Cybersecurity Terminology and Frameworks

Abstract

The documents related to cybersecurity are often filled with information technology (IT) acronyms and with familiar business terms that need to be understood in the context of cybersecurity. In order to develop and implement an effective cybersecurity program, it is necessary to understand the terminology and its contextual use. Cybersecurity programs often evolve within an organization and, depending on the history of that evolution, the implemented measures may be somewhat unbalanced. For example, in some organizations the program may be headed by an IT professional who has exceptional IT skills, so she or he may place an emphasis on technical controls such as firewalls and authentication measures and the resulting program may not have enough administrative controls in place. Any organization can improve their cybersecurity posture by taking a balanced approach. A balance can be reached by utilizing a framework that allows a cybersecurity program to document its programmatic strengths and weaknesses thus hopefully achieving a better balance over time. This chapter defines key cybersecurity terminology and discusses three popular standards/frameworks that are very relevant to cybersecurity in the critical infrastructure sector. Specifically, the information security standards published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) under the ISO/IEC 27000 series is discussed, followed by a summary of the National Institute of Standards and Technology (NIST) Cybersecurity Framework for Critical Infrastructure and the NIST Special Publication 800-82—A Guide to Industrial Control Systems (ICS) Security, both of which have direct relevance to many of the various critical infrastructure sectors in the U.S.