Tag Archives: How might that move forward into your professional practice?

Cybersecurity Framework Steps

What kind of steps would you take to illustrate how an organization could use the Cybersecurity Framework to create a new cybersecurity program or improve an existing program. What are some of the key messages and ideas that you will take away from this course? What surprised you about the class? In your opinion, what has changed? How might that move forward into your professional practice?

Course Textbook(s) Lewis, T. G. (2020). Critical infrastructure protection in homeland security: Defending a networked nation (3rd ed.). Wiley. https://online.vitalsource.com/#/books/9781119614562

• • What kind of steps would you take to illustrate how an organization could use the Cybersecurity Framework to create a new cybersecurity program or improve an existing program,

• • What are some of the key messages and ideas that you will take away from this course,

• • What surprised you about the class,

• • In your opinion what has changed,

• • How might that move forward into your professional practice,

---

✅ Comprehensive General Answers

1️⃣ Steps to Use the Cybersecurity Framework (CSF)

To create or enhance a cybersecurity program, an organization can follow a structured approach using the NIST Cybersecurity Framework, which aligns well with best practices highlighted in Lewis (2020):

1. Identify

   • Understand assets, systems, risks, regulatory requirements, and mission priorities.

   • Conduct a cybersecurity risk assessment.

   • Define business-critical systems and dependencies, especially those tied to critical infrastructure (Lewis, 2020).

2. Protect

   • Implement policies, user access controls, awareness training, endpoint protection, secure network architecture, encryption, and incident prevention controls.

3. Detect

   • Deploy monitoring tools, intrusion detection systems, log management, and behavioral analytics to identify potential breaches in real time.

4. Respond

   • Build an Incident Response Plan (IRP) including containment, communication protocols, digital forensics, and defined roles.

5. Recover

   • Ensure continuity operations, secure backups, system restoration, and improvements based on lessons learned.

Throughout each step, the organization:

• Sets current and target maturity levels,

• Identifies gaps,

• Prioritizes actions based on risk and resources,

• Measures performance for continuous improvement.

This layered approach mirrors the defense-in-depth principles emphasized in homeland security protection strategies (Lewis, 2020).

---

2️⃣ Key Messages & Ideas From the Course

Some major takeaways include:

• Critical infrastructure interdependencies create systemic national vulnerabilities.

• Cybersecurity is not just technology — it is people, processes, and risk-based decision-making.

• Threats evolve faster than policies; therefore, resilience and adaptability are essential.

• Public-private collaboration is necessary to defend a networked nation (Lewis, 2020).

---

3️⃣ What Surprised Me

I was most surprised by:

• How deeply cybersecurity challenges affect national security, not just corporate IT.

• The volume of threat vectors tied to operational technology (OT), such as utilities, transportation systems, and supply chains.

Seeing how a cyberattack on one sector can quickly cascade into multiple infrastructure failures was eye-opening.

---

4️⃣ What Has Changed

My understanding has shifted in several ways:

• I now see cybersecurity as a strategic mission, not only a technical function.

• Risk management frameworks like NIST CSF provide a repeatable, scalable way to align technology controls with mission objectives.

• Threat intelligence must be proactive versus reactive — waiting is no longer an option.

---

5️⃣ How This Moves Into Professional Practice

Professionally, I will:

• Advocate for risk-based cybersecurity planning rather than reactive spending,

• Use the NIST CSF as a standard for program development and assessment,

• Promote training and cyber hygiene as core components of organizational safety,

• Engage more with incident readiness and business continuity planning.

Ultimately, this course prepares me to contribute to a more secure and resilient operational environment — one where cybersecurity is embedded into the culture and strategic goals of the organization.