The AIVD approach discusses four supporting pillars: context analysis, resistance, detection, and damage limitation. At Fundaments, we have established 5 similar pillars based on the NIST Cybersecurity Framework: identify, protect, detect, respond, and recover. With the corresponding Fundaments services, you can address each of these pillars (and therefore those of the AIVD) and take appropriate measures against a cyberattack. How? You can read about it below.
1. CONTEXT ANALYSIS (IDENTIFY)
Many organizations do not know where they stand when it comes to cybersecurity and security. Yet this is quite essential, because to properly secure a Cloud environment and thus an organization, it is important to know exactly what the current status of the security level is. What does your Cloud environment look like? Which part of this is critical for business processes? Where are any weak spots? The AIVD calls this context analysis. At Fundaments, we refer to this as identify. Gaining insight is of great importance, or in other words: identifying what is there, what needs to be protected, and where the potential risks lie. For these issues, Fundaments offers the Vulnerability Management service. With this solution, you get exactly what the AIVD points to, namely:
- Insight into threats
- Insight into your crown jewels
- Insight into your infrastructure
- Simple method for risk analysis
Want to know more? Read our blog article about identify.
2. RESISTANCE (PROTECT)
Actually protecting and therefore taking measures for the right security falls under the resistance pillar, or as Fundaments calls it: protect.
Based on our Cloud expertise, Fundaments can offer a number of measures to optimally protect every Cloud environment, for example by implementing Next Generation Firewalls. In addition, a simple, highly effective measure is available for filtering attack traffic: the DDoS scrubbing center. This makes it possible to filter (scrub) attack traffic and pass on legitimate traffic. This ensures you are optimally protected against DDoS attacks. Finally, there is a service to protect data by placing it in a second, physically separate, and secure location: Back-up as a Service.
Want to know more? Read our blog article about protect.
3. DETECTION (DETECTION & RESPONSE)
Monitoring the security measures taken and identifying cybersecurity incidents in a timely manner is what the AIVD calls: detection. At Fundaments, we use the same term here. Additionally, Fundaments sees an important role for subsequently responding to an incident: response.
Every year, many organizations are hacked or experience a data breach. On average, hackers have free rein for months until these hacks and data breaches are discovered, if they are discovered at all. Even companies that spend thousands of euros on digital security have no idea if a hacker is present on their network. Detection is all about implementing and developing measures to identify a cybersecurity incident (and thus hackers) in time. Fundaments has a simple solution for this: a digital bait bike.
Everyone knows the concept of the bait bike. The police park bikes in places where they are often stolen. The bait bikes have a tracking system. As soon as a bike thief takes the bike, the police can track down the suspect. In the Cloud world, there is also a digital bait bike: these are called Honeypots. Honeypots are used to lure and keep hackers and virus creators busy. The Honeypot can pose as a normal server or network device and has been intentionally made vulnerable to hacker attacks. The Honeypot forms a source of information about new viruses, threats, and the hacker. Such a digital bait bike is often used for investigations and is a proven effective alarm system for companies.
In 'Defensible network, how do you do that?', the General Intelligence and Security Service (AIVD) advises that in addition to good security on endpoints (servers and laptops), you should also place Honeypots in your network to track down attackers who work cautiously.
If an alarm then goes off, it is important that all kinds of processes and procedures are in place to respond to this quickly. What does the incident management process look like? Is support prepared for all the calls and alerts? Are the right people working in the right places to deal with this? There must be an answer to all these types of questions. In addition, forensic investigation and searching for the right insights to resolve the incident are crucial.
Fundaments works with partners who can completely unburden you and advise you on these issues. These specialists are 100% focused on their core services, namely: security response. The specialists can help with all kinds of security issues, such as a SIEM/SOC solution, forensic investigation, analytics, 24/7 incident response, and much more.
Want to know more? Read our blog article about detect or respond.
4. DAMAGE LIMITATION (RECOVER)
After a security incident has occurred, been identified, and action has been taken, it is possible that your Cloud environment is still damaged or compromised. To return to a working situation, it is important to be prepared for this. It is crucial that the data from your Cloud is secured and you are prepared to return to a situation before the security incident took place. At Fundaments, we call this: recover. The AIVD refers to this as damage limitation.
Fundaments offers two solutions to restore a Cloud environment to a normal situation before a cybersecurity incident occurred: BaaS (Back-up as a Service) & DRaaS (Disaster Recovery as a Service). Two primary questions are important here: how quickly am I back online and how much data can I afford to lose? Thanks to Fundaments, you can be back online within seconds if necessary, with minimal data loss.
Want to know more? Read our blog article about recover.
Curious about what Fundaments can do for your organization? Call 088 4227 227 or email info@fundaments.nl.
