Security Architecture & NIST Framework

Defense in Depth: multiple security layers so compromise of one
doesn't mean total breach. Attacker must defeat ALL layers.

Layers:
1. Policies, Procedures, Awareness (governance)
2. Physical Security (locks, cameras, guards)
3. Perimeter (firewall, IPS, WAF, DDoS protection)
4. Network (VLAN segmentation, NAC, IDS)
5. Host (EDR, patch management, hardening, AV)
6. Application (WAF, SAST, DAST, secrets management)
7. Data (encryption, DLP, access control, backup)

Example — protecting a database:
Layer 1: Policy — "DB must be encrypted at rest"
Layer 2: Physical — DB server in locked server room
Layer 3: Perimeter — firewall blocks 5432 from internet
Layer 4: Network — only app server VLAN can reach DB VLAN
Layer 5: Host — OS patched, unnecessary services disabled
Layer 6: Application — parameterized queries, no SQL injection
Layer 7: Data — AES-256 encryption, backups encrypted, minimal privilege

NIST CSF 2.0 (2024): voluntary framework for managing cyber risk
Used by: US federal agencies, enterprises, critical infrastructure

6 Core Functions:
GOVERN → IDENTIFY → PROTECT → DETECT → RESPOND → RECOVER

1. GOVERN (NEW in 2.0):
   - Organizational context, risk strategy, roles/responsibilities
   - Policy, risk management framework
   - Supply chain risk management
   Example: security policy approved by board, CISO reports to CEO

2. IDENTIFY:
   - Asset inventory: all systems, data, users
   - Risk assessment: threats, vulnerabilities, likelihood, impact
   - Business environment: critical processes, dependencies
   Example: asset management system, annual risk assessment

3. PROTECT:
   - IAM: MFA, PAM, least privilege
   - Awareness training: phishing simulations
   - Data security: encryption, DLP
   - Maintenance: patch management, hardening
   Example: MFA for all users, 90-day patch cycle

4. DETECT:
   - Anomaly detection: SIEM rules, behavioral analytics
   - Monitoring: network, endpoint, cloud
   - Detection testing: purple team exercises
   Example: SIEM with 24/7 SOC, EDR on all endpoints

5. RESPOND:
   - IR plan: defined, tested, rehearsed
   - Communications: legal, PR, regulators
   - Analysis: RCA after incidents
   Example: annual tabletop exercise, IR retainer

6. RECOVER:
   - Recovery planning: BCP/DR tested
   - Improvements: lessons learned implemented
   - Communications: stakeholder updates
   Example: RTO/RPO defined, backup restore tested quarterly

Implementation Tiers:
Tier 1 (Partial): ad hoc, informal, no risk process
Tier 2 (Risk-Informed): some policies, not organization-wide
Tier 3 (Repeatable): formal policies, organization-wide
Tier 4 (Adaptive): continuous improvement, information sharing

Center for Internet Security — 18 Controls prioritized by impact

Implementation Groups (IG):
IG1 (Essential Cyber Hygiene): everyone, even small orgs
IG2: medium/large with dedicated IT security
IG3: organizations facing sophisticated threats

Top Controls:
1. Inventory and Control of Enterprise Assets
2. Inventory and Control of Software Assets
3. Data Protection
4. Secure Configuration of Enterprise Assets and Software
5. Account Management
6. Access Control Management
7. Continuous Vulnerability Management
8. Audit Log Management
9. Email and Web Browser Protections
10. Malware Defenses
11. Data Recovery
12. Network Infrastructure Management
13. Network Monitoring and Defense
14. Security Awareness and Skills Training
15. Service Provider Management
16. Application Software Security
17. Incident Response Management
18. Penetration Testing

CIS Controls map to: NIST CSF, ISO 27001, SOC 2, HIPAA, PCI DSS

SOC: team monitoring and responding to security events

SOC Tiers:
Tier 1 (Alert Triage):
  - 24/7 monitoring of SIEM alerts
  - First response: is this a real incident or false positive?
  - Escalate to Tier 2 if real
  - Skills: alert analysis, basic IR, tool operation

Tier 2 (Incident Handling):
  - Deeper investigation of escalated incidents
  - Containment and initial remediation
  - Threat hunting when directed
  - Skills: forensics, malware analysis, advanced log analysis

Tier 3 (Threat Intelligence & Hunting):
  - Proactive threat hunting
  - Malware reverse engineering
  - Threat intelligence integration
  - Complex incident investigation
  - Skills: advanced RE, exploit analysis, threat intel

SOC Metrics:
- MTTD: Mean Time to Detect (hours)
- MTTR: Mean Time to Respond (hours)
- Alert-to-ticket rate (quality of detection rules)
- False positive rate (tuning needed)
- SOC alert volume per analyst per day

SOC Technology Stack:
SIEM: Splunk, Microsoft Sentinel, IBM QRadar
EDR: CrowdStrike, SentinelOne, Microsoft Defender
NDR: Darktrace, ExtraHop, Corelight
SOAR: Palo Alto XSOAR, Splunk SOAR (automating IR)
TIP: MISP, ThreatConnect, OpenCTI

NIST RMF (SP 800-37) — for federal agencies but widely used:
1. Prepare: establish risk management context
2. Categorize: information system impact (low/moderate/high)
3. Select: security controls (from NIST SP 800-53)
4. Implement: put controls in place
5. Assess: verify controls work (security assessment)
6. Authorize: ATO (Authorization to Operate) from senior official
7. Monitor: continuous monitoring, report deviations

NIST SP 800-53 Control Families:
AC - Access Control
AU - Audit and Accountability
CA - Assessment, Authorization, Monitoring
CM - Configuration Management
CP - Contingency Planning
IA - Identification and Authentication
IR - Incident Response
MA - Maintenance
MP - Media Protection
PE - Physical and Environmental Protection
PL - Planning
PM - Program Management
PS - Personnel Security
RA - Risk Assessment
SA - System and Services Acquisition
SC - System and Communications Protection
SI - System and Information Integrity
SR - Supply Chain Risk Management

Measuring and improving security program maturity:

CMMC (Cybersecurity Maturity Model Certification):
Required for: DoD contractors
Level 1 (Foundational): 17 basic practices
Level 2 (Advanced): 110 practices (NIST SP 800-171)
Level 3 (Expert): 110+ practices + NIST SP 800-172

NIST CSF Tiers:
1 (Partial) → 2 (Risk Informed) → 3 (Repeatable) → 4 (Adaptive)

Maturity improvement cycle:
1. Assess current state (where are we?)
2. Define target state (where do we need to be?)
3. Gap analysis (what's missing?)
4. Roadmap (how do we get there? priority, cost, timeline)
5. Implement controls
6. Re-assess (did it improve?)

Common frameworks for assessment:
- NIST CSF self-assessment
- CIS Controls assessment tool
- ISO 27001 audit
- SOC 2 Type II audit

Security budget justification:
- Risk reduction calculation: probability * impact
- Cost of control vs cost of incident
- Regulatory penalties (GDPR 4% revenue)
- Cyber insurance requirements