WHITE PAPER (TRIPWIRE)

Closing the Integrity Gap withNIST’s Cybersecurity Framework

Implementing a Practical Roadmap to Identify andManage Cyber Risk Against Escalating Threats—AndBring Integrity Management Into Sharper Focus

Fortra White Paper

Closing the Integrity Gap with NIST’s Cybersecurity Framework

When the National Institute of Standards and Technology

Amoroso recommends to companies, “… if you’re going(NIST) announced that it had released its new Cybersecurity

to pick something, you might as well pick the thing thatFramework in 2014, it appeared on the surface to be just one

has everything”—a suggestion he also made to themore option for organizations looking to develop a cohesive

Trump Administration prior to the release of the May 2017

and effective cyber risk management strategy. Indeed, there

Presidential Executive Order (EO) on Strengthening theare dozens of choices available and organizations have

Cybersecurity of Federal Networks and Critical Infrastructure,

been all over the map when it comes to deciding which

which mandates all government agencies to use the NIST

compliance frameworks and which tools they should use toFramework for managing risk.

support the variety of security standards available.

Because the NIST Framework facilitates a risk-based

NIST’s Cybersecurity Framework is unique, however.

approach, it also heightens the awareness of cyber threats

For starters, it was developed by NIST in partnership

across the organization, accelerates the efforts to create awith organizations from the critical infrastructurestronger cybersecurity strategy and supporting program, andindustry to address complex cybersecurity challenges

it can reduce the possibility of miscommunications between

within operational technology environments, such asstaff of other functions that integrate with cyber departments.

manufacturing, utilities, energy, transportation, healthcare and chemicals. The Framework was designed tosimplify an organization’s approach to securing these andother complex environments, yet it is universal in scope.
Importantly, it provides a common language that helps allpersonnel—from the IT team to department heads and otherdecision-makers within the C-Suite—define and understandsecurity problems and potential solutions within the context
of the overall mission. It then offers flexible guidance tohelp organizations from every industry meet their specificbusiness objectives from the top down.
It is not a one-size-fits-all approach. Organizations facedifferent threats and have different vulnerabilities anddifferent risk tolerances. With the NIST Cybersecurity
Framework, they can pick, customize and prioritize which
practices and activities will help them reduce and better
manage their unique cybersecurity risks and gain the fastest
time to value.
These characteristics are part of why an increasing numberof private sector companies are diving deeper into NIST
Cybersecurity Framework adoption. Gartner predicted that50% of all U.S. organizations would be using this framework
by 2020.1 Meanwhile, the framework has been adopted byvarious countries as part of their cybersecurity strategy; andin some cases, their national legislation.
“The full maximum NIST Cybersecurity Framework is about
as big an umbrella as you are going to find,” says Edward G.
Amoroso, CEO for TAG Cyber.

Fortra.com

First developed by the executive order of President Obama
in 2013, the Framework became a requirement for all federal
agencies by order of President Trump in May 2017. A newversion was issued in late 2017.
“NIST is probably the most thoughtful, comprehensive,well-researched, accepted framework out there,” says
cybersecurity technology officer David Meltzer. “It’s robust
enough to complement what large organizations are
already doing in cyber, but flexible enough to give smallerorganizations a roadmap to improved cybersecurity.“

New Threats, Different Vulnerabilities
More urgently, perhaps, is the immediate need for criticalinfrastructure and other companies to successfully prepare
for the anticipated increase in integrity-related threats.
Global ransomware is an integrity-​related threat, forexample, and its costs, alone, will reach $20B in 2021, which is
57x more than it was in 2015, according to leading research
firm, Cybersecurity Ventures.2“Integrity is really at the heart of information security
protections for any system,” says Ron Ross, Fellow for NIST.
“Because if someone is able to indiscriminately change anapplication or a piece of data or the BIOS instructions oranything within the computing stack—whether the customer
is aware or not aware of those changes—then that reallyattacks the basic underpinnings of an information system,
along with everyone’s trust in it.”Page 2Fortra White Paper

Closing the Integrity Gap with NIST’s Cybersecurity Framework

The consequences of an integrity-related attack areare easily understood and communicated from front line

devastating for any organization, but especially those

operations to the executive level. These are all containedthat handle critical infrastructure systems. If an attacker

within five overarching functions, each of which can bemanages to tamper with a medical device, the critical

further broken down into categories and subcategories.

safety system of an automobile, the data collected during
a clinical trial or the operations of a power plant—the result
could be major disruption or even death.

• Identify—This function allows organizations to better
understand the business context and the resources that
support critical functions, and the related cybersecurity

Says Amoroso, “Unfortunately, most security experts, including

risks so it can focus and prioritize its efforts, consistentmyself, are predicting that the shift towards integrity-oriented

with its risk management strategy and business needs.

threats is coming like a tsunami and most organizations arepoorly set up to stop those types of things.”• Protect—By helping organizations to develop andimplement the appropriate safeguards to ensure

Organizations of every size—and in every industry—candelivery of critical infrastructure services, this function

improve their ability to protect critical assets and operations

supports the ability to limit or contain the impact of aagainst these types of attacks by utilizing the NIST

potential cybersecurity event.

Cybersecurity Framework, which is designed to be easily
paired with an organization’s choice of security control
catalogs like NIST 800-53, ISO 27000 and the Center forInternet Security Critical Controls to enable strong integrity
management, including configuration management, file
integrity monitoring and change management.
And that’s because it’s no longer simply a question ofvulnerability and defending data and systems against any
penetration by an outside-in intrusion, states Ross. “Youare going to be hit at some point, if you haven’t been hit• Detect—With this function, organizations develop andimplement the appropriate activities to enable thetimely discovery of a cybersecurity event.
• Respond—This function supports the ability to containthe impact of a potential cybersecurity attack bydeveloping and implementing response activities.
• Recover—This function supports the timely recovery
to normal operations to reduce the impact from acybersecurity event.

already,” he says. “So the important thing is not to keep

According to NIST, these five functions aid an organization

worrying about the likelihood of an adversary attack. It’s: Doin expressing its management of cybersecurity risk by

they have the capability of attacking you, and what would

organizing information, enabling risk management

be the impact if that happens?”

decisions, addressing threats and improving by learning

The How of Identifying Risk

The best time for that discussion is before an attack occurs,and NIST’s Cybersecurity Framework is designed to force
organizations to triage their critical systems based on thenegative impact an attack would have on their mission orbusiness.
“There are things that are low impact, moderate impact andhigh impact, and once you figure out what’s most critical,
then you can actually engineer and apply all of the security
tools and security controls and best practices in a way that’s
really focused on those most critical assets,” says Ross.
“Then everything else you can kind of let go and be lessrigorous in that process.”
To do this, the Cybersecurity Framework features a set ofcore activities, outcomes and applicable references that

Fortra.com

from previous activities. They also align with existing
methodologies for incident management and help show theimpact of investments in cybersecurity.
That the functions are described using basic, plain
English terminology is no coincidence. “All of these words
are meaningful for cybersecurity risk management
but they’re also meaningful for larger risk discussions,”
says Matthew P. Barrett, Program Manager for the NIST
Cybersecurity Framework. “This really stages cybersecurity
for consideration in those larger enterprise risk discussions.
It sounds simple, and in some respect it really is, but it’s
an incredibly important extra step that’s available in ourframework and not in others.”
Although the steps can be utilized concurrently andcontinuously, NIST recommends that organizations spend alot of upfront time on the “Identify” task.

Page 3Fortra White Paper

Closing the Integrity Gap with NIST’s Cybersecurity Framework“That’s the step that helps you gain context,” Ross says. “HowThese five functions also allow organizations to take a “dipare you going to organize your organization to build theyour toe in the water” approach. “You don’t have to do a 50-

best security program you possibly can? What is your risk

page business plan out of the gate. We don’t have to havemanagement strategy? What are your critical assets? What are

an expensive risk authority matrix or policy library in order tothe different things you do in your mission and business space

do governance or a tome on cybersecurity risk managementthat need to be addressed? What kind of IT assets do you havestrategy,” explains Barrett. “You can do all of those thing

now? All of that has to be organized first, to understand wherewith a page or less of paper and just capture it for the future

you’re going in the future with regard to what kind of programand communicate it within the business, so everyone knows

you’re going to build with regard to security.”

what solid ground looks like. Then you can move deeper into
categories and subcategories within each function.”

How Tripwire Maps to the NIST Cybersecurity Framework

Why do companies consider Tripwire functionality a key component to successfully implementing the NIST Cybersecurity
Framework? Because the controls found in Tripwire solutions provide support for all five functions of the Framework, including
integrity controls specific to 13 of the Framework’s subcategories.
FUNCTION

CATEGORY

Identify

Asset Management• Physical devices and systems are inventoried• Software platforms and applications are inventoried
Risk Assessment• Asset vulnerabilities are identified and documented• Threat and vulnerability information is received from information sharing forums and sources• Potential business impacts and likelihoods are identified• Threats, vulnerabilities, likelihoods, and impacts are used to determine risk

Protect

Access Control• Network integrity is protected, incorporating network segregation where appropriate
Data Security• Integrity checking mechanisms are used to verify software, firmware and information integrity
Information Protection Processes and Procedures• A baseline configuration of information technology/industrial control systems is created andmaintained• Configuration change control processes are in place• A vulnerability management plan is developed and implemented

DetectSecurity Continuous Monitoring• Vulnerability scans are performed

RespondAnalysis• Forensics are performed

Recover

Restore systems in a timely fashion using remediation guidelines/advice derived from Tripwire policy
contentFortra.com

Page 4

Fortra White Paper

Going VerticalOnce organizations set a foundation with the NIST
Cybersecurity Framework, they can easily pivot to using
NIST Special Publications like 800-53, 800-160 and 800-171 oranother comprehensive security control catalog and further
bolster their ability to manage their systems for integrityrelated changes and attacks.
Historically, the security focus has been on protecting
data confidentiality and system availability, or the “C” and“A” components of the “CIA Triad.” Of lesser priority has
been integrity—the “I” in the strategy—which is focused onprotecting data and systems from modification or deletionby unauthorized parties and ensuring that damage canbe repaired or reversed. In today’s environment, though,Closing the Integrity Gap with NIST’s Cybersecurity Framework

NIST SP 800-53, a catalog of security and privacy controls,
includes a number of control families that deal specificallywith integrity. Together, the 800-53 controls include
guidance and tools for capabilities that help manageand ensure system integrity including log management,
configuration management, vulnerability management,change management and asset management.
Of course, security controls have long been available toand used by information security teams, but when usedwithin the context and roadmap of the NIST Cybersecurity
Framework, they can be linked and mapped up throughthe Framework’s pyramid shape of detailed safeguards,
subcategories, categories and functions and then conveyed
to the C-Suite.

cyber attackers are much more likely to exploit a system’s“It’s a beautiful way to get that communications started,

integrity—or lack thereof. In doing so, they can not only

going both up and down the organizational hierarchy,change and modify coding and operational settings, but

to make sure that integrity is an issue that is recognized

they can also steal intellectual property and customer

as important and well-defined at the boardroom level,”

information and shut down systems. All of this illustrates thatsays Ross. “This is really critical: Integrity has to be athere is an inherent relationship between a system’s integrity

primary objective of the C-Suite, to the people at thatand its confidentiality and availability.

level, if integrity is going to be a part of the overall security“Integrity is critical because once you establish a certain
lockdown set of configuration settings or you deploy
software, adversaries like to get into your systems andnetworks and they like to attack your systems and deploy
unauthorized, malicious code,” says Ross. “Thus, you have
got to understand what’s on the network and make surethat any changes to that network are done by authorizedindividuals so that you have really strict control over theconfiguration settings and also any changes to softwareand systems that go on routinely within organizations.”
Integrity management involves a number of capabilities
including those safeguards or countermeasures designed tocontinuously assess hardware and software vulnerabilities,
passively and actively monitor in real-time to identify andreport on weaknesses and support incident investigationand mitigation. By pairing NIST Cybersecurity Framework

discussion and prioritized in the security strategy and thesuccessful implementation of that strategy.”

Easing Integrity with Tripwire

Extending integrity management to the full range of criticalinfrastructure assets managed will enable you to reduce
your organization’s overall attack surface and address morecumulative security and operational risks. To that end, Fortra’s
Tripwire offers an integrated suite of foundational controlsthat deliver integrity assurance closely aligned with NIST
guidance, including the Cybersecurity Framework and SP
800-53, Revision 5. In fact, Tripwire has released an expanded
platform and policy support for NIST 800-53 and has
addressed a number of its specific requirements, including:• Automation of the implementation and management ofsecurity controls

guidance with specific NIST controls, organizations• A continuous monitoring capability

across all industries and risk profiles can ensure that

• Ease of reporting in support of annual reviews

they are effectively addressing these capabilities. When
implemented properly, integrity management can preventthe majority of breaches from happening.

Fortra.com• Specific support of configuration management family ofcontrols, system integrity requirements and information
system monitoring

Page 5Fortra White Paper

Closing the Integrity Gap with NIST’s Cybersecurity Framework

Specifically, Tripwire’s Industrial Security Solutions suite
provides a holistic set of software applications that assess,harden and monitor plant and industrial environments
to drive availability, safety and resilience against cyberincidents that could adversely impact operations.
“In so many ways, Tripwire is better positioned than mostcybersecurity vendors to provide the critical componentsof good, solid foundational cybersecurity programs… fromasset identification to vulnerability assessment to change
identification and impact,” says Meltzer. “They’ve got thetools that work together to solve integrity management
challenges and they can do it at a scale better thanmost. So, they are uniquely positioned in a lot of ways torespond to the breadth of the NIST expectations for criticalinfrastructure organizations and beyond.”

Sources

1 https://www.oas.org/en/sms/cicte/docs/OAS-AWS-NISTCybersecurity-Framework(CSF)-ENG.pdf
2 https://cybersecurityventures.com/global-ransomware-damagecosts-predicted-to-reach-20-billion-usd-by-2021/

About Fortra
Fortra is a cybersecurity company like no other. We’re creating a simpler, stronger future for ourcustomers. Our trusted experts and portfolio of integrated, scalable solutions bring balance andFortra.com

control to organizations around the world. We’re the positive changemakers and your relentless ally toprovide peace of mind through every step of your cybersecurity journey. Learn more at fortra.com.

© Fortra, LLC and its group of companies. All trademarks and registered trademarks are the property of their respective owners.

(fta-tw-wp-0523-r1-hm)