Cybersecurity Risk Management Ultimate Study Hub

Sections

Current Chapter:

NIST Overview

Framework Fundamentals

🔑 NIST Core Functions

Identify Protect Detect Respond Recover

🎯

NIST Cybersecurity Framework Overview

Mastering the Fundamentals of Risk Management

Core Functions: Identify • Protect • Detect • Respond • Recover

🛡️

Why Cybersecurity Risk Management?

• Cyber risks are unavoidable and must be actively managed
• Cannot eliminate all risks—must prioritize protection
• Requires involvement from leadership to employees
• Embed cybersecurity into organizational culture

📐

NIST Framework Components

Framework Core: 5 key functions (ID, PR, DE, RS, RC)

Implementation Tiers: Partial → Risk Informed → Repeatable → Adaptive

Framework Profile: Customized to business needs

⭐

The 5 Core NIST Functions

🔍

IDENTIFY

Assets, risks, governance

🛡️

PROTECT

Safeguards, controls

👁️

DETECT

Monitoring, anomalies

⚡

RESPOND

Incident handling

🔄

RECOVER

Restore operations

🔍

IDENTIFY Function

• Asset Management: Inventory all devices, systems, software
• Governance: Educate management on cyber risks
• Risk Assessment: Document vulnerabilities and threats
• Focus on highest risks first

🛡️

PROTECT Function

• Access Control: Least privilege, MFA, separation of duties
• Data Security: Protect data at rest and in transit
• Processes: Patch management, backups, config management
• Training: Security awareness programs

👁️

DETECT Function

• Baseline: Establish normal network/user behavior
• Tools: IDS, EDR, centralized logging, vuln scanning
• Continuous Monitoring: Mission-critical systems
• Formalized Processes: Clear roles for detection

⚡

RESPOND Function

• Response Planning: Actionable plan with assigned responsibilities
• Communications: Internal/external, protect reputation
• Analysis: Investigate, gather evidence, classify impact
• Mitigation: Contain incidents, manage vulnerabilities

🔄

RECOVER Function

Disaster Recovery

Restore functions after incidents

Business Continuity

Essential operations continue during events

Recovery Phases

Activation → Execution → Reconstitution

🔗

Supply Chain Risk Management (SCRM)

Establish Processes

Develop SCRM procedures

ID Suppliers

Prioritize high-risk partners

Contracts

Security requirements + audits

Joint Testing

Test with high-risk suppliers

📊 NIST Framework Diagrams

Visual representations of key concepts

NIST Cybersecurity Framework Cycle

NIST
CSF

🔍 IDENTIFY

🛡️ PROTECT

👁️ DETECT

⚡ RESPOND

🔄 RECOVER

Continuous cycle of cybersecurity risk management

Implementation Tiers (Maturity Levels)

Tier 1

PARTIAL

Ad-hoc, reactive

→

Tier 2

RISK INFORMED

Aware but informal

→

Tier 3

REPEATABLE

Formalized policies

→

Tier 4

ADAPTIVE

Continuously improving

📋 NIST Overview Key Concepts

Essential terms and definitions

Framework Core Functions (Mnemonic: "I P D R R")

Identify

Protect

Detect

Respond

Recover

Key Definitions

Vulnerability

An exploitable weakness in a system

Threat

Actor or tool that exploits vulnerabilities

Risk

Likelihood × Impact of a threat exploiting a vulnerability

Control

Safeguard to reduce risk

Recovery Phases

1️⃣

Activation

Initiate recovery procedures

2️⃣

Execution

Perform recovery operations

3️⃣

Reconstitution

Return to normal operations

🎯 NIST Overview Quiz

Test Your Framework Knowledge

1. How many core functions are in the NIST Cybersecurity Framework?

2. What is the highest implementation tier in NIST?

3. Which NIST function focuses on inventorying assets and assessing risks?

4. What are the three recovery phases?

📋

Chapter 1: Cybersecurity Risk Planning

Strategic approaches to identify and mitigate cyber threats

NIST Risk Management Process • Asset Management • Governance

😱

Case Study: Joanna's Nightmare

Scenario: Critical network failure during a crisis

❌ No Documentation

Can't access device specs

❌ Communication Gap

CEO demands answers

❌ No Response Plan

Is it a cyberattack?

Lesson: Well-documented assets and response plans are ESSENTIAL!

📖

What is CSRM?

Cybersecurity Risk Management is:

• Continuous: Ongoing, proactive process
• Organization-wide: All levels must engage
• Accountable: Clear risk ownership
• Balanced: Risk tolerance vs. business goals

🔄

NIST Risk Management Process

1. FRAME Define risk appetite with leadership

2. ASSESS Identify assets, evaluate vulnerabilities

3. RESPOND Prioritized action plans

4. MONITOR Evaluate controls, adapt to threats

📦

Asset Management & Inventorying

• Physical: All IP-addressable devices
• Software: Track versions, unauthorized apps
• Tools: Spreadsheets or CMDBs
• Prioritization: Classify by value and risk

CMDB = Configuration Management Database

🏛️

Governance & Management Education

• Governance: Sets policies and oversight
• Education: Executives must understand risks
• Steering Committees: Guide resource allocation
• Compliance: Adhere to legal standards

⚠️

Risk Assessment & Threat ID

• Starts with hardware/software inventory
• Vulnerabilities: Exploitable weaknesses
• Threats: Actors or tools exploiting them
• Use automated tools, vendor alerts, NIST framework

📝

POAMs (Plans of Action & Milestones)

• Define steps, timelines, responsibilities
• Address prioritized risks efficiently
• Engage stakeholders for alignment
• Test via drills; update based on feedback

📊 Chapter 1 Diagrams

Risk Management Process Visualizations

NIST Risk Management Cycle

FRAME

Define risk
appetite

→

ASSESS

Identify
vulnerabilities

→

RESPOND

Action
plans

→

MONITOR

Evaluate
controls

🔄

Continuous cycle

Risk Prioritization Matrix

Likelihood ↓

Low Impact

Med Impact

High Impact

High

Medium

High

CRITICAL

Medium

Low

Medium

High

Low

Very Low

Low

Medium

High-risk issues get immediate attention

📋 Chapter 1 Key Concepts

Risk Planning Essentials

NIST Risk Process (Mnemonic: "FARM")

🖼️

Frame

📊

Assess

💪

Respond

👁️

Monitor

Asset Management Checklist

✅ Inventory all IP-addressable devices

✅ Track software versions

✅ Use CMDB or spreadsheets

✅ Classify by value and risk

✅ Include cloud components

✅ Define personnel roles

POAM Components

📌 Steps: What actions to take
📌 Timelines: When to complete each step
📌 Responsibilities: Who is accountable
📌 Resources: Budget and tools needed
📌 Testing: Validate via drills

🎯 Chapter 1 Quiz

Risk Planning & Management

1. What are the 4 steps in NIST's Risk Management Process?

2. What does CMDB stand for?

3. What is the key lesson from Joanna's Nightmare case study?

4. What does POAM stand for?

5. In the "Frame" step, what do you define with senior leadership?

🔐

Chapter 2: NIST Protect Function

User and Network Infrastructure Planning & Management

Access Control • Data Security • Training • Maintenance • Protective Technology

🔑

Case Study: Alan's Super-User Account

Scenario: Major Motors suffers severe data loss

What happened:

• Keylogger on Alan's home computer
• Captured temporary super-user credentials
• Credentials never deactivated after use

Key Lessons:

✅ Deactivate temp accounts immediately
✅ Proper credential lifecycle management
✅ Monitor privileged account usage

🛡️

NIST Protect Function Categories

Access Control

Awareness & Training

Data Security

Info Protection

Maintenance

Protective Tech

🔐

Authentication vs Authorization

Authentication

Verifies WHO you are (credentials, MFA)

Authorization

Determines WHAT you can access

⚖️

Key Access Principles

Least Privilege

Only access necessary for the role

Separation of Duties

Critical tasks divided between individuals

📱

Multi-Factor Authentication (MFA)

Requires 2+ factors:

🧠

Know

Password

📱

Have

Device/Token

👆

Are

Biometric

🔌

Network Segmentation & Firewalls

• Segmentation: Separates resources, blocks unauthorized traffic
• Firewalls: Enforce segmentation rules
• Reduces breach impact (lateral movement)
• Regular policy audits required

💾

Data Security

Data at Rest

Cryptography, file-share scanning, WORM media

Data in Transit

Encrypt communications (TLS/SSL)

🎓

Training & Awareness

• Understand user roles in security
• Focus on phishing, data protection, privacy
• Use phishing assessments as training tool
• Ongoing, role-specific programs

⚙️

Baseline & Configuration Management

• Baseline: Document IT/OT system specs
• Apply least privilege, least functionality
• Configuration Manager: Controls changes
• Verification Manager: Maintains integrity

🔧

Patch Management & Backups

• Apply vendor updates carefully (balance urgency vs downtime)
• Use automated tools to prioritize critical patches
• Perform frequent off-site backups
• Test backups regularly for ransomware resilience

🏢

Business Continuity Planning

• Ensure operations continue during incidents
• Establish communication protocols
• Plan for employee relocation if needed
• Regular reviews to adapt to new threats

🛠️

Protective Technology Best Practices

Restrict Media

Limit removable devices (USB)

Minimal Function

Enable only essential services

Avoid Multi-Service

Don't host multiple services on one device

Resilience

Fail-safe, load balancing, hot-swap

📊 Chapter 2 Diagrams

Protect Function Visualizations

Defense in Depth (Layered Security)

🌐 Perimeter (Firewalls, IDS)

🔌 Network (Segmentation, VPN)

🖥️ Host (Endpoint, AV)

📦 Application

💾 Data

Multiple layers of protection around critical data

Credential Lifecycle Management

➕

CREATE

→

✅

USE

→

🔄

MAINTAIN

→

🗑️

DEACTIVATE

⚠️ Key: Deactivate temporary accounts IMMEDIATELY after use!

📋 Chapter 2 Key Concepts

Protect Function Essentials

Protect Categories (Mnemonic: "AAD IPM PT")

Access Control

Awareness & Training

Data Security

Info Protection

Maintenance

Protective Tech

Authentication vs Authorization

Authentication	WHO are you? (Identity verification)
Authorization	WHAT can you do? (Access levels)

MFA Factors (Something you...)

🧠

KNOW

Password, PIN

📱

HAVE

Phone, Token

👆

ARE

Fingerprint, Face

Key Security Principles

Least Privilege: Minimum necessary access

Separation of Duties: No single person has full control

Defense in Depth: Multiple security layers

Least Functionality: Only essential services enabled

🎯 Chapter 2 Quiz

Protect Function Mastery

NIST Cybersecurity Framework Overview

Why Cybersecurity Risk Management?

NIST Framework Components

The 5 Core NIST Functions

IDENTIFY Function

PROTECT Function

DETECT Function

RESPOND Function

RECOVER Function

Supply Chain Risk Management (SCRM)

📊 NIST Framework Diagrams

📋 NIST Overview Key Concepts

Framework Core Functions (Mnemonic: "I P D R R")

Key Definitions

Recovery Phases

🎯 NIST Overview Quiz

1. How many core functions are in the NIST Cybersecurity Framework?

2. What is the highest implementation tier in NIST?

3. Which NIST function focuses on inventorying assets and assessing risks?

4. What are the three recovery phases?

Chapter 1: Cybersecurity Risk Planning

Case Study: Joanna's Nightmare

What is CSRM?

NIST Risk Management Process

Asset Management & Inventorying

Governance & Management Education

Risk Assessment & Threat ID

POAMs (Plans of Action & Milestones)

📊 Chapter 1 Diagrams

📋 Chapter 1 Key Concepts

NIST Risk Process (Mnemonic: "FARM")

Asset Management Checklist

POAM Components

🎯 Chapter 1 Quiz

1. What are the 4 steps in NIST's Risk Management Process?

2. What does CMDB stand for?

3. What is the key lesson from Joanna's Nightmare case study?

4. What does POAM stand for?

5. In the "Frame" step, what do you define with senior leadership?

Chapter 2: NIST Protect Function

Case Study: Alan's Super-User Account

NIST Protect Function Categories

Authentication vs Authorization

Key Access Principles

Multi-Factor Authentication (MFA)

Network Segmentation & Firewalls

Data Security

Training & Awareness

Baseline & Configuration Management

Patch Management & Backups

Business Continuity Planning

Protective Technology Best Practices

📊 Chapter 2 Diagrams

📋 Chapter 2 Key Concepts

Protect Categories (Mnemonic: "AAD IPM PT")

Authentication vs Authorization

MFA Factors (Something you...)

Key Security Principles

🎯 Chapter 2 Quiz

1. What is the difference between authentication and authorization?

2. What are the three factors in Multi-Factor Authentication?

3. What does "Least Privilege" mean?

4. In Alan's case study, what was the root cause of the breach?

5. What does "Separation of Duties" prevent?

6. What is the purpose of network segmentation?

7. Why should you regularly test backups?