Building new skill sets for NIST CSF 2.0

The enhancements to the NIST CSF include several different topics, including governance, data security, and access management. However, many of the changes are focused on incident response and recovery.

Enhancing incident response and NIST CSF 2.0 Compliance with HTB

The NIST CSF has included Respond and Recover functions since the beginning. The latest updates to the framework include various steps to formalize the process. 

As shown in the infographic above, the Respond function (RS) now includes requirements:

• For applying criteria for starting incident response

• Collecting and preserving data about the incident

• Estimating the scope of the incident. 

New Recovery requirements include verifying that backups are clean and that systems are restored to a normal, secure state.

💡HTB Academy’s SOC Analyst job role path, alongside blue team labs provides training on the key skills needed to perform incident detection and digital forensics. This includes both new and existing requirements in the NIST CSF’s Respond (RS) function.

Addressing Emerging Threats with NIST

Alongside new requirements and sub-requirements, the new version of the NIST CSF includes sections highlighting risk management programs focused on specific threats, such as AI, supply chain attacks, and data privacy risks. 

These sections point to related NIST standards that organizations can use to address:

Risk management and assessment

Risk assessment and management require the ability to identify potential vulnerabilities and gauge the risk they pose to the organization. NIST recommends its Risk Management Framework (RMF) for implementing a corporate risk management program.

💡 Risk assessment is also a key skill for any HTB Machine. Learners need to identify the vulnerabilities and configuration errors most likely to allow them to achieve their goals.

Privacy risks

Data privacy and data security are related areas that overlap where cyberattacks pose a risk to an individual’s privacy, such as the potential for financial losses or physical harm. 

The NIST Privacy Framework complements the NIST CSF by providing a privacy-focused approach to data management.

Many of the skills taught and tested by HTB relate directly to the potential for data theft. For example, check out resources on SQL injection, cross-site scripting, and password security using the Academy x HTB Labs mapping tool.

Supply chain security risks

Supply chain attacks exploit vulnerable partner organizations or insecure or malicious dependencies used within an application. 

The most famous example of a supply chain attack is likely the SolarWinds breach. Attackers with access to SolarWinds’ development environment injected malicious code into an update to their Orion product, which was then pushed out to customers.

In addition to a sub-requirement focused on supply chain risks, NIST has published NIST SP 800-161 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. 

💡 HTB has numerous courses, Labs, and Machines focused on supply chain security. For example, the ICS & SCADA security path on Dedicated Labs equips teams with a strong hands-on foundation of the intricate interplay of software, hardware, and network layers, including components such as SCADA systems.