Implementing security requirements: examples from the NIST 1800 series

I have recently developed a newfound appreciation for reading cybersecurity standards and guidelines. Their lack of practical examples and real-world scenarios, however, is a bit of a disappointment. There is very little out there on how to map controls and requirements from standards into the set of technologies that would implement them, or support/facilitate their implementation. I understand standards and regulations should not be prescriptive in what technology needs to be used. However, I believe implementation examples would go a long way in clearly illustrating what needs to be met and making it easier to understand. That’s why I like the NIST 1800 series!

In general, the starting point would be a control baseline that helps establish a relevant set of controls (a minimal set) based on the requirements and risk profiles of an organization. In fact, there are two fundamental aspects to consider here, which will likely affect the technology choice:

• A baseline would probably not address all of your security and privacy concerns. It is not a one-size-fits-all solution for every environment. Certain controls within a baseline might also be unnecessary. It is, therefore, essential to understand the requirements and characteristics of your organization’s systems to select the appropriate controls, i.e., scoping.
• These controls need further tailoring to produce a customized solution for your environment. NIST lists some of the factors that can be taken into account in tailoring: “Control baselines are tailored based on a variety of factors, including threat information, mission or business requirements, types of systems, sector-specific requirements, specific technologies, operating environments, organizational assumptions and constraints, individuals’ privacy interests, laws, executive orders, regulations, policies, directives, standards, or industry best practices.”

In essence, scoping focuses on selecting relevant controls, while tailoring adjusts these controls to suit the organization’s specific objectives, context, and operational needs. These steps are prerequisites for technology selection.

What technology for which control?

The main challenge in implementing controls is the identification of technologies, components, or equipment, that will best serve your requirements and integrate well with existing tooling and IT environments. This is usually done via a suite of products, whether commercial off-the-shelf (COTS) or open source that will help security teams and organizations address this challenge. While vendor and tools consolidation is on the rise, fragmentation may still be a big headache when trying to meet the intent of several controls or requirements. I touched upon that subject in my very first blog post.

One of the rare publications that addresses this issue is the NIST 1800 series, which presents practical security solutions intended to serve as a “how-to” guide on implementing cybersecurity capabilities and technologies in real-world scenarios. Part of what it does is map security requirements into example solutions and implementations, featuring a variety of vendors and technology partners that offer capabilities and security products to meet or support the needs of the system in question.

It is important to remember that these are example solutions! NIST doesn’t endorse or recommend used products or vendors, and they may not always be the best fit for every purpose. Nevertheless, the series provides a valuable indication of the types of technology that can be used to implement or enhance controls. There are currently 28 documents in this series. I have selected three of them addressing data integrity use cases:

• NIST 1800-11 on data integrity covering the recovery from ransomware or other destructive events.
• NIST 1800-25 on data integrity covering the identification and protection of assets against ransomware and other destructive events,
• NIST 1800-26 on data Integrity covering the detection and response to ransomware and other destructive events,

The tables below summarize the technologies used to achieve control objectives in those scenarios. They present security technologies, their categories and functions, and their NIST 800-53 control coverage. These would be used for comparing against control baselines, for instance, such as those outlined in NIST 800-53B (Low, Moderate, or High), or other standards’ controls or requirements using mappings or relationships between existing standards and guidelines, e.g., NIST 800-53 to ISO 27001.

One key element for me here was that building security platforms is largely about leveraging the flexibility of technologies to achieve different objectives. For example, the NIST 1800-26 practice guide mainly addresses Detect/Respond capabilities, while NIST 1800-25 focuses on Identify/Protect capabilities. This difference can be seen through their use of the Tripwire Enterprise/Semperis DSP pairing. In one case, these technologies are used to establish integrity baselines; in the other, they are used for integrity checks and monitoring. The main task of implementing security requirements is not only about the selection of technologies, but also how they can be tailored, configured, or integrated (in various ways) to support target cybersecurity functions and goals.