A journey through the NIST Cybersecurity Framework

The first step is about gaining an overview: “Cyberdefence consists of a multitude of demanding challenges,” says Cyrill Peter, Head Cybersecurity Services at Swisscom B2B. “On the one hand there is the complexity, and on the other, the variety of attack techniques. And this in combination with the increasingly shorter reaction times that are required.”

Once the sensitive elements have been identified, the next step is to implement suitable security measures. The second stage of the journey ensures basic protection: the foundation and bulwark against cyber attacks. And these protective measures should be considered from the outset, for example in the development of software and infrastructures, emphasises Stephanie Ramseyer, Security Solution Architect at Swisscom: “My job starts well before the actual development work. First we bring together developers, product managers and others responsible for the product, and set out where the attack surface might be.”

Time plays a key role in this stage. This is because cyber criminals often take their time to look around the company network before striking. This “lateral movement” is used to identify relevant data and gain the widest possible access rights for data outflow and encryption. 

“These days, early detection of cyber attacks is essential for effective cyberdefence,” explains Oliver Stampfli, Head of Cyberdefence B2B at Swisscom. This is because doing so can prevent major damage. “That’s why appropriate detection systems are essential,” also emphasises Andrew Campbell.

We’ve now reached the key stage of the journey. This is where the “crack team” of incident response experts is called for. Modern approaches to cyberdefence assume that the attacker is already inside. This “assume breach” paradigm implies that cyber attacks cannot be completely prevented. Yet the technical containment of an attack is only part of the task – getting the communication right is just as important. “We let people within the company know about incidents,” explains Marco Wyrsch. “But we also notify affected customers, suppliers and partners.” 

However, what matters is that means of communication are also available in this situation. “The incident response can also throw up some surprises,” says Alexander Odenthal, Group Information Security Officer at Swiss Life. “For example, when the usual chat environment that is also used for telephone calls no longer works. That’s why it’s important to test such scenarios beforehand.”

Time and again, we hear reports of companies that have not yet returned to normal operations even weeks or months after a cyber attack. How well they cope with this stage also depends on their preparation. Or, as Marco Wyrsch puts it: “Test, practise and be ready.” 

Backups and, above all, the recovery of data and systems play a major role here. “It’s possible to get caught out by inadequate backup quality or lack of availability due to a cyber attack and the complexity of the restoration process,” says Alexander Odenthal.

Cyberdefence cannot reach its destination without steering. That’s why governance runs through every stage in the Cybersecurity Framework 2.0. It also calls for management to be involved, says Marco Wyrsch: “Investments in cybersecurity will not be effective if management does not put up a protective shield and take responsibility.” This is true regardless of IT operating model, emphasises Pascal Lamia: “Even if IT is outsourced, cybersecurity needs to be discussed at management level. Are we doing enough for our cybersecurity? Are we protecting customer data adequately?” 

This is where risk management comes into play, in order to answer such questions – and indeed before something actually happens, as Georgia Fotaki, Information Security Governance Manager at Swisscom, emphasises: “Risk management isn’t just about reacting. It’s about anticipating what lies ahead of us, being able to adapt and to develop resilience in all areas.”