Cybersecurity, Technology, and Society

Write-Ups:

Discussion Board:

From your readings of pages 1-21 of the NIST Cybersecurity Framework Links to an external site., what benefit can organizations gain from using this framework, and how would you use it at your future workplace?

The NIST Cybersecurity Framework serves as a detailed guide for companies to organize and shrink their cybersecurity dangers.  This framework helps organizations adapt their security system to different work environments and company types.  The framework helps companies sort out and focus on their main cybersecurity hazards, reinforces their defenses, and trains them to find, fight off, and fix cyberattacks.  Furthermore, companies must obey rules while earning customers’ confidence by showing they take online protection very seriously.  I would apply NIST Cybersecurity Framework rules to create a step-by-step guide to growing better security processes at my future work location.  We’ll begin by checking how close our company is to the key steps defined by the framework: identify, protect, detect, respond, and recover.  When I first join the team, I will examine vital company assets alongside possible threats to map out our security risks.  Following our analysis, I would partner with the team to build security mechanisms along with access restrictions and encryption before actively watching for any threats.  Regularly checking and making changes to the framework will help the organization stay ready for new security dangers as they appear.  Using this approach would help build a workplace that prioritizes early security response before and after risky situations.

Response 1

Hi, Ethan! Your analysis shows well that NIST’s Cybersecurity Framework benefits organizations in all sectors through its flexible use. I say the NIST Cybersecurity Framework works because its five parts—Identify, Protect, Detect, Respond, and Recover—show how to respond in order and stop threats. I thought what stood out was how the framework helps both technical experts and managers talk to each other using the same language. Good communication between these different groups is really needed because most workplaces struggle with getting them to work well together when it comes to security. Your idea to employ the framework both to evaluate progress and to sort out what parts to focus on first is very well thought out. Using it shows that cybersecurity benefits both productivity and business strategy. Using the framework to link different teams together strengthens their joint security work, as you described. You use the framework with clear application skills that will boost your career growth.

Response 2

Hi, Isaac!  Your post brings out the NIST Cybersecurity Framework in logical steps while showing how to put it into practice.  Before starting with the framework, companies need to understand their goals, policies, and history to build cybersecurity measures that match their unique requirements.  You’re right to make profile building and full risk checking your top priorities because they’re both key steps in preventing cybersecurity problems.  You should add how you would keep track of and adjust your cybersecurity plan moving forward.  There are web threats that evolve regularly, which requires us to review our framework updates.  Keeping this cycle of ongoing improvement built into your plan will make it even better.  Your plan shows that you know how to use the framework correctly in workplaces!

In this discussion board, you are the CISO for a publicly traded company. What protections would you implement to ensure the availability of your systems (and why)?

Publicly traded companies need their system availability protected by the Chief Information Security Officer because operational success depends on it and prevents monetary losses and bad publicity.  I will establish multiple essential measures to reach this objective.  Downtime reduction will be achieved through simultaneous application of failover clusters along with data centers distributed across different geographical areas together with duplicate infrastructure systems.  Emergency data recovery can be executed swiftly through regular backups together with a satisfactory disaster recovery plan named DRP, which handles ransomware attack situations.  The implementation of DDoS protection and network resilience measures would shield the organization against damages that result from malicious online traffic.  Regular testing of a business continuity plan along with its recovery time objectives (RTOs) serves to maintain business operations during emergency situations.  Real-time security threat detection together with threat mitigation occurs immediately because of automatic patch management alongside persistent monitoring by a twenty-four-seven Security Operations Center (SOC).  The combination of employee training programs and third-party risk management activities would best support availability by preventing human mistakes while monitoring critical external relationships.  Multiple joint defensive measures will support the continued reliability of our systems throughout all operational hours.