Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
NCM ICT Security Principles is a framework for ICT security published and maintained by the Norwegian National Security Authority (NSM). The security principles advice businesses and organisations on how to protect their information systems from unauthorized access, damage or misuse.
NCM ICT Security Principles is a framework for ICT security published and maintained by the Norwegian National Security Authority (NSM). The security principles advise businesses and organisations on how to protect their information systems from unauthorized access, damage or misuse.
The principles focus on technological and organisational measures. Measures concerning physical security and the human perspective are generally not covered. The measures apply to both unintentional and intentional acts, although the main focus is on intentional acts.
In this framework there are 21 security principles with a total of 118 security measures, distributed across four categories: i) identify, ii) protect and maintain, iii) detect and iv) respond and recover.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
Comply with laws, regulations and the organisation’s guidelines on security monitoring. a) Determine which laws and regulations the organisation is required to comply with. b) Decide how long collected data can be stored. c) Inform staff of what is being collected, what it will be used for and how the data will be processed.
Decide which parts of the ICT system to monitor. This could be: a) The most critical parts of the system or the parts which contain the most confidential information (operating system, database and application). b) Operating systems on devices. c) Internal gateways where data flows through. d) Gateways between internal and external systems, e.g. to the internet. e) Security products (AVS, IDS, IPS, FW etc.) in the information systems. f) Systems for backup and restore.
Decide which data is security-relevant and should be collected. With regard to the parts of the system described in 3.2.3, one should collect the following as a minimum: a) Data relating to access control (successful and unsuccessful log-in attempts), and b) Administration and security logs from devices and services in the ICT systems. With regard to clients, one should record the following as a minimum: c) attempts to run unknown software (cf. 2.3.2), and d) attempts to seek privilege escalation.
Verify that the monitoring is working as intended. a) Check that log settings are working and that the collection works as expected. b) Ensure that all systems which regularly store security-relevant data have sufficient storage space so that crucial data is not lost. c) Use a standardised format so that data can easily be read by third-party log analysis tools.
Prevent manipulation of monitoring-data. a) Archive and sign logs digitally at regular intervals to ensure log integrity. b) Ensure sufficient access control for logs and implement functionality to detect attempted manipulation or deletion of logs. c) Ensure that all components are synchronised with a single time source. d) Gather and consolidate relevant monitoring-data and make available for analysis (see principle 3.3 – Analyse data from security monitoring).
Review the security relevant monitoring-data regularly and, if necessary, reconfigure the monitoring in line with the strategy so that only relevant data is collected and preserved. Remove collected data which no longer has operational or security relevance.
Create a plan for analysing data from security monitoring, including:
• Determining whether the organisation is capable of building its own analytics expertise or whether
to buy it.
• Priority, frequency and resources spent on analytics.
• Tools, services and mechanisms for searching, processing and analysing.
• Administration and further development, including:
o signature-based tools
o desired state of the information system
o methodology and automated processing of collected security-relevant data
o reconfigure tool for collecting security-relevant data
o analytics tools, technology and algorithms for applied machine learning
• Reporting.
• Incident management.
Establish and maintain expertise on the desired state of the organisation’s information systems to be able to detect changes or abnormalities that could indicate unauthorised actions. The desired state needs to be managed over time and should reflect any restructuring, reorganisation, acquisitions, mergers, staff redundancies and changes to the operational concept. Knowledge of the information systems should be good enough that it is possible to identify anomalies that represent a threat. This could include:
• Data flow in breach of permitted data flow as per principle 2.5 – Control data flow
• Data flow at abnormal times and which is not deemed normal traffic.
• Abnormal volumes of data flowing through the network.
Select tools that support manual and automated searches including criteria based alerts. The tool should be able to automatically collate data from different sources to determine more easily whether the incident is genuine (i.e. not a false positive) as well as its scope and nature. Use knowledge of the desired state (see 3.3.2) and threats (see 3.3.4) to improve the tools’ searches and alert criteria. This will help to detect unknown threats at an earlier stage.
Obtain and process threat information from relevant sources and use it to evaluate potential security incidents. This could be data from past attacks or threat information from the authorities, sector CERTs, comparable organisations or open sources.
Continually assess whether the collected data is sufficiently relevant and detailed.
Establish a procedure for escalating alerts, whom to report to, which data to make available and to whom when managing an incident.
Use analytics tools, technology and algorithms (e.g. applied machine learning) to help detect and communicate unknown threats and abnormalities in the security-relevant data.
Plan penetration testing with defined goals and scope. a) Identify important parts of the information system that should be emphasised during testing. b) Identify individual systems or components which are so critical that they must be excluded from the testing. They could be parts of the ICT infrastructure which are vital to maintaining organisation-critical services or which are incapable of withstanding a penetration test (e.g. centralised industrial control systems).
Involve relevant stakeholders in advance. Adapt the type of information being issued and to whom according to the goals and scope of the testing. For example, it will often be appropriate to inform external system monitoring providers prior to testing, but not necessarily users and system management personnel.
Use vulnerability scanning tools and attack tools. Vulnerability scanning can be used as a starting point for the test, while attack tools are used to exploit identified vulnerabilities.
Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.