x
x
x

Framework Core

The Framework Core consists of common cybersecurity activities and goals. It is comprised of five concurrent and continuous functions representing activities that assist with defining and implementing the cybersecurity program. The functions are Identify, Protect, Detect, Respond, and Recover.

Functions are subdivided into categories representing cybersecurity goals which tie agency and security needs to desired outcomes. Examples of categories include Asset Management, Access Control, and Detection Processes.

Categories are further divided into subcategories that provide specific outcomes of technical and/or management activities. Examples of subcategories include External information systems are catalogued, Data-at-rest is protected, and Notifications from detection systems are investigated.

Detect

The Detect Function describes activities will help an agency to develop and implement the appropriate safeguards to identify cybersecurity events. These activities will enable timely discovery of potential cybersecurity events to allow for immediate recovery responses.

Anomalies and Events

DE.AE

Detecting anomalous activity in a timely manner and understanding the potential impact.

  1. Create and manage a baseline of network operations (i.e. a documented reference of the normal everyday working state of the network) and expected data flows (i.e. a representation of the way data should "flow" through an information system, network, or between users) for users and systems.
  2. Analyze detected cybersecurity events to understand why targets were attacked and the methods used.
  3. Collect, combine, and compare cybersecurity event data from multiple sources and sensors (e.g. a series of sensors to monitor liquid leaks, temperature and humidity levels, smoke, etc.).
  4. Determine the impact of cybersecurity events to information systems, the network, and users.
  5. Establish incident alert thresholds (i.e. the point at which an incident alert is generated).

Security Continuous Monitoring

DE.CM

Monitoring information systems and assets at discrete intervals to identify cybersecurity events and verify the effectiveness of protective measures.

  1. Monitor the network to detect potential cybersecurity events.
  2. Monitor the physical environment to detect potential cybersecurity events.
  3. Monitor personnel activity to detect potential cybersecurity events.
  4. Detect malicious code (i.e. any code in any part of a software system or script that is intended to cause undesired effects, security breaches, or damage to a system or network (e.g. virus, worm, etc.)) .
  5. Detect unauthorized mobile code (i.e. any program, application, or content capable of automatically executing or completing an action, without the user directly or knowingly authorizing the action. Malicious code is typically embedded in an email, document, or website).
  6. Monitor external service provider activity to detect potential cybersecurity events.
  7. Monitor for unauthorized personnel, connections, devices, and software.
  8. Perform vulnerability scans.

Detection Processes

DE.DP

Maintaining and testing detection processes and procedures (e.g. using vulnerability scans, intrusion detection and prevention systems, audit monitoring, etc.) to ensure timely and adequate awareness of anomalous events.

  1. Define roles and responsibilities for detection to ensure accountability.
  2. Detection activities must comply with all applicable requirements.
  3. Ensure detection processes are regularly tested.
  4. Ensure that event detection information (e.g. vulnerability scan results, audit records analysis, etc.) is communicated to appropriate parties.
  5. Ensure detection processes are continuously improved.
⇡