A framework for securing internal business-critical infrastructure services : A structured approach for reducing systemic security gaps
Tero Hannula · Theseus (Ammattikorkeakoulujen) · 2018
The objective of the research was to develop a framework for protecting business-critical digital infrastructures and services by ensuring adequate coverage of defence and avoiding systemic security problems during implementation. The framework can support teams responsible for a digital infrastructure and improve their capability to identify and deal with threats in an autonomous fashion. The framework can also be used as a supplementing tool to help understand and deal with threats when implementing an information security standard or another security framework. The framework collects threats into nine classes, covering areas from physical security to organizational issues. The threats were collected in an internal brainstorming session, from ENISA cyber threat taxonomy, and from Lockheed Martin’s Cyber Kill Chain attack model. In addition, three targets were created for understanding the threat environment, human labour and system functionality. The targets contain controls and other defences linked to goals that define the desired long-term security outcomes, forming a clear three-layer structure for the framework and securing digital infrastructures. It can then be implemented to meet specific needs of each organization. The coverage of the framework was assessed by benchmarking control lists of ISO 27001 and CIS controls against the areas in this framework. The benchmarking showed that the references do not cover the areas in this framework completely, and in some areas the coverage is almost non-existent. Examples of these areas are accidental human errors and issues in supply chain security. These areas have played a significant role in major breaches during the recent years. Implementing the framework could help to identify the problems in these areas and resolve them.