Control Selection – Cyber security Risk Compliance

Review the Verizon Breach report for 2019. I would start on page 5. Consider the different breaches of a particular category – social attacks, or stolen credentials, or nation-state, or … – you choose, and then dig into the report to learn more about the breaches of that type.

Now consider a company with a basic control set – say the first 6 of the CIS 20 security controls. What additional controls would have helped prevent or mitigate the impact of that breach? You are not limited to the CIS Critical Security Controls. Feel free to use any control in NIST 800-53 as well.

Consider the Cyber Security Framework, and the five stage – Identify, Protect, Detect, Respond Recover and how the controls you have selected fit into that framework.

Now, write an analysis that describes the characteristics of that category of breach, the vulnerabilities that permit that breach and the type of assets typically at risk. You do not need to consider a threat vector. You can assume one exists as there have been breaches.

Now present a set of controls meant to minimize the likelihood and/or impact of that type of attack on an organization (this can be a generic organization or one of your choosing). In other words – how will these controls minimize the success or impact of a threat actor exploiting these vulnerabilities to impact assets.

Present these controls in the structure of the CSF five stages.

The length of the paper is not important to me, but will be several pages if you do a thorough job of analyzing the threat, selecting controls and putting them within the framework.