What are alternatives you would suggest to these frameworks?
(I am also deeply skeptical of these frameworks, but don’t have a strong argument against them, and they seem pervasive in the security industry)
(I am also deeply skeptical of these frameworks, but don’t have a strong argument against them, and they seem pervasive in the security industry)
Those frameworks should be treated as guidelines to build a mature security programme, and not just tickbox exercise.
By a wide margin, their most impactful designed purpose is to sell security products and services.
1. They should adopt frameworks only when there's certainty that the revenue coming in from the sales they enable justifies the expense of performing the framework.
2. They should minimize the scope of work they do to satisfy the framework, keeping a clear head about the fact that these are sales enablement tasks, not security program tasks.
3. They should design and execute a real security program independent of the frameworks, being careful not to let the real program get led around by the framework compliance tasks, which are unrelated to security.
The real danger with these frameworks is that people don't do (3), but rather use the framework as a runbook for building a security practice. That's a terrible idea with a terrible track record, because frameworks aren't designed to security your company, but rather to document what a consortium of IT security people, largely from huge companies with diffuse, unaccountable security teams, happen to be doing.
Unfortunately business benefit is easiest to quantify from a sales enablement perspective as opposed to a security program perspective. Agree wholeheartedly you need to do (3) to actually move the needle on security.
The cyber causality dilemma - which came first, the vendor or the framework?
I think there's some use for the framework to make people think about which controls and concepts might work for a given situation, but certainly they need the real world to be examined in parallel to be useful
If a big company can’t explain why they aren’t doing the bare minimum defined in a framework, that’s a red flag.
There are open source solutions for the majority of controls in these frameworks. It isn’t 1995.
in fact I would suggest cis controls over nist and iso for pretty much everyone, but nothing beats knowing your environment inside and out, and striving for 100% visibility.