Cyber Security Framework

 Introduction

Cyber security has become vital for organisations operating in any sector with increased incidents of malware attacks, phishing attacks, DoS and other kinds of cyber attacks. In such a scenario, it is important for an organisation to evaluate its cyber security measures against standard practices to improve and strengthen organisational cyber security. This Article will deal with a case study of WatchIt Capital Ltd., a UK-based firm to implement a secure architecture. There will be an attempt to present a comprehensive plan for this organisation. In an attempt to do this, a security framework will be presented and proposed to the organisation that will be beneficial to optimise cyber security within the organisation. The discussion of this article will contain a list of cyber security capabilities and policies that will be appropriate for WatchIt Capital Ltd. Besides, this article will also delineate cyber security operational processes and metrics for monitoring the effectiveness of cyber security. 

Current scenario and background of WatchIt Capital Ltd 

WatchIt Capital Ltd. is an organisation that operates in the private equity business. This is an investment organisation whose speciality is to invest in blue-chip global organisations. This organisation has more than 400 employees, 421 to be a precise and the gross turnover of this company was more than 780 billion in the previous fiscal year. This is a UK-based organisation with headquarters and a data centre in London. Presently, this organisation employs a cloud platform that is Amazon Web Services. Amazon Webs service provides increased security to users enabling them to control the location of their data and the people that can access it (Aws. amazon, 2022). Their website receives protection from Cloud flare and a third party administers this website. WatchIt Capital Ltd employs firewalls as a security measure, however, this organisation does not use a formal risk register and this is one of its legal necessities. A cause of concern is that some employees are using third-party CRM software in place of the organisation's implementation. 

Moreover, WatchIt Capital Ltd also lacks centralised management for firewalls and there is also a scarcity of employees to monitor the security alerts and warnings they receive. This poses a security threat in case of an actual security breach or attack as without adequate staff security alerts could go unnoticed. As a result, a lack of employees and monitoring could lead to a serious breach of security those results in harmful consequences. Constant monitoring is a healthy practice in cyber security (Ghelani, 2022). Another inappropriate practice in the organisation is that some employees are employing SalesForce.com to manage clients' information without permission from the IT department. This creates security risks to clients' sensitive information. In addition, this organisation also lacks the practice to respond in case any incident related to cyber security such as a security breach occurs. This indicates that they are not prepared in a sufficient manner to deal with any sort of cyber threat or breach. The vendor contract support of this organisation is not organisation either and contract management presently lacks apparent principles of organisation. Not only this, the 'data loss prevention system’ of this organisation is insufficient as it is set to report only. This implies the organisation may lose sensitive and valuable data due to a lack of a back of the system. 

Although this organisation uses HP data protector, however, a backup system is not organised and is protected inadequately. One of the vulnerabilities is that HP data protector that they use is outdated. Therefore, their backup system is vulnerable to modern threats and exploits. Furthermore, the central web console of the security system of this organisation also encounters many false positives. False positives create a false alarm that indicates non-existent security vulnerability in the system (Sedjelmaci et al. 2019). False positives could make security personnel careless posing a threat of a lack of response in case of an actual security breach. Additionally, the security system for the configuration management database of this organisation is also insufficient. This is by the reason of the fact that excel spreadsheets are out of date without any central asset database. 

WatchIt Capital Ltd’s Cyber Security Framework

The cyber security framework that proves to be beneficial and practical for effective security includes five elements namely identifying, protecting, detecting, responding, and recovering. The strength of this framework is that it will enhance the cyber security procedure of the entire organisation. The first element in this framework is identification, which includes risk assessment. From the case study of the organisation, it is obvious that this firm does not have a risk register to identify potential risks that could arise. For this reason, the cyber security framework will include a risk register to identify potential cyber security risks that this organisation could encounter. According to Ahmad et al. (2020), a risk register, as well as a risk assessment strategy is crucial for cyber security. The reason the risk register is significant is that it provides valuable insights and information regarding different vulnerabilities in the cyber security system of an organisation. For this reason, a risk register is necessary to identify possible risks that could occur in this organisation. 

Ahmad et al. (2020), state that identification of risk includes determining if an incident could occur and validating possible implications and scope of the risk. Identification stage also includes determining the way a cyber security indecent could occur. Cyber security framework also includes a risk assessment strategy as a part of identification. Ganin et al. (2020), assert that risk assessment strategy includes three key elements, which are vulnerability, threat and implications. Integration of these three elements is crucial to enhance cyber security system of an organisation. Decision-analysis-based approach for cyber security management is essential as per this author. 

 

 Multi-criteria decision framework for risk management and assessment

This figure illustrates an effective framework for risk assessment and management as a part of cyber security framework. As shown in this figure, vulnerabilities could occur in different domains such as information domain, physical domain and social domain. Identification of these vulnerabilities will assist to enhance cyber security policies and measures of WatchIt Capital Ltd. The implication of this framework will be advantageous to improve vulnerabilities in cyber security system of this organisation. Protection is second element of cyber security framework for this organisation. Protection incorporates a wide range of measures and actions that are crucial to prevent identified cyber security threats that could occur (Gordon, 2020). One of the measures that WatchIt Capital Ltd. could take is to increase the protection of organisation’s recruiting skilled IT personnel into the organisation and providing adequate training to them. From the case study, it is evident that WatchIt Capital Ltd lacks IT personnel to monitor threats. Access control and data security are included in protection element of NIST cyber security framework. WatchIt Capital Ltd. lacks an adequate system for data backup and protection. Their current software for backup is not up to date; therefore, it is vulnerable to exploits. Hence, this organisation requires updated backup software to ensure data of this organisation remains protected from threats. 

AI technology will assist in not only preventing the detected threat but also backing up stored data to recover in future. Zhilin and Safar'yan (2020), show that Artificial Intelligence technology is effective to provide enhanced security in case of data protection as well as data backup. With the help of artificial intelligence technology, WatchIt Capital Ltd. could detect potential threats such as malware and ransom ware and intrusion into the system. AI could make data protection and backup efficient through automation technology. This technology, with the assistance of machine learning, automatically backs up software components or crucial data of an organisation without interference from humans. Therefore, protection elements will include implementation of AI into cyber security system of the organisation to optimise and enhance the backup and restoration process. 

Cyber security framework includes detection of threats, anomalies, vulnerabilities, attacks and monitoring. This organisation lacks an adequate system or technology for threat detection. Intrusion detection and prevention system (IDPS) is a prevalent technology to identify and prevent cyber security threats such as malware attacks. Radoglou-Grammatikis and Sarigiannidis (2019), asserts intrusion detection and prevention system provides enhanced cyber security to an organisation’s devices as well as networks. 

The way intrusion detection and prevention system works. Three kinds of intrusion identification methods exist in IDPS including anomalies, signatures and specification-based. This author states that IDPS system is reliable as the rate of false positives in this technology is relatively low. However, one of the disadvantages of this technology is that it cannot detect attacks or signatures that are not known. For this reason, it becomes necessary to update continuously this system with the latest identified signatures to remain up to date.

Therefore, Artificial Intelligence technology could be employed to detect previously unidentified signatures that common intrusion detection and prevention systems cannot identify. On the other hand, this system provides adequate security against threats related to anomalies (Quincozes et al. 2021). This kind of threat involves unethical intrusion into a system or network. Intrusion detection and prevention system generally utilises machine-learning technique, for instance, neural networks or Bayesian networks to identify malicious or abnormal activities in an effective manner. 

WatchIt Capital Ltd also lacks sufficient response management in case of a cyber security breach. Intrusion detection and prevention system response detected threats automatically. This system continuously monitors functions of firewalls as well as routers that require security (Birkinshaw, 2019). This system reports intrusion or threat that is detected to the administrator and take action to prevent unauthorised access. Hence, this system also responds by blocking the intruder in an effective manner. NIST framework includes different measures that are essential to perform and take for an effective response strategy. Response planning is one of the measures that WatchIt Capital Ltd requires to avoid effectively a potential cyber security threat. This includes a detailed plan for responding to detected threats (White and Sjelin, 2022). They are the guidelines and steps that WatchIt Capital Ltd must take in case of incidents of a cyber attack. 

The planning and preparation must be in accordance with the policies and procedures of this organisation. Response planning also includes providing training to the employees of the organisation to deal with cyber attacks. They should be provided clear instructions regarding the way they should respond in critical circumstances. Response in this framework also includes mitigation and improvement (Taherdoost, 2022). The mitigation strategy for detected cyber security threats should be clearly outlined in a risk register. For instance, a mitigation strategy in case of a malware attack will include connecting the system to a clean network for installing an operating system and other necessary software required by the organisation. 

Mitigation goal of cyber security framework should be to protect the device, data and privacy of an individual. 

Last element of this framework includes recovering. This involves several steps such as recovery planning, improvement and communication (Delgado et al. 2021). Recovery planning also contains a pre-determined set of guidelines and procedures for an organisation. The implication of this framework will be positive for this organisation, as it will strengthen its cyber security measures and the entire system. Hence, this cyber security framework is considered advantageous to WatchIt Capital Ltd. 

Detailed outline Watch It Capital Ltd’s cyber security policy

Updating system/software regularly

One of the essential cyber security policies for adoption and implementation in this organisation will be to update all systems and software on a regular basis.  This organisation uses HP data protector, however, a backup system is not organised and is inadequately protected. One of the vulnerabilities is that the HP data protector that they use is outdated. Therefore, their backup system is vulnerable to modern threats and exploits. For this reason, it is proposed that the policy of updating the system and software of this organisation on a continuous and regular basis will be beneficial. One of the disadvantages of any kind of outdated software whether operating system or backup software is that outdated software creates vulnerability in the system (Fagan et al. 2020). Cyber criminals have become extremely advanced and they are quick to take advantage of any sort of vulnerability in a system or network. For this reason, updating software is considered immensely significant. 

Software that is outdated exposes the system and data contained within the system to cyber-attacks and breaches. Outdated software increases the possibility of malware or virus attacks largely as it is generally convenient to breach outdated software in comparison with updated software (Ganin et al. 2020). Cyber security breaches could also lead to the loss of sensitive data resulting in extensive loss to this organisation. For instance, the loss of clients’ data could lead to a loss of customer trust and reputational loss. As a result, this could harm organisational business consequence in a reduced customer base and a decrease in revenue. For this reason, the organisational policy should be to constant update outdated software of the organisation on a regular basis. This policy will enhance the protection and security of the data of this organisation benefiting the organisation. Updating software on a regular basis will not only provide protection from cyber attacks but also ensure avoidance of system failure (Zhang et al. 2019). Outdated software often results in system failure by the reason of the fact that outdated software encounters difficulty in operating on new hardware. 

Moreover, outdated software may also contain bugs that are eliminated in updated software. For this reason, updated software is considered to enhance the security of the system largely. Thus, updating software on regular basis is necessary to avoid system failure. Thus, the software updates policy will benefit WatchIt Capital Ltd to reduce the risk of cyber attacks by cybercriminals, assist in protecting data and data backup, remove bugs and avoid system failure. 

Using only company software and devices to work

A cause of concern is that some employees are using third-party CRM software in place of organisation’s implementation. Moreover, a small group of employees of this organisation use salesforce.com without the permission of the IT department. The employees are using the platform for client information management. This implies that the data of clients are at risk raising the threat of sensitive data breaches and data being stolen. The policy of using only company platforms and software recommended by the organisation would benefit WatchIt Capital Ltd to keep its data secured and protected from a third party that could misuse the data in various ways. For instance, there is a possibility that the stolen data could be used and sold to rival organisations which will not only create a risk of loss of sensitive customer data but also customer trust and loyalty (Ameen et al. 2021). For this reason, this policy is proposed to WatchIt Capital Ltd and it is considered that the policy to use only the company-recommended platform will benefit to avoid the breach of clients’ data loss. For successful implementation of this policy, there should be strict provisions for violating the company rules to ensure compliance with the policy by all employees. 

Practising incident response once every month

This is one of the policies essential for WatchIt Capital Ltd by the reason of the fact that this organisation does not have an established procedure for practising incident response. An incident response plan includes a clear set of steps that employees are required to follow in case a cyber attack takes place in an organisation (Srinivas, 2019). Incident response planning will include a document containing, outlining and assigning the responsibilities and roles of different individuals. The incident response lifecycle includes four phases, which are preparation, detection and analysis, containment, eradication and recovery. Assigning a specific responsibility to a particular individual is necessary to avoid confusion in case a cyber attack takes place. 

Moreover, incident response also incorporates processes to keep business partners, employees and other relevant stakeholders engaged with and notified in case of a cyber security breach (Sarker et al. 2020). The updates and notifications to stakeholders could take place through different communication methods such as social media platforms, meetings, conferences, phone calls, newsletters and so on. The benefit of this response practice will be that employees will have a comprehensive understanding of the process that they will have to follow to deal with a situation involving cyber-attack or other security threats (Whitman and Mattord, 2021). Hence, in case of an actual incident, they will be able to manage the situation in an effective and efficient manner without creating chaos. Moreover, the incident response policy will create a systematic and organised system for a fast and automated response that will assist to prevent data loss and increasing data privacy. Thus, this policy will be beneficial to establish a procedure for a response during cyber attacks. 

Policy to adopt new technologies 

One of the factors that contribute to cyber-attacks and make it convenient for cyber criminals to perform cyber attacks are using outdated technology. Similar to outdated software, outdated technology creates vulnerability in cyber security that poses a threat of cyber attack and data breach. Some of the most common cyber attacks that occur are ransom ware, and DoS, which occur due to outdated technology (Basnet, 2021). For this reason, it is proposed that a policy to adopt and implement latest technology to enhance cyber security will be beneficial to this organisation. 

A technology that this organisation could employ is Artificial intelligence. Artificial Intelligence technology is efficient to ensure enhanced security in case of data protection as well as data backup (Wang and Lu, 2019). Utilising artificial intelligence technology could detect potential threats such as malware and ransom ware and intrusion into the system. AI technology will assist in not only preventing the detected threat but also backing up stored data to recover in future. Another effective technology is block chain. Lage et al. (2019), show that block chain technology in different areas of cyber security such as threat intelligence, backup and recovery, content delivery networks and so on. With the help of this technology, the cyber security of WatchIt Capital Ltd. will improve largely. These technologies will eliminate cyber attack threats such as malware, DoS, ransom ware, phishing attacks, and others. Hence, the policy of adopting new technology will involve the implementation of such technologies as artificial intelligence and block chain. 

Recruiting skilled employees and providing training to staff

WatchIt Capital Ltd. lacks adequate employees in the organisation to monitor the alerts and warnings that they receive. This creates vulnerability in the organisation’s cyber security management to effectively deal with a situation of cyber attack. The central web console of security system of this organisation also encounters many false positives. False positives could make security personnel careless posing a threat of a lack of response in case of an actual security breach (Calderon, 2019). For this reason, a policy is proposed that recommends recruiting skilled and talented IT staff into the organisation to effectively deal with alerts and warnings. This will eliminate the threat of being unable to respond to a cyber attack and take necessary actions (Aldawood and Skinner, 2019). Thus, this policy is argued to be beneficial to this organisation to take adequate action and steps with adequate staff in case of a cyber attack. This policy also mentions that staff should be provided adequate training to deal with a cyber-attack as well as technical knowledge. Training will eliminate the threat of the inability to deal with the situation of cyber attacks in an effective manner. Hence, this policy will be beneficial to WatchIt Capital Ltd. to deal with cyber attacks.

Log management Policy

Log management system is also necessary for this organisation, as it is a crucial part of security and event management. The log management system will include giving priority to log management in the organisation and building appropriate infrastructure for log management in the organisation. Moreover, the log management policy will also include standard operations processes for long management (Landauer et al. 2020). Log management will include a collection of logs from different sources. Log aggregation and log retention are also included in the log management process. Next, log management includes log analysis and log searching and monitoring. Log management will enhance cyber security of this organisation by reducing the attack surface (Naseer, 2021). An element of log management will also include constant monitoring and real-time monitoring for optimised identification and time for responding to threats. 

Effective log management also decreases the individual required to monitor system. Hence, effective log management will assist to resolve the issue of inadequate staff to monitor system. In addition, log management will also improve visibility and observability with the help of a common event log (Bhardwaj and Goundar, 2019). Log management will also benefit this organisation to improve communication and coordination in IT department. With improved coordination in the IT department dealing with issues such as cyber-attacks will become more effective and efficient. Furthermore, log management is also considered essential as it provides protection against malicious elements and cyber security threats (McFarland and Olatunbosun, 2019). Not only this, but log management also ensures security against the misuse of information from inside the organisation. External threats could be identified rapidly facilitating quick intervention. Thus, it is asserted that a log management policy is beneficial for WatchIt Capital Ltd. to improve monitoring in the organisation and avoid external cyber security threats. 

Access control policy

Access control policy consists of rules and regulations that state specifically people that are allowed to access as well as manage information of the organisation under specific situations. Sufficient protection of information systems and information is fundamental to cyber security policy (Colombo and Ferrari, 2019). Almost all kinds of applications that handle privacy, finance, and safety involve some type of authorisation or access. In effective access control, policy creates privacy risks. 

 

Relationship between Cyber security and Privacy Risks

Access control policy determines people that possess authority to reach information of an organisation. Access control policy becomes highly vital to ensure safety of organisational information from not only external malicious elements but also harmful elements within the organisation that could pose threat to cyber security. The benefit of this policy is that it will prevent the risk of unauthorised access to sensitive information of an organisation. This policy will require effective enforcement across the organisation with the help of an efficient mechanism (Habib et al. 2019). One of the advantages of this policy is that this organisation will be able to keep track and monitor of people that will access a piece of information. Hence, in case of sensitive information leaks from inside the organisation in future, the organisation can take identify potentially suspected people conveniently that may have leaked the information. Some of the benefits of an access control policy are as follows: 

● Prevention against data breach

● Safety from unauthorised access 

● Creation of a safe work environment

For these benefits, WatchIt Capital Ltd. is proposed to adopt and implement this policy into the organisation. 

Policy summary 

Policies Description 

Updating system/software regularly This policy will be beneficial to eliminate vulnerability arising due to outdated software. This policy will prevent cyber security threat of malware attacks due to system vulnerability. 

Log Management Policy This policy will be beneficial for effective control and monitoring system

Policy to adopt new technologies This policy is advantageous to prevent threats of novel viruses and signatures 

Access control policy This policy is advantageous to protect organisational information 

Budget for implementation 

Operational processes for Cyber security

Operational process for cyber security incorporates several elements such as risk management, configuration management database, cyber intrusion response, control management, password and key management and so on. They are some of the operational processes an organisation is required to cater to for effective cyber security. These operational processes encompass different areas that an organisation must pay attention to strengthen cyber security in the organisation.

Risk management

First operational process for cyber security is risk management which contains detection and tracking of different organisational risks related to cyber security. Cyber criminals identify and exploit technology factors into threats and risk processes as vulnerabilities. For this reason, cyber security risks rise and it becomes necessary for an organisation to adopt an effective mitigation plan. Risk management involves identifying risk and analysing the identified risk. Next, risk management includes design control after which risk plan is approved. After approval of risk plan, an organisation needs to implement control and operate controls. Last element in risk management is tracking risk. WatchIt Capital Ltd. should follow this process for effective cyber security risk management in the organisation. Lee (2021), proposed a framework that could be employed by this organisation for effective risk management. 

Cyber infrastructure plays a crucial role in cyber risk management to protect IT services and assets of a firm. Cyber infrastructure consists of such elements as employees and cyber technology and an organisation must concentrate on both employees as well as technological aspects in risk assessment and cyber security management (Chowdhury and Gkioulos, 2021). This author states that risk assessment should incorporate such elements as risk qualification and cyber investment analysis. WatchIt Capital Ltd could adopt this framework in operational process of risk management to strengthen cyber security in the organisation. 

Control management

Control management is another significant operational process for cyber security which contains an identification of controls, evaluation of controls, revision of controls and so forth. Identification of control includes detection of different controls within the organisation by security team or IT team that result from risk management (Asghar, 2019). Evaluation of control involves architecture, strategy engineering, and security and operation consideration for every control from different points of view. After evaluation of controls control management includes revision of control to produce, upgrade and change controls depending on the outcome of the evaluation procedure. This organisation could adopt this control management process in the organisation for effective cyber security measures.

Configuration management database

This process incorporates regularly auditing configuration system of an organisation to update database of configuration management. This is necessary to perform for verifying that database is similar to system configuration. Alterations that are not planned, troubleshooting, debugging and cyber attacks could lead to differences in a configuration that are required to be resolved on regular basis (Argaw et al. 2020). Although it is possible to automate the process of configuration, management complete automation is not possible. The process of configuration management contains tracking configuration. This involves identification of alterations that are unauthorised and differences in configuration to make the process of re-certification convenient. Next, configuration management involves requesting re-certification that is performed as a response to detected differences (Georgiadou, 2021). In addition, reviewing discrepancies is also an element in this process that is crucial to understand whether discrepancies exist due to malicious activities. Hence, WatchIt Capital Ltd should adopt this process as a part of operational process for cyber security to strengthen organisational cyber security. 

Password and key management

Operational processes for cyber security involve password and key management, which is a vital process from a cyber security perspective. This operational process involves the creation of a new password or key. This alludes to organisational passwords and keys rather than personal passwords. After successful creation of key or password, this process includes archiving the key for safety. The password should be altered and retrieved as per the necessity of an organisation (Soni, 2021). Key rotation is an important element in key management and this should be performed on regular basis. Lastly, key management process involves key retirement at the end of key life cycle. WatchIt Capital Ltd could utilise this process for effective key management and enhance cyber security in the organisation. 

Evaluation of metrics for monitoring cyber security efficiencies

Metrics for monitoring cyber security efficiencies include different matrixes such as risk assessment metric, resilience metric, penetration testing metric, vulnerability assessment metric and others.

Risk assessment metrics contain risk likelihood and risk impact. Every risk that is identified in risk register is evaluated for likelihood of risk occurrence and impact in case a particular risk occurs. This evaluation indicates whether a risk is low, moderate, high or extreme. A firm could employ security risk metrics to manage oversight on the process of risk management. This matrix could also involve a percentage of every identified risk and crucial rating. This matrix proves to be effective in prioritising identified risks and making mitigation and response strategy (Marbukh, 2021). Therefore, it is asserted that with the use of this matrix, WatchIt Capital Ltd could efficiently prioritise identified risks related to cyber security. 

Penetration testing metric

This is a technique for identifying vulnerabilities and loopholes in a network of an organisation. Penetration testing metrics could also contain simulated attacks. Since penetration testing is highly costly firms perform this annually or twice a year. However, the landscape of cyber security risk and the threat keeps changing rapidly and a lack of regular tests could increase create vulnerabilities (Ahmed, 2019). Firms to bridge this gap have created novel penetration testing techniques. For instance, Firedrill made Attack IQ, which is a method to perform testing to decide organisational security posture. However, these developed metric is not entirely developed, as a result, not completely efficient. 

Vulnerability assessment metrics

This metric involves the percentage of vital systems with identified vulnerabilities that are unpatched. This metric will assist an organisation to decide if they are executing security patches in an effective manner. Moreover, this metric also allows a firm to evaluate if vulnerabilities are identified in an efficient manner (Ahmed, 2019). This metric also includes exposure time, which is the duration between identification and execution of the path. This could be utilised to calculate if administrators are implementing patches fast enough. This is an efficient metric for organisations to use; therefore, WatchIt Capital Ltd employs this metric to strengthen cyber security in the organisation. 

Conclusion

This Article proposed and discussed a cyber security framework for WatchIt Capital Ltd. This framework contains five elements namely identifying, protecting, detecting, responding, and recovering. All these individual elements play a vital role in strengthening cyber security of a firm. For instance, identification process includes determining the way a cyber security indecent could occur. This article also presented an outline of cyber security policy considered suitable for WatchIt Capital Ltd. Policies proposed to this organisation include a log management policy, updating software regularly, adopting new technology, access control policy and others. Each policy is proposed considering organisational cyber security in mind. For instance, this organisation uses outdated data protection software that creates vulnerability and poses a threat of cyber attack and data loss. Hence, a policy on updating software regularly is proposed. Lastly, this article delineated operational processes and evaluated metrics for monitoring the effectiveness of cyber security efficiencies.