
00:14:35.038 --> 00:14:41.888
I think what's important for those folks is to be able to have access to a service provider that can assist.
00:14:41.888 --> 00:14:48.089
Having in-house expertise to cover off on these critical things is going to be difficult.
00:14:48.089 --> 00:14:56.386
The framework, however, the place to start, if you are a smaller entity, is with the identify right, like.
00:14:56.486 --> 00:14:57.792
You need to understand your risk.
00:14:57.792 --> 00:14:58.908
What are your risks?
00:14:58.908 --> 00:15:00.614
You need to know what they are.
00:15:00.614 --> 00:15:02.812
If you are small, you need to know what they are.
00:15:02.812 --> 00:15:08.495
That being said, when you are small, the answer is also somewhat fairly easy.
00:15:08.495 --> 00:15:09.528
It's everything.
00:15:09.528 --> 00:15:13.073
You can't really absorb the blow of a ransomware impact.
00:15:13.073 --> 00:15:21.359
If you get hit with ransomware, even a 50,000 or five ransom can really, really really impact your business.
00:15:21.359 --> 00:15:22.769
It can shut through your doors.
00:15:22.769 --> 00:15:24.249
We have watched it happen.
00:15:24.249 --> 00:15:30.397
Arguably, for some of those folks, for a lot of small folks, the place to start is at protect.
00:15:30.397 --> 00:15:34.855
It's at protect and then measure the gap between what you have.
00:15:34.855 --> 00:15:42.437
But you can arguably get closer to protecting air quotes, everything when you are small.
00:15:42.437 --> 00:15:44.610
Just run to that.
00:15:44.610 --> 00:15:50.384
If for no other reason, then the risk of being impacted by something like ransomware.
00:15:50.384 --> 00:15:57.188
I'm just going to use that because it's the highest ROI attackers have these days and it's not going anywhere.
00:15:57.188 --> 00:16:06.751
But if the risk of ransomware putting you out of business is real, then I might argue you should fast forward right to protect.
00:16:10.508 --> 00:16:16.976
Anything beyond AI and quantum computing that NIS should consider already.
00:16:16.976 --> 00:16:30.533
Well, I guess, on top of combining the privacy framework, is there anything that you can think of from your perspective on something they should be looking already at implementing for the next phase?
00:16:31.988 --> 00:16:32.509
of the future.
00:16:32.509 --> 00:16:45.210
I'm out here armchair quarter backing but for the record, I did submit some of this feedback during an open call for feedback, so none of what I'm saying here is new.
00:16:45.210 --> 00:16:45.751
At the moment.
00:16:45.751 --> 00:16:58.177
It has been a very long time that we 200 episodes counting at this point that we've been talking about that intersection of security and privacy, of just how intertwined they are.
00:16:58.177 --> 00:17:02.014
I went through the thing and I submitted that feedback.
00:17:02.014 --> 00:17:07.777
I don't think I have anything else that's really salient to call out here.
00:17:07.777 --> 00:17:10.089
I want to give credit where credit's due.
00:17:10.089 --> 00:17:11.615
This update is amazing.
00:17:11.615 --> 00:17:12.950
This update is incredible.
00:17:15.086 --> 00:17:20.438
I'm excited to watch folks adopt this in the real world.
00:17:20.438 --> 00:17:30.717
I'm hopeful that it's also an opportunity for some of those organizations that had not gotten to maturity and maybe they take this opportunity to get to maturity now on 2.0.
00:17:30.717 --> 00:17:32.912
This is kick butt.
00:17:32.912 --> 00:17:34.230
This is absolutely kick butt.
00:17:34.230 --> 00:17:35.749
I think we have worked it.
00:17:35.749 --> 00:17:37.407
I think we have.
00:17:37.407 --> 00:17:40.276
I know we have worked it, I know we have.
00:17:40.276 --> 00:17:43.972
Well, yeah to that point wake up people.
00:17:43.972 --> 00:17:45.395
Wake up.
00:17:46.185 --> 00:17:50.121
If you haven't done anything yet, you might want to jump on it Now's a good time.
00:17:50.583 --> 00:17:51.125
Now's a good time.
00:17:51.125 --> 00:17:52.328
Now's a good time because it's live.
00:17:56.511 --> 00:17:57.694
It's not just a draft.
00:17:57.694 --> 00:18:01.065
It happened, it's real, it's real.
00:18:01.548 --> 00:18:02.796
There's a lot of good things in this.
00:18:02.796 --> 00:18:03.721
Yeah, absolutely.
00:18:03.721 --> 00:18:10.218
I think one of the most yeah, one of the best parts about it, too, is it introduces organizational context.
00:18:10.218 --> 00:18:14.115
It's at the top of the governance chart.
00:18:14.115 --> 00:18:18.997
An organizational context is a thing that's been missing from a lot of cybersecurity practice.
00:18:18.997 --> 00:18:20.371
A lot of cybersecurity practice.
00:18:20.371 --> 00:18:23.278
It is the thing that is missing from a lot of privacy practice.
00:18:23.278 --> 00:18:28.877
That lack of organizational context is what leads to such exposures.
00:18:30.298 --> 00:18:34.125
Well, give us your thoughts, people, listeners.
00:18:34.125 --> 00:18:38.548
If you have any insights or questions, please shoot them our way, unless I disagree with them.
00:18:38.588 --> 00:18:40.769
in which case, yeah, bring those too.
00:18:42.313 --> 00:18:42.894
Gabe wants it.
00:18:42.894 --> 00:18:48.996
He's just saying that he doesn't want it, but please send them, add him, add him.
00:18:48.996 --> 00:18:52.108
It's okay, he probably won't even read it.
00:18:52.108 --> 00:19:02.691
He tries to stay off the socials, so you can email him here at that's GABR.
00:19:05.549 --> 00:19:06.614
Yeah, yeah, yeah.
00:19:06.614 --> 00:19:09.172
Well, gabe, good stuff.
00:19:09.172 --> 00:19:16.438
Love to see this and we'll stay on alert for any other new changes in anything with the privacy framework, if there's any.
00:19:16.438 --> 00:19:22.278
But we will at NIST and see if somebody will respond to us on that or maybe we'll bring them on the show.
00:19:22.278 --> 00:19:27.517
Yeah, right on, cool, thanks for coming this week and we'll see you guys next week.
00:19:27.517 --> 00:19:30.308
And let's, gabe, you had anything, let's go, all right, see you later.
00:00:01.467 --> 00:00:05.282
I have to go Chain, chain food.
00:00:07.427 --> 00:00:07.849
I'll thank you.
00:00:07.849 --> 00:00:12.109
Ladies and gentlemen, welcome to another episode of Privacy, please.
00:00:12.109 --> 00:00:16.446
I'm your host, cameron Ivy, alongside my other host, t'chcape Gums.
00:00:16.446 --> 00:00:18.169
We don't do co-hosts anymore, we're just hosts.
00:00:18.169 --> 00:00:19.451
You know what You're just hosts.
00:00:19.451 --> 00:00:20.271
I just made that up.
00:00:20.271 --> 00:00:22.155
Right now we're going to fly with it.
00:00:22.600 --> 00:00:27.708
That's how it works, though, Like if you just it said it is now true, it is a statement.
00:00:28.240 --> 00:00:31.850
Yeah, I don't want to tire saying co-hosts, because you know we're one and the same.
00:00:32.521 --> 00:00:33.484
No one says co-parent.
00:00:33.484 --> 00:00:34.307
Does anyone say co-parent?
00:00:34.307 --> 00:00:34.951
I guess they do.
00:00:35.353 --> 00:00:36.076
I don't like it either.
00:00:36.076 --> 00:00:37.119
Yeah, if you're gonna.
00:00:37.119 --> 00:00:39.148
So either you say it as an adjective or a verb.
00:00:39.148 --> 00:00:43.630
Right like, but as a noun co-parent as a noun doesn't work.
00:00:43.799 --> 00:00:50.353
You just, you just call them parents Like this is, this is my mom and my co-parent, and I'm sorry, I meant dad.
00:00:50.353 --> 00:00:54.884
Dad looks down at you like what did you?
00:00:54.884 --> 00:00:56.710
Just, I'm well, how are you sir?
00:00:57.280 --> 00:00:58.944
Good man Got some.
00:00:58.944 --> 00:01:03.314
You know, life life continues to go.
00:01:04.141 --> 00:01:05.128
It does, it does.
00:01:06.617 --> 00:01:10.331
We uh Sun continues to shine and yeah, you know.
00:01:11.061 --> 00:01:12.025
Comes up another day.
00:01:12.561 --> 00:01:14.507
NIST security framework continues to change.
00:01:14.507 --> 00:01:18.164
It does, and we have questions it does it does.
00:01:18.203 --> 00:01:19.186
That is today's topic.
00:01:19.186 --> 00:01:20.731
200th episode yes.
00:01:22.801 --> 00:01:23.688
There's a button for that.
00:01:23.688 --> 00:01:25.120
If you want me to use it, use the button.
00:01:25.120 --> 00:01:27.670
I gotta go live with it, though.
00:01:27.670 --> 00:01:31.444
Oh, it won't.
00:01:31.444 --> 00:01:33.471
It won't, let me go live with it.
00:01:33.471 --> 00:01:35.259
No, that's all right.
00:01:35.259 --> 00:01:35.620
All right, so okay.
00:01:36.165 --> 00:01:36.792
Post production.
00:01:36.792 --> 00:01:37.519
That's what post productions are.
00:01:37.519 --> 00:01:42.292
For those of you that have listened to the show long enough know what we mean when we say post production.
00:01:42.292 --> 00:01:47.269
Oh yeah, we really start 200th episodes.
00:01:47.269 --> 00:01:47.953
So that happened this week.
00:01:47.953 --> 00:01:49.620
There's the button Big times.
00:01:50.603 --> 00:02:04.414
Also also just as significant in in the security framework, security and privacy world, nist released version 2.0 of the cybersecurity framework, nist cybersecurity framework 2.0.
00:02:04.414 --> 00:02:05.620
It's been a long time coming.
00:02:05.620 --> 00:02:10.620
It's been many, many years into making there's been a lot of comments.
00:02:10.620 --> 00:02:13.188
I mean the way the entire process works is they.
00:02:13.188 --> 00:02:16.620
They solicit comments from the industry, from experts.
00:02:16.620 --> 00:02:26.599
There are no shortage of experts that are also already engaged in working on this project in particular, both inside and out, so it's very much a collective effort.
00:02:26.599 --> 00:02:30.560
Nist, of course, is a government entity.
00:02:30.560 --> 00:02:33.233
It is.
00:02:33.233 --> 00:02:34.620
It is funded and backed by the US government.
00:02:36.703 --> 00:02:46.560
Well, they say here, it's now added as the sixth the government function which emphasizes the cybersecurity is a major source of enterprise risk and a consideration for senior leadership.
00:02:47.664 --> 00:02:50.620
And so that is the significant update to the 2.0 framework.
00:02:50.620 --> 00:03:10.599
So, for those of you who just don't have the NIST cybersecurity framework memorized, it encompassed five sections prior to this update Identify, protect, detect, respond, recover as it pertains to your environment, infrastructure, data, etc.
00:03:10.599 --> 00:03:26.073
Identify the things that require protection, protect them, apply detective measures such that you know, when, not doing anything, when naughty things are happening, respond to any naughty things that are happening and recover from any naughty things that may have happened.
00:03:26.073 --> 00:03:36.668
So the the the additional, the update to the NIST cybersecurity framework is governed, but they didn't add it as another step or another wedge.
00:03:36.668 --> 00:03:43.741
They added it as an overlay across all of those other components, which I think is good.
00:03:43.741 --> 00:03:52.795
I think that sends the right message, namely that govern isn't somehow distinct from detection, protection, responding, etc.
00:03:52.795 --> 00:03:59.519
But that governance is an activity that must occur throughout the entire life cycle of protection.
00:03:59.519 --> 00:04:02.594
I'll call it the life cycle of protection.
00:04:02.875 --> 00:04:04.617
I like that Coin it.
00:04:04.617 --> 00:04:08.144
Coin it Trademark, that's mine.
00:04:08.183 --> 00:04:08.525
There it is.
00:04:08.525 --> 00:04:12.700
That's how it works, isn't it now, I guess?
00:04:13.413 --> 00:04:17.728
I mean, you heard it here, that's how it works now.
00:04:17.728 --> 00:04:19.795
So questions from this.
00:04:19.795 --> 00:04:31.615
Obviously, I know the one that jumped up in your mind is well, isn't there a security framework opposite of this or, I'm sorry, a privacy framework?
00:04:31.615 --> 00:04:35.875
Apologies, yeah, but why is that separate?
00:04:37.230 --> 00:04:38.456
And it has been for some time.
00:04:38.456 --> 00:04:43.922
So NIST also has a privacy framework.
00:04:43.922 --> 00:04:47.500
It is currently in version, I think, 1.1.
00:04:47.500 --> 00:04:52.161
, but 1.0 was released back in January of 2020.
00:04:52.161 --> 00:04:58.297
It is a privacy framework and we've talked a lot about why.
00:04:58.297 --> 00:05:05.939
We've always felt that there's a lot of overlap between the two, but not really certain that they should be that wholly distinct from each other.
00:05:05.939 --> 00:05:20.723
And in this update of the NIST Cybersecurity Framework 2.0, I find myself questioning even further why NIST chooses to keep cybersecurity as a distinct framework from the privacy framework.
00:05:20.723 --> 00:05:33.862
Now, for what it's worth, nist actually addresses this right up front In the 2.0, in the updated cybersecurity framework, right on page 12, it does explicitly state the following.
00:05:33.862 --> 00:05:46.279
I'm going to read this verbatim Privacy risk While cybersecurity and privacy are independent disciplines, their objectives overlap in certain circumstances, as illustrated in Figure 6.
00:05:47.310 --> 00:06:09.737
Figure 6 is a Venn diagram and on the left it's cybersecurity risk, which are associated with cybersecurity incidents arising from loss of confidentiality, integrity or availability, and the right side of this Venn diagram is privacy risk associated with privacy events arising from data processing, and in the middle of that are cybersecurity-related privacy events.
00:06:09.737 --> 00:06:21.021
So let me go on to read Cybersecurity risk management is essential for addressing privacy risk related to the loss of confidentiality, integrity and availability of individuals' data.
00:06:21.021 --> 00:06:24.399
For example, data breaches could lead to identity theft.
00:06:24.399 --> 00:06:30.041
However, privacy risk can also arise by means that are unrelated to cybersecurity incidents.
00:06:30.041 --> 00:06:31.173
So there's the smoke and gut.
00:06:31.173 --> 00:06:45.031
That sentence is the reason why the NIST body still sees privacy as a separate framework Because, quote, privacy risk can also arise by means that are unrelated to cybersecurity events.
00:06:46.470 --> 00:06:51.059
I am further confounded, confused and maybe even a little grumpy about that statement.
00:06:51.059 --> 00:07:09.377
Cybersecurity framework includes physical protections to things like data centers, so it obviously acknowledges that you can have an impact to confidentiality, integrity, availability that are not really the cybersecurity that are.
00:07:09.377 --> 00:07:19.482
Simply, someone walked into a data center and removed a hard drive, there was a natural disaster and a location is offline.
00:07:19.482 --> 00:07:25.041
Those are not cybersecurity incidents, but yet we cover them under the cybersecurity framework.
00:07:25.041 --> 00:07:28.098
Yes, they are not distinct.
00:07:28.098 --> 00:07:34.199
There are other frameworks that talk explicitly about disaster recovery, so, no, I'm not attempting to conflate those things either.
00:07:34.199 --> 00:07:39.600
What I'm failing to understand here is we know that you cannot have privacy without security.
00:07:39.600 --> 00:07:40.362
It is not a thing.
00:07:40.362 --> 00:07:56.122
You can, indeed, have security without privacy, but you cannot have privacy without security, and so I'm very much failing to understand why these two are separate, especially if you added the ring of governance to include governance as one of the key pillars.
00:07:56.629 --> 00:08:00.242
Well, maybe that's a question we'll ask NIST when we tag them.
00:08:01.810 --> 00:08:02.471
I need an answer.
00:08:02.471 --> 00:08:06.095
I'm just curious how we arose to that decision.
00:08:06.095 --> 00:08:12.096
The document clearly does point out why it thinks that with that anecdotal blur.
00:08:12.096 --> 00:08:24.237
But I think part of the problem with both privacy and security is that as long as we continue to treat them as these distinct practices, we're going to end up with the outcomes we have.
00:08:24.237 --> 00:08:26.690
Here's a really good example of that.
00:08:28.004 --> 00:08:34.517
We treat ransomware as largely a confidentiality risk, namely data loss.
00:08:34.517 --> 00:08:49.312
Now, those of us following along at home would have remembered that the Verizon Databrige Investigation Report from last year 2023, very accurately points out that availability is the number one impact of ransomware.
00:08:49.312 --> 00:08:51.687
It crossed the threshold Two years ago.
00:08:51.687 --> 00:08:53.928
Data loss was, no longer is the case.
00:08:53.928 --> 00:08:56.745
Availability is the number one impact.
00:08:56.745 --> 00:08:57.889
Where am I going with this?
00:08:57.889 --> 00:09:02.634
Cybersecurity is still treating ransomware incorrectly.
00:09:02.634 --> 00:09:12.716
If the impact is availability, then encrypting your data doesn't protect against availability attacks, because if I re-encrypt the data, you've also lost access to it.
00:09:12.716 --> 00:09:23.048
You know why this is a problem Because we keep separating CIA confidential integrity and availability across this line of security and privacy.
00:09:23.048 --> 00:09:31.067
This Venn diagram should be one circle, One circle.
00:09:31.067 --> 00:09:40.511
The cybersecurity framework and the privacy framework I do not, do not genuinely think, should continue to exist as two distinct entities.
00:09:41.333 --> 00:09:42.846
Yeah, now is this.
00:09:42.846 --> 00:09:55.376
It says that the 2.0 version now applies to all audiences, industry sectors and organizations, instead of just critical infrastructure owners.
00:09:55.376 --> 00:09:57.029
I didn't know that.
00:09:57.985 --> 00:10:00.374
I think that's a great update.
00:10:00.374 --> 00:10:14.556
So a lot of times, nist documents are published with an intended audience of critical infrastructure owners, both public and private, and that can be everything, of course, from banks to other government entities.
00:10:14.556 --> 00:10:23.817
There are government banks, so yeah, nonetheless public and private sector, but largely critical infrastructure.
00:10:23.817 --> 00:10:34.452
I really do appreciate that this has expanded itself to include all verticals, because everyone suffers from cybersecurity incidents these days.
00:10:34.452 --> 00:10:36.049
Everyone does.
00:10:36.049 --> 00:10:54.220
If you now acknowledge that the cybersecurity framework covers all entities, not just critical infrastructure, you've also just included all of the entities that are responsible for individuals data.
00:10:56.458 --> 00:11:06.345
So to add on to that game, the framework added emerging threats rooted to artificial intelligence and quantum computing too.
00:11:06.345 --> 00:11:07.827
What does this mean?
00:11:09.937 --> 00:11:26.164
I'm hopeful that it means that we now have a framework that others can use when thinking about threats against artificial intelligence and quantum computing.
00:11:26.164 --> 00:11:41.618
Or I should say, on the second, the inverse of that, how quantum computing can affect what we already do today and the threats that will emerge from successful quantum computing, the primary risk there, of course, being a privacy one right.
00:11:41.618 --> 00:11:51.524
Like everyone's worried that quantum computers will lead to the ability to decrypt information that is currently otherwise very well protected.
00:11:51.524 --> 00:11:54.860
A privacy issue, a privacy issue.
00:11:56.636 --> 00:12:01.996
There's no secure network period.
00:12:01.996 --> 00:12:03.061
Right, you can't.
00:12:03.061 --> 00:12:10.644
I mean, there's no way to get around, like, even if you have a VPN, you mean that assumption of compromise that I love to go back to.
00:12:10.664 --> 00:12:13.741
Yeah, yeah, I think it's.
00:12:13.741 --> 00:12:23.049
It is mostly a foregone conclusion with many security folks that the assumption of compromise is the best way to treat your networks.
00:12:23.049 --> 00:12:33.847
I say most security people because not everyone is adopted a zero trust mentality, much less the framework, another framework put forth by this zero trust right.
00:12:33.847 --> 00:12:37.865
Reauthenticate all the things, right Like nothing should get.
00:12:37.865 --> 00:12:42.760
There should be no implicit or inherent trust throughout the systems and the network.
00:12:42.760 --> 00:12:49.547
One should assume that compromise can and or does already exist, and so you should compartmentalize and check those things.
00:12:49.547 --> 00:12:59.563
That assumption of compromise is, I think, very alive and well in this part of the conversation.
00:12:59.563 --> 00:13:05.366
Hmm, should zero trust be a separate framework than CSF?
00:13:05.366 --> 00:13:15.086
Now that we're talking about it, I I understand the differences between what they are intended to to do and describe.
00:13:15.086 --> 00:13:24.722
One is implicitly just about infrastructure and the other is a much larger component of that.
00:13:26.386 --> 00:13:28.711
Yeah, I'll just continue to be grumpy about the privacy and security.
00:13:28.711 --> 00:13:32.672
Look, maybe it's because that's what we do here.
00:13:32.672 --> 00:13:37.293
This is, this show is rooted in privacy and security.
00:13:37.293 --> 00:13:40.889
Not security, not privacy, but privacy and security, for a reason.
00:13:40.889 --> 00:13:45.966
What we really dig into here is where that intersection of those two things live, and I think there's.
00:13:45.966 --> 00:13:55.839
We will continue to see failures and be able to protect ourselves, even against ransomware, when the number one threat is availability.
00:13:55.839 --> 00:14:00.649
The number one threat posed by ransomware is availability and we keep treating it like a confidentiality problem.
00:14:00.649 --> 00:14:07.808
Fail when we keep treating privacy as something separate and distinct and the cybersecurity necessity fail.
00:14:08.504 --> 00:14:20.678
In your opinion, what kind of challenges do you think organizations, especially like smaller firms, might face when implementing a framework like the 2.0?
00:14:20.678 --> 00:14:22.150
Do you have any concerns there?
00:14:22.465 --> 00:14:23.005
Really it's not.
00:14:23.005 --> 00:14:27.216
It's not a lot of small organizations won't be audited against it.
00:14:27.216 --> 00:14:35.038
I think it is difficult for many small organizations to implement the cybersecurity framework.
00:14:35.038 --> 00:14:41.888
I think what's important for those folks is to be able to have access to a service provider that can assist.
00:14:41.888 --> 00:14:48.089
Having in-house expertise to cover off on these critical things is going to be difficult.
00:14:48.089 --> 00:14:56.386
The framework, however, the place to start, if you are a smaller entity, is with the identify right, like.
00:14:56.486 --> 00:14:57.792
You need to understand your risk.
00:14:57.792 --> 00:14:58.908
What are your risks?
00:14:58.908 --> 00:15:00.614
You need to know what they are.
00:15:00.614 --> 00:15:02.812
If you are small, you need to know what they are.
00:15:02.812 --> 00:15:08.495
That being said, when you are small, the answer is also somewhat fairly easy.
00:15:08.495 --> 00:15:09.528
It's everything.
00:15:09.528 --> 00:15:13.073
You can't really absorb the blow of a ransomware impact.
00:15:13.073 --> 00:15:21.359
If you get hit with ransomware, even a 50,000 or five ransom can really, really really impact your business.
00:15:21.359 --> 00:15:22.769
It can shut through your doors.
00:15:22.769 --> 00:15:24.249
We have watched it happen.
00:15:24.249 --> 00:15:30.397
Arguably, for some of those folks, for a lot of small folks, the place to start is at protect.
00:15:30.397 --> 00:15:34.855
It's at protect and then measure the gap between what you have.
00:15:34.855 --> 00:15:42.437
But you can arguably get closer to protecting air quotes, everything when you are small.
00:15:42.437 --> 00:15:44.610
Just run to that.
00:15:44.610 --> 00:15:50.384
If for no other reason, then the risk of being impacted by something like ransomware.
00:15:50.384 --> 00:15:57.188
I'm just going to use that because it's the highest ROI attackers have these days and it's not going anywhere.
00:15:57.188 --> 00:16:06.751
But if the risk of ransomware putting you out of business is real, then I might argue you should fast forward right to protect.
00:16:10.508 --> 00:16:16.976
Anything beyond AI and quantum computing that NIS should consider already.
00:16:16.976 --> 00:16:30.533
Well, I guess, on top of combining the privacy framework, is there anything that you can think of from your perspective on something they should be looking already at implementing for the next phase?
00:16:31.988 --> 00:16:32.509
of the future.
00:16:32.509 --> 00:16:45.210
I'm out here armchair quarter backing but for the record, I did submit some of this feedback during an open call for feedback, so none of what I'm saying here is new.
00:16:45.210 --> 00:16:45.751
At the moment.
00:16:45.751 --> 00:16:58.177
It has been a very long time that we 200 episodes counting at this point that we've been talking about that intersection of security and privacy, of just how intertwined they are.
00:16:58.177 --> 00:17:02.014
I went through the thing and I submitted that feedback.
00:17:02.014 --> 00:17:07.777
I don't think I have anything else that's really salient to call out here.
00:17:07.777 --> 00:17:10.089
I want to give credit where credit's due.
00:17:10.089 --> 00:17:11.615
This update is amazing.
00:17:11.615 --> 00:17:12.950
This update is incredible.
00:17:15.086 --> 00:17:20.438
I'm excited to watch folks adopt this in the real world.
00:17:20.438 --> 00:17:30.717
I'm hopeful that it's also an opportunity for some of those organizations that had not gotten to maturity and maybe they take this opportunity to get to maturity now on 2.0.
00:17:30.717 --> 00:17:32.912
This is kick butt.
00:17:32.912 --> 00:17:34.230
This is absolutely kick butt.
00:17:34.230 --> 00:17:35.749
I think we have worked it.
00:17:35.749 --> 00:17:37.407
I think we have.
00:17:37.407 --> 00:17:40.276
I know we have worked it, I know we have.
00:17:40.276 --> 00:17:43.972
Well, yeah to that point wake up people.
00:17:43.972 --> 00:17:45.395
Wake up.
00:17:46.185 --> 00:17:50.121
If you haven't done anything yet, you might want to jump on it Now's a good time.
00:17:50.583 --> 00:17:51.125
Now's a good time.
00:17:51.125 --> 00:17:52.328
Now's a good time because it's live.
00:17:56.511 --> 00:17:57.694
It's not just a draft.
00:17:57.694 --> 00:18:01.065
It happened, it's real, it's real.
00:18:01.548 --> 00:18:02.796
There's a lot of good things in this.
00:18:02.796 --> 00:18:03.721
Yeah, absolutely.
00:18:03.721 --> 00:18:10.218
I think one of the most yeah, one of the best parts about it, too, is it introduces organizational context.
00:18:10.218 --> 00:18:14.115
It's at the top of the governance chart.
00:18:14.115 --> 00:18:18.997
An organizational context is a thing that's been missing from a lot of cybersecurity practice.
00:18:18.997 --> 00:18:20.371
A lot of cybersecurity practice.
00:18:20.371 --> 00:18:23.278
It is the thing that is missing from a lot of privacy practice.
00:18:23.278 --> 00:18:28.877
That lack of organizational context is what leads to such exposures.
00:18:30.298 --> 00:18:34.125
Well, give us your thoughts, people, listeners.
00:18:34.125 --> 00:18:38.548
If you have any insights or questions, please shoot them our way, unless I disagree with them.
00:18:38.588 --> 00:18:40.769
in which case, yeah, bring those too.
00:18:42.313 --> 00:18:42.894
Gabe wants it.
00:18:42.894 --> 00:18:48.996
He's just saying that he doesn't want it, but please send them, add him, add him.
00:18:48.996 --> 00:18:52.108
It's okay, he probably won't even read it.
00:18:52.108 --> 00:19:02.691
He tries to stay off the socials, so you can email him here at that's GABR.
00:19:05.549 --> 00:19:06.614
Yeah, yeah, yeah.
00:19:06.614 --> 00:19:09.172
Well, gabe, good stuff.
00:19:09.172 --> 00:19:16.438
Love to see this and we'll stay on alert for any other new changes in anything with the privacy framework, if there's any.
00:19:16.438 --> 00:19:22.278
But we will at NIST and see if somebody will respond to us on that or maybe we'll bring them on the show.
00:19:22.278 --> 00:19:27.517
Yeah, right on, cool, thanks for coming this week and we'll see you guys next week.
00:19:27.517 --> 00:19:30.308
And let's, gabe, you had anything, let's go, all right, see you later.
Disclaimer: The podcast and artwork embedded on this page are from A Problem Lounge Show, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.
EDIT
Thank you for helping to keep the podcast database up to date.
