[Research Effort]: Lack of Cyber Resilience OSCAL control profile to assess and protect High Value Targets #41
Labels
Step 1 - Initiation
This research effort issue requires review and consideration.
Problem Statement
High Value Targets (HVTs) are information systems for which unauthorized access, use, disclosure, disruption, modification, or destruction could cause a significant impact to an organization’s ability to perform its mission or conduct business. NIST 800-160 and MITRE CREF define a set of defensive controls (a subset of NIST 800-53, for which profiles are already in place) however they fail to be applied by the cybersecurity community because of their complexity and lack of regulator interest to mandate (possibly again due to complexity). For this reason, focusing on the assets that matter most to advanced cyber adversaries (i.e. High Value Targets), is the most important step of any organization wanting to define and execute a threat-informed and risk aware security strategy.
I have been collaborating with MITRE -as part of MITRE CREF- and ResilienCyCon from 2022 on the concept of High Value Target. From 2023 I have launched the concept of Cyber Resilience Officer, which is the role that would be in charge within an organization of such OSCAL-defined control profile for HVTs. The concept got endorced by NIST NICE and a Cyber Resiliency competency area is being added.
In addition, the HVT concept is part of the OASIS Indicators of Behavior work now and a proposal for addition of HVT attributes is on the table for STIX/TAXXI.
More about High Value Target: www.highvaluetarget.org
More about Cyber Resilience Officer: www.cyberresilienceofficer.org
As an example (please bear in mind I am not an OSCAL expert yet):
<oscal:profile xmlns="https://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:highvaluetarget="http://www.highvaluetarget.org">
oscal:metadata
oscal:titleHigh-Value Target Protection Profile</oscal:title>
oscal:version1.0</oscal:version>
oscal:oscal_version1.0.0</oscal:oscal_version>
oscal:remarksThis profile aligns NIST 800-160 controls to protect against cyber attacks, with a focus on safeguarding the "stealthiness" asset from being used to bypass detection tools by adversaries.</oscal:remarks>
</oscal:metadata>
<oscal:import href="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160.pdf" oscal:version="1.0.0" />
<oscal:import href="https://www.highvaluetarget.org/definitions" oscal:version="1.0.0" />
oscal:controls
<oscal:control id="stealthiness-defense">
oscal:titleStealthiness Asset Defense</oscal:title>
oscal:statementThe organization implements measures to defend the "stealthiness" asset from being exploited to bypass detection tools by adversaries.</oscal:statement>
oscal:control-improvement-idsstealthiness</oscal:control-improvement-ids>
oscal:references
<oscal:reference href="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160.pdf">
oscal:citationNIST Special Publication 800-160</oscal:citation>
</oscal:reference>
</oscal:references>
</oscal:control>
</oscal:controls>
oscal:back-matter
oscal:resources
oscal:resource
oscal:titleHigh-Value Target Definition</oscal:title>
oscal:descriptionThe definition and criteria for identifying high-value targets are based on the information provided by www.highvaluetarget.org.</oscal:description>
<oscal:link href="https://www.highvaluetarget.org/definitions" />
</oscal:resource>
</oscal:resources>
</oscal:back-matter>
</oscal:profile>
The text was updated successfully, but these errors were encountered: