How to Build the Most Effective Information Security Framework

Build a comprehensive defense against cyberattacks with a strong information security framework that leverages the world's best standards and infosec tools. 

A term like "information security framework" can be interpreted in many different ways, and as such, there are a number of overlapping standards throughout the infosec field. 

Some of these are required for legal compliance — which must be followed to the letter if they apply to you — while others are technically voluntary but highly regarded throughout the industry. It’s wise to learn about all of these mandatory and voluntary standards and decide how best to adopt them alongside the right set of vulnerability assessment and interdiction tools. 

ISO standards: Firm foundations

Given that the International Organization for Standardization (ISO) has guidelines covering all major industries, it's little surprise that they created several focused on infosec: ISO 27001¹ and 27701.² Both were created alongside the International Electrotechnical Commission. 

ISO 27001: Developed around a risk-based approach to information security, in which you continuously identify hazards and select controls to properly address them. ISO 27001's "controls" for infosec are divided into categories including a written security policy, HR security, asset management, access control, cryptography, physical and environmental security, incident management, business continuity management and compliance with government regulations.³

ISO 27701: Focused more on the specific issue of data privacy. In fact, its 2019 update was a direct response to the European Union's implementation of the General Data Protection Regulation (GDPR) the previous year. It requires organizations to factor protection of personally identifiable information (PII) into all information security risk assessments, and demands that data processors or controllers make PII protections their highest priority.⁴

Whether you're a small business or an enterprise with facilities in multiple countries, you're responsible for safeguarding not only customer PII but also that of your workforce. The international standards shouldn't comprise the whole of your infosec practice — in fact, in some cases that would mean being noncompliant - but receiving ISO certification makes a solid foundation for any business's information security program. (Combining the practices of ISO 27001 with a tool like Tenable.sc makes for a particularly potent defense against infosec threats.) 

CIS benchmarks: The infosec professional's infosec guidelines

The Center for Internet Security (CIS), a nonprofit dedicated to promoting sound infosec practices, refers to its Controls and Benchmarks⁵ as "the global standard … for securing IT systems and data against the most pervasive attacks." ⁶

To call CIS Benchmarks "detailed" would be a major understatement: The manual for Windows 10 Enterprise's latest version, for example, is 1,312 pages and covers every single facet of that operating system. It'd be wise to take a look through CIS's library of Benchmarks, find the documents most closely related to your operations and spend some time poring over them as you work to develop the ideal information security framework for your organization's unique needs. 

Industry- and government-mandated standards

All of the following may be required by either industry governing bodies or the government itself, with penalties applying for noncompliance. If your organization falls under their purview, their rules have to be part of your information security program.

HIPAA: If you handle personal health information in the U.S. for any reason, whether as a health care provider or as tertiary material (like employee health data for benefits administration purposes), you must follow the Health Insurance Portability and Accountability Act's (HIPAA) Security Rule.⁷ This mandates the establishment of "administrative, physical and technical safeguards" for any electronically stored PII.

HIPAA doesn't list specific infosec practices to abide by or tools to use. (This is why leveraging multiple standards is necessary to create an information security framework.) One thing that isn't vague, however, is HIPAA's penalty system: Violations can mean penalties ranging from $100 to $1.5 million, depending on an organization's level of culpability.⁸

PCI DSS: Any business, government department or nonprofit that processes debit or credit card payments is subject to the Payment Card Industry Data Security Standards (PCI DSS) created by Visa, MasterCard and American Express.⁹ PCI DSS has more specific requirements for organizations, such as around firewall configurations and encryption. Like HIPAA, violations incur fines — for government and private-sector organizations alike¹⁰ — but instead of being one-time payments, they accrue monthly until the noncompliant party corrects its practices. 

NIST: If you want a lucrative federal contract for your business, you'd better be ready to adopt and maintain the National Institute of Standards and Technology's (NIST) unique Cybersecurity Framework.¹¹ But NIST's basic phases of information security are also an undeniably solid foundation for any organization: identifying cybersecurity risks, preemptively implementing appropriate protections, searching for and detecting anomalous network activity, and enacting immediate response and containment efforts in breaches' wake and data recovery.¹²

DISA: Although the requirements outlined in the Defense Information Systems Agency's (DISA) Security Technical Implementation Guides¹³ are only mandatory for the Defense Department, they're updated more frequently than almost any other infosec protocol, making them an excellent resource for developing your own framework. 

GDPR: These requirements affect any organization that collects or processes personal data from residents of EU member states.¹⁴ Almost all modern organizations will need to implement GDPR standards to at least some extent.

Security framework development 

The first step to any security framework is to get full visibility into your assets. Regardless of which framework you decide to go with, you can’t secure what you can’t see. A vulnerability assessment or vulnerability management solution can help you get a full picture of what’s on your network. 

Once you are ready to create the ideal information security framework, you obviously must start with standards you're legally obligated to follow (HIPAA, GDPR, NIST) and those for which noncompliance is fiscally devastating (PCI DSS). But beyond them, you should consider the value other standards can bring. 

For example, maybe ISO 27001 covers your infosec needs pretty well, but you appreciate CIS's exhaustive guidance for safeguarding the assets you host on Amazon Web Services. Adopting the relevant CIS standards can't hurt your cloud operations and will almost certainly help. Other voluntary certifications may not apply directly to your business, but it's still worthwhile to understand them before deciding whether to follow their guidelines. It's also critical to use vulnerability scanning, penetration testing and threat modeling to project how damaging attacks would be handled under different configurations. 

You need the right tools to help along the way - and at Tenable, we've got them. Nessus Pro, the industry-leading vulnerability assessment solution, is the ideal complement to many information security frameworks, including custom approaches. Alternatively, we offer solutions to help observe specific protocols, such as Tenable.sc's support for ISO 27001 compliance and Tenable.io's PCI ASV variant. 

Learn more and choose the product that’s right for you.

Start Your Free Nessus Trial

_{1. ISO, "ISO/IEC 27001 Information Security Management"
2. ISO, "ISO/IEC 27701:2019 Security Techniques," August 2019
3. IT Governance Blog, "ISO 27001: The 14 Control Sets of Annex A Explained," July 2020
4. IT Governance USA, "ISO 27701: Privacy Information Management Systems"
5. Center for Internet Security, "CIS Benchmarks"
6. Center for Internet Security, "About Us," July 2020
7. American Medical Association, "HIPAA Security Rule & Risk Analysis," December 2019
8. Modern Healthcare, "HHS to Cap HIPAA Fines Based on 'Culpability'," April 2019
9. PCI Security Standards Council, "Maintaining Payment Security"
10. FivePoint Payments, "Do Governments Need to Maintain PCI Compliance?", February 2018
11. National Institute of Standards and Technology, "NIST Cybersecurity Framework"
12. IT Governance USA, "What is the NIST Cybersecurity Framework?"
13. DoD Cyber Exchange, "Security Technical Implementation Guides (STIGs)"
14. GDPR.eu, "Does the GDPR apply to companies outside of the EU?"}