True or False: Cyber criminals would rather target large enterprises than small businesses.
Answer: FALSE!
One of the most pervasive myths about cybersecurity is the assumption that small businesses are less popular targets for malicious actors than large enterprises. However, even though major data breaches make up most of what we see in the news headlines, small businesses are actually very attractive targets for attackers. Cybercriminals often view them as relatively easy marks who still have plenty of data worth stealing.
NIST Cybersecurity Framework | NIST CSF
The NIST Cybersecurity Framework was originally intended to drive innovation and improve risk management within critical infrastructure organizations in the US. It has since become one of the global standards in cybersecurity. That said, achieving full compliance with the framework can be complicated, time-consuming, and costly. Fortunately, NIST offers a wealth of helpful resources to help make the process a little less arduous.
1. Official Publications as a Resource
The obvious place to start is the institute’s official publications, including the NIST Cybersecurity Framework documentation itself. In addition to the official framework, there are over a thousand other publications on the topic of cybersecurity aimed at different technology environments and industries. For example, there is a guide on mobile device security, one specifically on risk management, while yet another covers incident recovery.
2. Information Technology Laboratory
The Information Technology Laboratory is the go-to resource center for specific guidelines on all key areas of cybersecurity. Their library also contains all the information and resources needed to achieve compliance with various NIST special publications. The resources are conveniently divided into three main series.
- The 500 series details cybersecurity controls and standards that all businesses should adhere to, such as multifactor authentication and cloud computing safety.
- The 800 series provides resources to help businesses align with US government information security standards, which is crucial for defense contractors and businesses involved in critical infrastructure.
- Finally, the 1800 series provides operational resources, including guidance on creating your own internal cybersecurity policies and standards.
3. Cybersecurity Priority Areas
NIST currently lists five priority areas that reflect the most important technology challenges in the world today.
- Cybersecurity,
- the Internet of Things (IoT),
- Artificial Intelligence (AI),
- Reliable Computing, and
- Future Computing Technologies and Applications.
Of these five, only the first three are currently available, with the remaining two listed as "coming soon." These priority areas are intended to encourage innovation without adding risk. For example, the IoT priority area covers topics like the design and implementation of internet-connected smart technologies, while the AI topic area deals more with research and development.
4. Computer Security Resource Center
The Computer Security Resource Center is a one-stop resource for everything related to IT security. It's regularly updated to reflect current threats and trends, such as ransomware and operational technology vulnerabilities. In addition to news and updates, you’ll find numerous publications, projects impacting information security, and a list of events you can participate in. There are six main topic areas featuring, including –
- Security and Privacy,
- Applications,
- Technologies,
- Laws and Regulations,
- Activities and Products, and
- Industry Sectors.
There’s also a helpful glossary of IT and cybersecurity terminology, which will help you get up to speed with these complex topics.
5. NIST Small Business Center
NIST small business compliance might seem like a lofty goal, but the Small Business Cybersecurity Corner provides a wealth of material to help you and your business on your journey toward compliance. Whereas the aforementioned resources cater to businesses of all sizes, this resource takes into consideration the unique challenges that come with operating a small business. There is a complete introduction to cybersecurity alongside extensive planning guides to help you assess your current security measures and training materials with guidance by topic area.
Achieving NIST Small Business Compliance
The reality is that the NIST Cybersecurity Framework is extremely broad and exhaustive in its approach. Attempting to achieve full compliance with the framework can be a huge task for a small business unless you have a fully staffed IT security team. For this reason, the best approach is to find the right partner who can guide you through the process and help you implement the best-in-class security processes and controls for your business.
Charles IT provides the full range of services that businesses need to become fully compliant with the NIST Cybersecurity Framework. Get in touch today to schedule your first consultation!
Editor's Note: This post was originally published in September 2021 and has been updated for accuracy and comprehensiveness.
