{"id":277,"date":"2017-06-07T18:40:06","date_gmt":"2017-06-07T18:40:06","guid":{"rendered":"http:\/\/securitycurve.com\/?p=277"},"modified":"2017-06-07T18:40:06","modified_gmt":"2017-06-07T18:40:06","slug":"the-csf-stephen-fry-says-youre-doing-it-wrong","status":"publish","type":"post","link":"https:\/\/securitycurve.com\/?p=277","title":{"rendered":"The CSF: Stephen Fry says you’re doing it wrong"},"content":{"rendered":"

\"\"<\/a>So first of all, let me start by saying that I get it that Stephen Fry playing the role of Jeeves <\/a>from like a billion years ago has nothing to do with anything. \u00a0That said, it came up in my google image search for “you’re doing it wrong” while looking for an image to use in conjunction with commenting on people’s use of the NIST CSF<\/a>. \u00a0Frankly, I couldn’t resist: it lured me in almost as much as the giant, comic-themed superhero Stephen Fry<\/a>\u00a0from the child rescue alert campaign posters\u00a0(which I, like the complete rube that I am, stopped to take a photo of when passing by).<\/p>\n

Sir<\/del> Stephen Fry aside, on to the NIST Cybersecurity Framework [note: seriously… I don’t even live in the UK and I’m wondering why no knighthood yet for the institution that he represents.<\/em>]<\/p>\n

I continue to be mystified by the reception of the CSF in industry coupled with the complete failure of most organizations to get the central point of the document. \u00a0Here’s\u00a0the things that we know to be true about the usage of the CSF in industry:<\/p>\n

    \n
  1. The CSF is all over the place usage-wise. \u00a0It’s the ubiquitous, de-facto choice for pretty much anybody when organizing their cybersecurity efforts. \u00a0This is true when it comes to planning out their program, assessing what they do,\u00a0building teams… heck, even education about<\/em> security is based on the CSF nowadays.<\/li>\n
  2. The CSF is, at its core, a document about risk management.<\/li>\n
  3. Organizations continue to not<\/strong>\u00a0perform risk management in any kind of systematic, workmanlike way. \u00a0Lack of risk management is the normative case.<\/li>\n<\/ol>\n

    Seriously. \u00a0At least half of the CSF document itself is specifically about risk management: why it’s important, what it entails, how you’d determine what your relative capability or maturity is of your risk management efforts,\u00a0how to apply the implementation steps outlined later in light of the risk assessment you’re doing, etc. \u00a0This is from the document directly (emphasis mine):<\/p>\n

    The Framework uses risk management processes<\/span> to enable organizations to inform and prioritize decisions regarding cybersecurity. It supports recurring risk assessments<\/span> and validation of business drivers<\/span> to help organizations select target states for cybersecurity activities that reflect desired outcomes…<\/p><\/blockquote>\n

    It goes on to say:<\/p>\n

    The Framework Implementation Tiers (\u201cTiers\u201d) provide context on how an organization views cybersecurity risk and the processes in place to manage that risk<\/span>. The Tiers range from Partial (Tier 1) to Adaptive (Tier 4) and describe an increasing degree of rigor and sophistication in cybersecurity risk management practices<\/span> and the extent to which cybersecurity risk management is informed by business needs and is integrated into an organization\u2019s overall risk management practices<\/span>.<\/p><\/blockquote>\n

    So riddle me this… \u00a0If an organization says that they are using the CSF, but they\u00a0also say that they don’t have time to do risk management – what exactly do you suppose they are using the framework for<\/strong>?<\/p>\n

    Anyone? \u00a0As a way to organize their controls? \u00a0As a cross-reference? \u00a0As a philosophical guide to the ineffable chaos\u00a0of the world at large?<\/p>\n

    What exactly is the point of that? \u00a0The\u00a0CSF itself has as a self-stated design goal to provide a “common vocabulary” for security. \u00a0Sure, it does that. \u00a0Vocabulary achieved. \u00a0But doesn’t having a “common vocabulary” imply that, as a next step, people have a conversation about something? \u00a0In the case of the CSF, that conversation is supposed to be about risk management — which I still don’t see people doing very well out there. \u00a0I suppose I’ll get over it, but the CSF is supposed to be a first step – it’s a means to an end, not the end itself.<\/p>\n","protected":false},"excerpt":{"rendered":"

    So first of all, let me start by saying that I get it that Stephen Fry playing the role of Jeeves from like a billion years ago has nothing to do with anything. \u00a0That said, it came up in my google image search for “you’re doing it wrong” while looking for an image to use […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[4],"tags":[29,71,84,101,113],"class_list":["post-277","post","type-post","status-publish","format-standard","hentry","category-security","tag-csf","tag-jeeves","tag-nist","tag-risk-management","tag-stephen-fry"],"_links":{"self":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/posts\/277","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=277"}],"version-history":[{"count":0,"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/posts\/277\/revisions"}],"wp:attachment":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=277"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=277"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=277"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}