Search & Discovery 2.0
Search the complete Bare Metal Cyber knowledge system with identifier-aware ranking, framework filters, topic discovery, and direct paths into books, podcasts, and Academy learning.
Search results
Apply GV.OC-02 to achieve this CSF 2.0 outcome: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood.
Apply GV.RM-06 to achieve this CSF 2.0 outcome: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated.
Apply GV.RM-07 to achieve this CSF 2.0 outcome: Strategic opportunities — positive risks — are characterized and are included in organizational cybersecurity risk discussions.
Apply GV.SC-05 to achieve this CSF 2.0 outcome: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
Apply GV.SC-02 to achieve this CSF 2.0 outcome: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally.
Use the Detect Function to monitor environments and analyze events so potentially adverse activity is discovered, correlated, understood, and escalated.
Use the Identify Function to maintain an evidence-based understanding of assets, dependencies, threats, vulnerabilities, likelihood, impact, and opportunities for improvement.
Apply GV.SC-08 to achieve this CSF 2.0 outcome: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities.
Apply GV.SC-07 to achieve this CSF 2.0 outcome: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
Apply GV.SC-04 to achieve this CSF 2.0 outcome: Suppliers are known and prioritized by criticality.
Use the Protect Function to apply safeguards across identity, awareness, data, platforms, and infrastructure so risk is reduced before and during adverse events.
Use the Recover Function to restore assets and operations, verify their integrity, communicate progress, and transition the organization back to stable operations.
Use the Respond Function to manage, analyze, communicate, contain, and eradicate incidents using coordinated authority and tested procedures.
Apply GV.SC-06 to achieve this CSF 2.0 outcome: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.
There are many publicly available sources of system security alerts and advisories. The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) generate security alerts and advisories to maintain situational awareness across the Federal Government and in nonfederal organizations. Software vendors, subs
Sources of counterfeit components include manufacturers, developers, vendors, and contractors. Anti-counterfeiting policies and procedures support tamper resistance and provide a level of protection against the introduction of malicious code. External reporting organizations include the Cybersecurity and Infrastructure Security Agency (CISA). This requirement is sourced to a control tailored out of the SP 800-53B .13
User behavior analytics ("UBA") as defined by Gartner, is a cybersecurity process about detection of insider threats, targeted attacks, and financial fraud. UBA solutions look at patterns of human behavior, and then apply algorithms and statistical analysis to detect meaningful anomalies from those patterns-anomalies that indicate potential threats.' Instead of tracking devices or security events, UBA tracks a…
The Cybersecurity and Infrastructure Security Agency (CISA) generates security alerts and advisories to maintain situational awareness throughout the Federal Government. Security directives are issued by OMB or other designated organizations with the responsibility and authority to issue such directives. Compliance with security directives is essential due t
A security operations center (SOC) is the focal point for security operations and computer network defense for an organization. The purpose of the SOC is to defend and monitor an organization’s systems and networks (i.e., cyber infrastructure) on an ongoing basis. The SOC is also responsible for detecting, analyzing, and responding to cybersecurity incidents
Command and Control Channels is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Stateful and Stateless Firewalls is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Supply Chain Compromise is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Sysmon is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Indicators of compromise (IOCs) are forensic artifacts from intrusions that are identified on organizational systems at the host or network level. IOCs provide valuable information on systems that have been compromised. IOCs can include the creation of registry key values. IOCs for network traffic include universal resource locator (URL) or protocol elements that indicate malicious code command and control servers. T
