What's the first present you ever remember receiving for the holiday season?
I know I obviously got toys before this, but I just remember the big Barbie year.
I feel like it's common. Everybody's got that Barbie year where every toy is Barbie.
I think I got a lot of animals, like animals for my Barbie horses and orca.
Like SeaWorld Barbie.
I'm still out of the loop on this. Did Barbie have an orca friend? Is that?
I did.
That's so cool.
That wasn't my first, but I know that I had, and I think it means still be resident at my parents' house.
The Barbie RV that was very 60s or 70s when a bagel looking so very boxy.
Nice.
Matthew, what about you?
I remember getting my first Game Boy, which was the original.
My brother got a very loud noise making toy because he's a couple of years younger than me.
Most of the reason I remember it is because the drive home was me trying to play my Game Boy when my brother pressed every button on this toy and made as much noise as possible.
I do think it was intended to annoy my parents because my parents didn't get it for him.
The one I have the most evidence of is a Power Ranger outfit.
There was like the full outfit and there's so many photos of me wearing it because I wore it nonstop.
In public, two kindergarten, daily.
Everyone has that phase where they just wear the same outfit constantly, right?
Yeah, for sure.
Yeah, that was mine.
Like, my same outfit.
It's the same.
Exactly.
Now it's just business professional.
It's sort of Power Ranger outfits.
What about you, Ann?
I don't know that it was the first, but I remember getting a pinball-esque type machine that my brother and I could play together.
And as a now parent, I think my parents saw or felt the error of that quite quickly because the balls were not soft.
In fact, they were just slightly less hard than a actual pool ball.
Of course, after gameplay, then became projectiles.
At each other in general.
And they were hard enough that they bounced and bounced off the fireplace.
Oh my goodness.
I don't know how. I think of other people to your point. Other people can get my children these kinds of gifts.
I will get one for mine.
Yeah.
Oh man, I love it.
Well, today on our Tech for Business podcast, you might recognize the voices we've got Ann, our quality assurance analyst and GRC specialist, and Matthew, our GRC analyst, and V.C. So, and we're kind of continuing our customer question series.
And so we've got some common compliance questions. And I think I'm just going to pose all of these at the same time because I know they're going to feed in together and kind of build off of each other.
So kind of the top four that we got war was.
Why do I have to follow? I think the why is huge. Why do I have to follow a framework?
Why aren't they all the same? Or why are they all different? Which one is the best? And where do I start?
I'll kind of throw it to Matthew first. That's a lot. That's a lot of questions.
Yeah.
Okay, I'm going to try and keep them in line. I apologize, if not.
Let's just actually instead, let's just start with the first one. Why do I have to follow a framework?
You don't.
In some cases, it's okay. In some cases, that's not true, right? In some cases, you do. You have regulatory requirements, you're a bank, you're a, you know, a healthcare institute, you do have to.
Why do you have to? Well, not everyone has the same training, not everyone has the same knowledge.
Not everyone cares about the same stuff.
Not everyone reads the same things. So the overarching answer of why is because
do I go to the inflammatory answer or the kind answer?
We...
Yeah, consistency. Not everyone can be trusted to do all the things they're meant to do.
At the same time, it could be that it's just impossible to know all this stuff.
It just allows you to do something repeatable, something consistent, to make sure everyone's following the same things.
The why comes down to why wouldn't you? Why wouldn't you follow a pattern when you don't have to, when you can?
It's...
I think I keep coming back to the scientific method. It's reproducible, it's consistent, and it's understood.
Does that mean it's perfect? No, but it means that we know and expect the outcomes to be the same.
And...
I'll actually, I'll give an example that's not from the tech world. I used to teach guitar.
And with almost, almost every single time I had someone who wanted to get better at learning solos from songs,
there was a very consistent reason they couldn't learn it.
And I'd have them play it for me, and I'd just say, just play it. Let's see where you're at.
And then they'd play it, they'd mess up where they messed up, and then I'd say, okay, now, let's show me how you're practicing.
And every single time, there'd be a part they really, really liked.
And it was the part right before it or right after it that they'd mess up.
And so what they would do is they'd play the part they really, they basically were just playing the part they really liked over and over again.
They were messing up slightly and then playing the fun bit or playing the fun bit and messing up and stopping and going back to the fun bit again.
That I feel is how I've seen many, not all, obviously, but many IT techs.
They absolutely love one part of what network management is, so they'll focus on that. They'll ignore the rest of it.
Because it's not as important to them. It's not as cool to them. It's not as fun.
Frameworks make sure you're doing the whole solo and not just caring about the cool part in the middle.
Yeah. I think that answered it, Ann.
I think the music analogy is actually a really good one, but it's ensuring that we know all the parts that make up and consistently know the parts.
It doesn't necessarily ever say you must meet it in this way.
It leaves freedom to meet the requirements, whatever framework you're using.
However, those requirements are still the same for everybody. If you're following one framework, that requirement is the same for everybody.
And it takes guesswork out. I don't have to do more research or understand or guess at what level of compliance we want to find.
It's spelled out. As Matthew alluded to, it isn't always worded.
Terrifically, it isn't always crystal clear, even in the questions that are reviewed and published over and over.
There's still sometimes clear as mud, but at least they give a definition of some achievable mechanism to strive for.
Yeah. 100% agree.
What was the next question? Why aren't they all the same?
Yeah, the first is kind of why are we here? Why are we talking about this? So now that we're here, why aren't they all the same? If we're talking about these frameworks, why are there so many different ones?
Again, such a loaded question.
The answer is kind of the same as the first one, in that not everyone cares about the same things, not everyone needs to care about the same things.
And I think that's the answer. They aren't all the same because they aren't all trying to do the same thing.
Some people or some frameworks are trying to protect information in a very specific way. The NIST frameworks, I'll talk about NIST 800171, which is designed to protect confidential unclassified information.
This relates to things like contracts with government entities, a bunch of status information.
A lot of information that is not considered classified information, therefore, is not required to be kept in a certain way, but is more important than it could be used to cause trouble.
NIST 800171 includes a whole bunch of things about making sure you can confirm someone is who they say they are when they walk into a physical location or when they check specifically for things that are kept in safes, lockboxes, things like that.
Do you have cameras? Do you have physical entry guarantees? Do you have FOBS? All the things that you'd expect in those types of locations.
That's not the same requirement that someone has if they're fully digital.
If they're not doing anything but data like that, that would be overkill for some, say, a fish and chip shop. You wouldn't need that. That would be crazy to try and follow that.
They instead are worried mostly about their credit card data, which is generally in, you know, it's on the credit card machines that are at the counter.
So they have a different requirement for what that looks like. And that's why they're different. That's why they aren't all the same, but are all kind of similar in a way.
It's about where the focus is. Generally, it comes down to the data. So where your data is stored, how critical your data is, and then how complex your environment is for how that data flows.
Yeah.
So I'm going to side step.
Is there, this is probably a silly question, but depending on what you're doing as a business, is there a time in which you're using more than one framework? And are there some that fit better together?
Most definitely.
So I think your question ties in with the next two questions, which were, which one is best and where do I start?
So the answer is yes.
Multiple people.
D, all of the above.
Exactly.
Many of the organizations we work with have multiple compliance requirements.
It is incredibly common to want to do that. In fact,
there are things called meta frameworks that are designed to help with organizing that and covering more than one at a time. So you're not completing two questionnaires every day.
They're often called crosswalks.
Incredibly useful for looking into, especially if you are one of these people.
Healthcare industry, healthcare companies that also take credit cards have to worry about HIPAA and PCI.
Right out the gate. That's, you should be looking at both of those if you take credit cards in-house in any way, shape or form.
So there's definitely ways that you'll be looking at more than one.
And it's not uncommon for certain organizations to have three or four that they track whether they're required to be compliant with them or not.
In-house we track multiple just because we want to know where we stand against them.
Ann.
I completely agree. I would have used that exact example.
The idea that you can know, even your HSA card is a debit or credit card that needs to be controlled and the entity has to control that to some framework.
And it's always better to have that framework to not guess. I don't want to guess about how I have to protect someone's credit card data.
I can go to a guide and say, hey, this is where we're at. This is how we perform this.
Look, I can go through a checklist, however exhaustive, and find out where I need to be with reasonable certainty.
It leaves out a great deal of the guesswork. Sometimes we don't like the answer.
Sometimes you don't want to know that you really can't just leave these credit card machines out wide open.
Sometimes knowing what framework really means that you're going to have to do a full-scale change internally in process procedure.
Maybe implement new takeaway old that might be unknowingly harmful to how you protect your data.
But all in all, it's still a framework to go back to and say, this is how we do it.
Exactly. And so I think that the best one is the one that suits your needs.
With all of that, it's the one that's not doing too much. Just going into NIST 800 again, there is no need to follow the NIST 800 if you aren't storing CUI data.
It is a great baseline if you want a very thorough review, but it's very thorough.
If you were a small retail shop following that would be cost prohibitive to the point of potentially shutting you down because you can't keep up with doing that and actually selling goods.
It requires a full person generally to do that.
So it's about finding one that suits your needs, suits your level of risk, and makes you feel comfortable that it's still doing enough while not making you do too much at the same time.
And so with that, the last one was, I think, where do I start?
And we could go through the list of different compliance requirements and describe which ones we think are the best for what purpose.
But if you don't have any physical requirements, if you don't have FDIC or the FTC saying be compliant with us, if you don't have HIPAA data, if you don't have any of that stuff,
the NIST CSF or the NIST Cybersecurity Framework is a great starting point.
Yeah, it was designed, if I'm remembering my history correctly, to be exactly this.
We'll take as much of the NIST 800 framework as we can, condense it into the cybersecurity items that allow us to do a general baseline.
It is the closest thing I think there is to a actual baseline that isn't something like ISO, which can also be cross prohibitive for people.
Yes.
Those reviews are always fun.
The NIST CSF is talking about it and where to start.
The number one thing for me is language, because oftentimes when you're doing this, the terminology used has a very specific meaning that may be completely different to what you intend or how you use it in-house.
And oftentimes when I see people who've started and gotten lost or started and then potentially failed in audit, it's because the person doing it, when they started, made a bunch of assumptions about how things work.
As a quick example, within the NIST 800 guidelines, an incident is any event that is any cybersecurity occurrence that causes or could have potentially caused a significant loss to the organization.
This doesn't mean anytime anyone nearly clicked a link, it's a problem, it means anytime you've looked into it and gone, this could have been a problem.
So you're defining what counts as an incident for your organization.
Within the HIPAA guidelines, it's a little vaguer and personally I read the HIPAA guidelines as anytime you do get a phishing email, whether it's a aimed at a person or it's just a generic phishing email, technically that's a HIPAA incident.
So because of that, that alone is a huge distinction when you're defining how you handle incidents. Do you keep that same language? Do you change it?
So when I'm starting any of these, I will pull up their definitions list because they always have one and it's generally huge.
And that gets printed out and put next to me.
And then I start reading through the questionnaire and I just make sure the words mean what I think they mean.
Think about PCI and they use the word, they say CDE or the credit data environment, but then they also use the framing network.
They also use environment just in general.
Keeping in mind the CDE is purely the environment that has credit card data in it and your network may include the CDE or not, and your environment includes everything.
So that distinction alone is worth wrapping your head around before you start or else half of these questions are going to sound identical because they are if you don't have the definitions for what each section means.
Anne.
No, spot on.
No, it really is. I don't think I could have said it better.
The thing I caution in that very often you don't actually get to pick your framework.
But there should be an oversight entity agency, something like that, that is actually required to provide what what framework, what level of framework that you're required to abide by to start.
And that often comes in contract requirements, agreement requirements, that kind of thing.
However,
leaving it, leaving that to guests is is never a a good methodology either.
I guess I'm tiptoeing around that very gingerly.
It doesn't do any any good to kind of scatter plot the framework you think might work.
And just use like saying ISO 27001.
But do you know what that means, you might go down a whole different path in in a costly mistake of trying to achieve a level of compliance that isn't necessary.
Where the the CMMC is and the even the financial industry. Some are more complex and less but where you find those those.
I guess overlaps is where you're going to find your efficiencies to once you're finding the the the framework that is required for you.
You're you're seeing where you're meeting all of this and it starts to become routine to your business and your general operations where it's not really an audit it's just kind of a temperature check on where you are at a given time.
Thank you.
CIT uses has a sock audit and sock to type to we can go and look at that framework whenever we need to and we do self audits against that.
And that's where we can internally say hey guys how we do it. I know we were we were looking at these access list this is the requirement hey we can communicate where that is.
And that makes it easier to educate to not to totally go on tangent but I do like having the whatever framework it is it serves to to also get the buy in and through education.
I don't think there's any one framework that no one really loves to go and say let's audit against our compliance of anything.
But if you can really understand where that framework comes from what what's its intent.
And then going through and say this is this requirement meets this spirit and intent for access control.
I just throwing out different ideas. It becomes real. It's not just a checkbox on a list. It's a no we we definitely want to update our access make sure our access lists are current.
And as you go through whatever framework you're able to see that those those levels of true up to ensure that the consistency is applied really are meaningful.
It really is I want my my vendor to review their access lists every week or every year. Sorry.
That is in your in your given industry. So I not only do I want to do that because I want to make sure my my information is accurate but that that's that level set for for your vendors for your customers even there.
There's so much so much more clarity in being able to say here's where the rules are here's where they lie even if they come in you know 250 question.
Exactly. You know which is super fun to Matthew and I but probably not to a normal.
I mean, and I got done with a meeting earlier today that was a security review like this and it was two hours of us just answering questions and at the end I said you know time flies when you're having fun.
And I actually got we got an agreement from the people we were working with which I you know anytime someone can see as much joy in it as we do I'm happy.
The one last thing I'll mention when I when I moved into cybersecurity was basically out of necessity at a previous organization.
I was doing a lot of internal testing as well as a lot of a lot of work as a network admin for customers as well as for the organization itself and as soon as I started doing that I realized from a technical standpoint there was no without a framework there is nothing
that says here's what's most important because if you have that mindset which is where I was in that place.
I was just running around finding what's coolest not dissimilar to fun. It's a lot of fun. It's that playing that same part of the guitar solo over and over it's it feels cool but it doesn't actually help you perform it as a whole if someone were to watch you they don't want to
play the first three seconds of stay away to heaven over and over. So because of that I started looking into the framework specifically basically exactly what and said finding one that made the most sense for the organization finding one that we could hit consistently
without overworking the team and then seeing what we stood up to that and working from there at the same time my first run through it I did mess up. I did exactly what and was talking about I.
Didn't really gauge it properly. I also didn't follow my own current advice which is read through the definitions because I thought I knew it already because I've been doing this for so long and I believed that network administration is network administration.
That's not true when you start looking at the compliance items. So really it is important to keep in mind that if you're doing this have a purpose for it. For me it was about guiding myself finding a way for me to direct my energy more efficiently because when you are a solo
technician as a network admin or something for an organization it can feel overwhelming because you are doing more than one thing at a time.
So really look for what works for you if you do have contract requirements. Those are first that's where you should start if you don't.
The NIST CSF is a really good baseline if it feels too basic for you find something else that builds from it.
But there's there's so many out there that really are designed to help this way and to make you to make you sleep better at night which is what I keep which is what I always say compliance is actually about.
Don't try and do the bare minimum do the baseline and then try and beat it.
That's the goal but make sure you do in the baseline first.
Play the whole guitar solo. Yeah that guitar it was such a good analogy.
I just the reason I keep coming back to it and I think about this at least once a month there's one person I taught in particular because the reason they came to me is because they said that they were an older student and they said their partner was sick of hearing the first minute of their favorite song forever.
They wanted to be able to learn the best of the song.
And that's really like that.
So many things I think about thinking about this individual and just being like, yeah, I can see why that would have got annoying for their partner.
We want to do the whole song and then once we can do it all.
Maybe we play it a little less often.
Well that kind of leaves me in my my last question and then I'll kind of open up if there's anything else so let's say you've got a framework you've you've put it all into place and things are going well.
How often are you reviewing other than if things in your framework change.
Is this yearly is it monthly. What does that look like.
Most of the frameworks will typically guide where they want you to be. I always recommend more than that because no one wants a surprise.
As you're assessing yourself or have an external auditor.
But we had this today you should always write your policies of audit tier to the requirement and if you exceed that fantastic.
But actually, we'll keep it at the requirement and shine if it's better.
Keep it keep it where it's at if as an EP.
Yeah, exactly stick with their baseline of what their requirement is and then put your own spin on top of that if use their language.
If they say this is what it needs to do.
Say this is what we do if that's what you do like follow their language it's really in there for a reason.
And then and then again just build from that it will evolve it will change.
You mentioned changes to frameworks and they do happen there's a lot of really big ones going through right now especially to NIST they're adding a new pillar.
Which is I think the first time they've done that since they invented the pillar system.
So it's a huge change for them.
And that's fantastic, but it does mean a lot of people have to answer their questions again so do the baseline.
Try and make it better do it as much as you can.
If something says do it annually try and do it every six months if someone says if something says do it quarterly try and do it every month.
But at least do it quarterly at least do it annually whatever that minimum is.
Well thank you so much, Anne and Matthew for joining us today.
If you enjoyed this podcast please like and subscribe it's how we know that you're interested in these topics.
If you have a question or topic you'd like us to discuss reach out to us at info at cit-net.com or head out to our website cit-net.com slash podcast.
And we'll be back next week with an all new episode.