How to get

started with
the NIST
Cybersecurity
Framework
(CSF)
By Bruce Potter

www.expel.io
 Contents

About this doc. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

A three-minute tour of the NIST CSF. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Find your baseline (in two hours or less). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Charting your course ... literally. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Using Expel to color in your CSF. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

About Expel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2 How to get started with the NIST Cybersecurity Framework (CSF)

About this doc

Alright, let’s address the elephant in the room. Frameworks aren’t known for
being page turners — even when they’re shortened into seven characters
like the NIST CSF. But there are some things you do because they’re “good”
for you — like going to the doctor, eating well and exercising. The NIST CSF
is like that.

While we can’t turn the NIST CSF into the latest best seller (sorry!), we can give
you a quick tour and show you exactly how Expel can positively affect your
NIST CSF ratings — both now ... and over the long term.

www.expel.io 3
 Introduction

Newsflash! The NIST Cybersecurity Framework was never intended to be

something you could “do.” It’s supposed to be something you can “use.”

But that’s often easier said than done. The going as we grow our broader cyber risk
CSF can be a confusing and intimidating management program.
process to go through. So, if you’re at a
Here at Expel, we are our own customer.
loss about how to implement it, you’re not
That means we use our own service as
alone.
part of our internal IT security efforts. I’ve
But rest assured, since the CSF was honestly been shocked at the impact using
released back in 2013, lots of organizations the Expel service had on our CSF scores
have done it, including Expel. Like others, and wanted to share what I’ve learned
we’ve found it to be a useful tool to help us about how Expel can help you on the road
understand where we are and where we’re to CSF nirvana.

4 How to get started with the NIST Cybersecurity Framework (CSF)

A three-minute tour of the
NIST CSF

Let’s start with a “CliffsNotes” overview.

Like an apple, at the core of the CSF is,

unsurprisingly, the Core. The Core is meant
to capture the entirety of cybersecurity.
Yup, pick anything related to cybersecurity Governance
overn
vernance
and it should be in the Core. If you’re Rii sk
k Ass
sse
e ss
ssm
me ntt
thinking “that sounds ambitious” you’re
right. To capture everything, the Core is
broken down into buckets (and even more Business
usiness
siness Environme
Environmen
Environment
buckets inside those buckets).
Risk Manage me nt
Or, if you’re more outdoorsy, you can think
of the Core as a big tree with big branches
(aka functional areas), which have smaller
branches (aka categories), which have Asset Managementt
leaves on them (aka sub-categories).
Whatever metaphor you choose, the sub-
Identify
categories have the specific types of things
you should probably be doing.

The Core has functional areas: identify,

protect, detect, respond, and recover.
These are basically the lifecycle of including things like “Physical devices
cybersecurity without actually being a loop. and systems within the organization are
inventoried” and “Software platforms and
Under each functional area, there are
applications within the organization are
categories. For instance, under Identify,
inventoried.”
there’s asset management, business
environment, governance, risk assessment, The Core is nothing if not comprehensive.
and risk management area. Under each It’s a big tree, but it’s a tree that can
category, there are (unsurprisingly) sub- really help you mature your cyber risk
categories. For instance, under asset management posture … which is pretty
management, there are six sub-categories unique for a tree.

www.expel.io 5
 Find your baseline
(in two hours or less)

Whew! Now that we’ve got that out of the way, what can you do with the Core?

At Expel, we’ve found the CSF Core can You’ll probably look at these sub-
be super helpful to describe where we are categories and think “yeah, I’m kinda doing
and where we want to be with respect to those things,” which is good. But how well
cyber risk management. The first step is are you doing them? At Expel we use a
getting a baseline of where we’re at today. six-point scale to rate ourselves on each
subcategory (we’re computer scientists, so
Here’s how we suggest figuring out the “as
our scale starts at 0). Here’s what the scale
is” state for your organization.
looks like:
Start by looking at the sub-categories.
You’ll see lots of very specific things that
0 Nope, we’re not doing this at all
you should be doing. For example, under
Anomalies and Events (AE) in the Detect 1 It’s ad hoc, we only do it in cases
(DE) functional area, there are five sub- where we have to
categories:
2 We do it ... but it’s not consistent
■■ DE.AE-1: A baseline of network or structured
operations and expected data flows for
users and systems is established and 3 We do it consistently … but it’s
managed not best practice and it could be
■■ DE.AE-2: Detected events are analyzed better aligned with the business
to understand attack targets and
4 We do it well and I wouldn’t be
methods
ashamed to show this to my
■■ DE.AE-3: Event data are aggregated and peers
correlated from multiple sources and
sensors 5 We’re world class (as in, we’re
one of the best in the world)
■■ DE.AE-4: Impact of events is determined
■■ DE.AE-5: Incident alert thresholds are
established

6 How to get started with the NIST Cybersecurity Framework (CSF)

By applying this scale to the (gulp!) 98 sub- Once you’re done with the self-
categories you’ll get a good measure of assessment, take that break and then
where your organization stands. Just don’t do it again. But this time, instead of
forget that there are 98 sub-categories. So, documenting where you are, document
don’t overthink it. You don’t need to spend where you want to be. When building
a bunch of time debating the finer points of your “to-be,” be aware that (with the rare
each score. exception) you don’t need to be a five.
Being “world class” in anything takes a
For instance, resist the urge to add
lot of effort and resources. Organizations
significant digits to the scale. Try to stick
that require world class security controls
with integer ratings. If you must, allow
generally know it and are prepared to shell
yourself ½ increments (for example, you
out megabucks (or megaBitcoin) to achieve
can score a 2, 2.5, 3, 3.5, etc). If you’re
it. In most cases you should probably be
incrementing by tenths you’re in the
shooting for a four — sometimes a bit
danger zone … and under no circumstance
higher, sometimes a bit lower.
should you go to the hundredths place.
Not ever. That’s far too much specificity for
what’s meant to be a quick assessment of
where you stand.

At a leisurely pace of two sub-categories

per minute you’ll be done in an hour and
even have time for a break.

www.expel.io 7
 Charting your course ... literally

OK. So now you’ve got a lot of data and you’re thinking “how the heck do
I analyze and interpret all of this data” and “how are my execs (who only
understand simple shapes and primary colors) going to understand this?”
You’re in luck. With this ”how to”, we’re releasing the Expel self-scoring tool
for NIST CSF. It’s an excel spreadsheet that’ll track all of your info and (bonus!)
it’ll autogenerate fancy shmancy radar charts for you.

The spreadsheet rolls up all of your scores areas that haven’t been a priority and large
for each subcategory into an average gaps between where you’re at and where
for the category that you can use to see you want to be.
exactly where you stand and where you
Now what? Well, it’s time to prioritize
want to be. You can see an example of the
and plan. Unfortunately, we don’t have a
type of graph the spreadsheet can create
spreadsheet to autogenerate that. Based
on the next page.
on your business needs and the types of
These graphs do a good job of highlighting risks you’re most concerned about, you’ll
the areas where you’re doing really well need to figure out what gaps you want to
(in this case, Identity: Governance) and work on and how you’re going to close
areas where you need to focus your efforts them. It’s important to set expectations
(Detect, Respond and Recover). Every (with yourself and up the chain). Closing
organization is different, so don’t let the gaps isn’t a short-term program. What
gaps freak you out. Remember that the usually emerges is a strategic plan with lots
CSF is an attempt to cover everything in of little pieces that fall into place along the
cyber risk management. So even in large, way.
mature organizations there are going to be

8 How to get started with the NIST Cybersecurity Framework (CSF)

 NIST Cybersecurity Framework Analysis: Current State vs. Goal
Q1 2018
Target

Asset Management
5
Business Environment

Governance Identify
4

Risk Assessment
Communications
3 Risk Management Strategy
Recover Improvements
2
Recovery Planning

1 Access Control

Awareness and Training

Improvement 0

Data Security
Mitigation Protect
Information Protection P&P
Respond Analysis

Maintenance
Communications

Protective Technology
Response Planning

Detection Anomalies
Security
Process and Events
Continuous
Monitoring

Detect

ProTip
Re-evaluate yourself quarterly. It’s a good way to check your progress, keep yourself honest
and tweak the plan if need be.

www.expel.io 9
 Using Expel to color in your CSF

As I mentioned before, we’ve gone through the exercise I outlined above

here at Expel. And we also use Expel to protect Expel. As a result, we’ve got
an idea of how Expel can impact CSF scores.

To understand the answer, first you need Quite the change. Now, let’s look at each
to understand a bit of what Expel does. In functional area.
short, our transparent managed security
service monitors your network 24x7, Detect
investigates bad activity and helps you Since Expel is a 24x7 service that detects
get the answers you need so you can bad and anomalous activities on your
respond to attackers and keep them out. network, it lifts all of the Detect scores
We do that by using your existing security across the board. Our detection and
technologies and ingesting the alerts they correlation capabilities, which our analysts
create into our Workbench to keep tabs and engineers are constantly refining,
on what’s happening in your network. No detect threats in your enterprise and
new endpoints to deploy, no complex present them to our analysts in a structured
integration. and consistent way, 24-hours a day, seven
days a week. So, it kinda makes sense that
Expel’s first-year impact outsourcing your security operations leads
to better scores in the Detect function.
For this example, let’s assume you’ve got a
reasonable set of existing security controls: Respond
you have antivirus on the desktop, a next- In the Respond functional area, Expel also
gen firewall of some sort and maybe even has a dramatic impact on each category.
some other intrusion detection product. Our remediation actions are the reason we
But you don’t have anyone whose job it can move the needle so much. When we
is to look at those systems. You’re hoping detect a potentially bad activity, we kick off
they’re defending your network and that an investigation. Our analysts look at the
they’ll sound a siren or blast a red light alerts, gather related data and if we find
when something is wrong. In that case, there’s something legit bad going on, we
your CSF graph may look a lot like the one declare it a security incident.
above. Now, let’s say you decide you want
But we don’t stop there. We also give you
to move to Expel and want to know what
remediation actions for each incident.
your scores would look like. Take a look at
These actions are concrete steps that
the chart on the next page.
you can take to address the threat,

10 How to get started with the NIST Cybersecurity Framework (CSF)

 Sample NIST CSF Analysis: Current State vs. With Expel
Q1 2018
Target
After Expel Asset Management
5
Business Environment

Governance Identify
4

Risk Assessment
Communications
3 Risk Management Strategy
Recover Improvements
2
Recovery Planning

1 Access Control

Awareness and Training

Improvement 0

Data Security
Mitigation Protect
Information Protection P&P
Respond Analysis

Maintenance
Communications

Protective Technology
Response Planning

Detection Anomalies
Security
Process and Events
Continuous
Monitoring

Detect

accompanied with our analysis and other Recover

supporting material. This process adds Expel impacts the Recover functional
consistency and technical completeness to area a bit less than Detect and Respond.
your incident response, so you can quickly Recover is focused on longer-term incident
address the attack and get back to running response issues like corporate lessons
your business. learned, updating plans, and reputation
management. That said, Expel still impacts
Our remediation actions allow you to
your Recover score since you’re more
stand on the shoulders of our world-class
informed about the incidents you’ve
platform and analysts, so you get a world-
experienced and the remediation steps
class response capability. It’s a huge lift in
you’ve taken. The net result is that your
an area where many organizations struggle
Recover activities are better informed and
to even get to a “three” despite years of
more mature.
trying.

www.expel.io 11
 Expel down the road As we get to know you as a customer,
we learn more about your systems and
Now, fast forward 12 months and let’s networks — including what’s normal and
look at what things look like after you’ve what’s not. Over time, we’ll uncover actions
been an Expel customer for a year. we think you should take to make your
Unsurprisingly, you’ll continue to make enterprise more resilient to attack. These
incremental improvements to Detect, resilience actions might be configuration
Respond and Recover as you continue changes on your firewall or data protection
to refine those functional areas. But now systems, user training to help with phishing
there are also big jumps in Identify and or removal of accounts with shared
Protect because over time Expel provides roles so you can audit more easily. Our
more and more impact in the early lifecycle analysts know a lot about security, and
functional areas.

Sample NIST CSF Analysis: Expel on day 1 vs. Expel on day 365
Q1 2018
Target
After Expel Asset Management
1 year later 5
Business Environment

Governance Identify
4

Risk Assessment
Communications
3 Risk Management Strategy
Recover Improvements
2
Recovery Planning

1 Access Control

Awareness and Training

Improvement 0

Data Security
Mitigation Protect
Information Protection P&P
Respond Analysis

Maintenance
Communications

Protective Technology
Response Planning

Detection Anomalies
Security
Process and Events
Continuous
Monitoring

Detect

12 How to get started with the NIST Cybersecurity Framework (CSF)

we feel you should be able to learn from
their expertise. We’ll send you resilience
actions whenever we uncover these
deeper concerns. Sometimes these “ah-
ha” moments will come in the middle of
Expel self-scoring
an incident. Other times, we might be out tool for NIST CSF
getting a cup of coffee when inspiration
strikes. Whenever we have an idea that’ll Score yourself in less than
help make your organization more secure, two hours
we’ll pass that along.
Get your own copy of
Really? Expel’s self-scoring tool for
the NIST CSF. It’s an Excel
I know it sounds too good to be true. And
I confess I’m a skeptical curmudgeon
spreadsheet that’ll allow you
so even I was surprised. But ... yes ... to capture where you are
really, Expel can help you rapidly close today and where you want
the gaps between where you are and to be tomorrow.
where you want to be from a security risk
management perspective. Bonus! It’ll also auto-
generate fancy schmancy
Heck, that’s why I work at Expel. I feel
radar charts for you.
strongly about helping businesses of
all sizes be more secure — not just
big companies with huge security and
risk programs. I think Expel is unique Get it!
in this regard and can provide a nearly
instantaneous lift for your security posture
for relatively little expense and time.

www.expel.io 13
 About Expel

Expel provides transparent managed security. It’s the antidote for companies
trapped in failed relationships with their managed security service provider
(MSSP) and those looking to avoid the frustration of working with one in the
first place.

Transparency is the unique bit. You get 24x7 access to our security analysts so
you can watch investigations as they’re unfolding and take action immediately
— all within a shared interface. Our analysts monitor your environment and
investigate suspicious activity using the security products you already own.
When we find a problem, we tell you exactly what to do about it including how
to fix the root cause of problems that happen over and over. To learn more,
check us out at www.expel.io

14 How to get started with the NIST Cybersecurity Framework (CSF)

 (this is the last page)

Expel provides transparent managed security. It’s the antidote for companies trapped in failed relationships with their
managed security service provider (MSSP) and those looking to avoid the frustration of working with one in the first
place. To learn more, check us out at www.expel.io.

© Expel, Inc.