Ruslan Rakhmetov, Security Vision
The authority of the American institute NIST (National Institute of Standards and Technology) among information security specialists is virtually unquestionable. For many years, NIST documents (special publications and standards) have been used by the global cyber security community to build logically interconnected, transparent, measurable processes for information security and cyber risk management.
NIST operates the Information Technology Laboratory ( ITL), one of six research laboratories at NIST dedicated to information technology research and standards. The ITL includes the Computer Security Division ( CSD), which maintains the Computer Security Resource Center ( CSRC ), a web portal dedicated to information security projects and publications.
Among other things, this resource publishes documents being developed by the various working groups:
- Special Publications (SP) 800 series, which are recommendations, guidelines, technical specifications, and annual reports on information security issues within NIST's competencies;
- Special Publications (SP) 1800 series, which provide practical cybersecurity tips and solutions that illustrate the application of standards and best practices.
To date, more than 230 800- and 1800-series Special Publications have been published on the CSRC portal. Below are the most interesting documents in our opinion with brief descriptions and references.
SP 800-213 ‘IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements’ is devoted to assessing the cyber risks of IoT devices and developing information security requirements for IoT devices, device manufacturers, and third parties.
The document SP 800-40 Rev. 4 (Draft) ‘Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology’ describes typical complexities in patch management processes for large infrastructures and provides recommendations for simplifying and structuring these activities.
The document SP 800-161 Rev. 1 (Draft) ‘Cybersecurity Supply Chain Risk Management Practices for Systems and Organisations’ provides guidance on identifying, assessing and mitigating supply chain cyber risks by incorporating this risk into corporate risk management procedures and creating strategies, plans, policies and rules for assessing supply chain attack risks.
SP 800-218 (Draft) ‘Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities’ provides recommendations for using the Secure Software Development Framework, a set of high-level secure software development practices that can help reduce the number of vulnerabilities in code, reduce the potential damage from exploitation, and address the root causes of vulnerabilities.
The document SP 800-50 Rev. 1 (Draft) ‘Building a Cybersecurity and Privacy Awareness and Training Program’ is still under discussion and, once published, will address such an important topic as the proper organisation of cybersecurity and privacy awareness training.
The document SP 800-47 Rev. 1 ‘Managing the Security of Information Exchanges’ provides guidance on building information exchange processes without reference to specific technologies and data channels, focusing on identifying information exchange processes, protecting information, and fulfilling agreements between exchange participants.
SP 800-82 Rev. 2 ‘Guide to Industrial Control Systems (ICS) Security’ provides recommendations for securing automated control systems, SCADA-systems, programmable logic controllers (PLCs), distributed control systems taking into account specific risks and requirements for safety and reliability. Currently, the 3rd edition of this document is under discussion.
SP 1800-22 (Draft) ‘Mobile Device Security: Bring Your Own Device (BYOD)’ provides cybersecurity guidance for implementing BYOD in the enterprise, with practical examples and specific technologies.
SP 1800-33 (Draft) ‘5G Cybersecurity’ is under development and will focus on handling cyber risks in 5G networks in a technology-specific manner.
Document SP 800-53 Rev. 5, ‘Security and Privacy Controls for Information Systems and Organizations,’ is a fundamental list of all the various protective measures (technical and organisational) that should be implemented for information security and cyber risk management, and is referenced by many other documents in the NIST SP 800 series.
SP 1800-25 ‘Data Integrity: Identifying and Protecting Assets Against Ransomware and Other Destructive Events’, SP 1800-26 ‘Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events’: Detecting and Responding to Encryption Viruses and Other Destructive Events’ and SP 1800-11 “Data Integrity: Recovering from Ransomware and Other Destructive Events”: Recovering from Ransomware and Other Destructive Events’ provides practical guidance on dealing with cryptolockers, with specific cyberattack scenarios and incident response techniques.
Document SP 800-55 Rev. 1 ‘Performance Measurement Guide for Information Security’ suggests evaluating information security performance based on metrics to determine the adequacy of security measures, policies and procedures in place. The 2nd edition of this document is currently being prepared for release.
SP 800-207 ‘Zero Trust Architecture’ describes the concept of zero trust network architecture and provides examples of how it can be used to improve enterprise information security.
SP 800-210 ‘General Access Control Guidance for Cloud Systems’ describes the principles of access control for cloud infrastructures with specifics for each of the service models (IaaS, PaaS, SaaS).
The document SP 800-124 Rev. 2 (Draft) ‘Guidelines for Managing the Security of Mobile Devices in the Enterprise’ provides guidelines for securing mobile devices, describing possible strategies and technologies to protect them throughout their lifecycle.
SP 800-128 ‘Guide for Security-Focused Configuration Management of Information Systems’ provides a structured approach to IT configuration management with a focus on security and monitoring to mitigate cyber risks and ensure the required level of service functionality.
Document SP 800-177 Rev. 1 ‘Trustworthy Email’ addresses email security technologies such as SPF, DKIM, DMARC, STARTTLS, MTA-STS, and the use of PGP and S/MIME to ensure the confidentiality of email correspondence.
