tashatuvango - Fotolia


How to identify and evaluate cybersecurity frameworks

Not all frameworks for cybersecurity are equal. ESG's Jon Oltsik explains what attributes make a cybersecurity framework and how to go about choosing and using one.

As the information security industry matures, the infrastructure needed to carry out and evaluate information security controls and strategies continues to adapt. Security practitioners are faced with an embarrassment of options -- some of which should not even be properly considered as cybersecurity frameworks.

While real cybersecurity frameworks provide clear guidelines for identifying security issues and providing guidance for creating strategies to mitigate or remediate those issues, some practitioners now consider things like Metasploit, Mitre ATT&CK and even PCI DSS and GDPR as frameworks -- even though they may not meet all the criteria to be considered cybersecurity frameworks.

In a recent Q&A, Jon Oltsik, analyst at Enterprise Strategy Group in Milford, Mass., and founder of the firm's cybersecurity division, explained what makes a cybersecurity framework and how to identify the right ones to be aware of.





Jon OltsikJon Oltsik

Frameworks tend to be broad-based and suggestive of solutions -- but not solutions in themselves. I would characterize the NIST Cybersecurity Framework as a framework.

The Mitre ATT&CK framework tends to be a very popular tool in the public sector -- Mitre being funded by the federal government. The ATT&CK framework is multifaceted, so if you look at the Mitre ATT&CK matrix, it really spans across the whole kill chain. And, therefore, there are lots of parts to it that are linked together, so that's the basis for the term framework there.

For other things, I think they're taking license with it. Metasploit is a toolkit, so you can use it in lots of different ways, and I think that's where the word framework comes in.



Oltsik: You can find frameworks for GDPR, but GDPR and HIPAA and other regulations, like PCI DSS, those tell you what you must comply with, what mandates you must comply with -- but they don't tell you how to comply.


That's how you should look at security frameworks. You're constructing a solution, and it's multifaceted, and there are loosely coupled procedures, and there are tightly coupled procedures. The framework is meant to coordinate all those.

This was last published in August 2019

Dig Deeper on Risk assessments, metrics and frameworks