Secure State IT and the Cyber Defense Matrix
Navigating the pool of technology vendors is overwhelming even for an IT professional.
The 5×5 matrix plots the five business critical assets on the Y axis and NIST’s five core functions on the X axis: Identify, Protect, Detect, Respond, and Recover. At the bottom it includes a gradient for dependencies. On the left side of the matrix there are functions better executed by technology and on the right side are areas where human expertise becomes more critical.
(see pictures from book cyber defense folder on desktop)
- Column 1 is all about Identifying and Inventorying. You can not protect that which you do not know.
- Devices: make a list of anything connected to the nework: Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, etc.
- Applications: What applications does the business use? How do they handle data?
- Network:
- Data: Data flow diagrams. Where does the data go? you will be surprised
- Users: Who has access and to what? Are old accounts pruned off?
- Column 2 is all about protection. Now that we have identified what we have we need to protect it.
- Devices: Physically and virtually
- Applications: External and internal facing
- Network: LAN and WAN
- Data: Ransomware
- Users: Who has access and to what? Are old accounts pruned off?
- Column 3 is all about detection. Protection is only good if we are notified of the detection .
- Devices:
- Applications:
- Network: intrustion d
- Data: exfiltration
- Users:
- Column 4 is after boom and about responding.
- Devices:
- Applications:
- Network:
- Data:
- Users:
- Column 5 is after boom and about recovering.
- Devices:
- Applications:
- Network:
- Data:
- Users:
