1
.
NIS2 background and basics 🇪🇺
In this video, we provide an overview of the NIS2 directive, explaining its background, reasons for implementation, and key improvements over the original NIS directive. We also present the NIS2 directive's most important contents, related to scope, required security measures and incident reporting. Learn how NIS2 aims to enhance cyber resilience in important industries.
2
.
NIS2's scope and main requirements 🏭
In this video, we go over the most important contents of the NIS2 directive for an end organization, such as industries in scope, required minimum security measures and required incident notification types. The purpose is to understand the key requirements of the directive and how to approach them.
3
.
NIS2 and ISO 27001: Understanding the connection
In this video, we explain the importance and benefits of aligning NIS2 security measures with ISO 27001 standards. NIS2 mandates covering a list of security topics, while ISO 27001 provides detailed controls and best practices for implementing all of those. We highly recommend you base your NIS2 actions against 27001 or other similar broadly accepted security framework.
4
.
Understanding Cyberday 🛡️: An overall introduction
In this video we explain the basics of Cyberday, an ISMS tool that streamlines information security management within Microsoft Teams. By utilizing our universal cyber security language tech, we translate various frameworks into actionable tasks, enhancing compliance across different requirements. I demonstrate how to build a future-proof information security plan, select frameworks, track compliance, and prioritize critical tasks.
5
.
Getting started in Cyberday: Quick evaluations and available support 🛟
In this video, we go through the important first steps when deploying Cyberday and getting to a good start. You will learn how to evaluate the current status of your security measures, how to understand your current compliance level compared to common frameworks like ISO 27001 and how to choose realistic goals for the future.
6
.
Understanding Reporting in Cyberday 📊: Automated compliance reports, policies, procedures and much more
In this video, we explain the importance of reporting in information security work. Cyberday offers different kind of reports to suit different reporting needs - e.g. reporting for an auditor, for authorities, for your own top management, your customers or your internal security team. You can find all the reports from Cyberday's report library and create any of them with our one-click report creation.
7
.
Risk management in Cyberday ⚠️: Automation-assisted, straightforward process
In this video, we discuss the importance of risk management in information security and Cyberday. The main goal is to minimize potential damage from cyber threats while keeping costs balanced. We emphasize the need for a clear and simple process to identify, treat, and implement measures for cyber risks. Viewers are instructed to start with the basics of information security, categorize assets, and prioritize security measures - to have the best potential of creating a successful risk management process and to get most help from automations.
8
.
Asset management in Cyberday : Know what you're protecting
9
.
Incident management 🚩: From identification to continuous improvement
10
.
Continuity management and backups ☢️: Being prepared also for the worst
11
.
Supply chain security in Cyberday 🏢: From inventory to contracts and assessments
12
.
Assessing your security measures 📈: Introduction to popular methods
This article emphasizes the importance of assessing the effectiveness of cybersecurity measures. Regular assessments help organizations understand vulnerabilities, improve security, and maintain a broad view of their security posture. Different methods of assessment include certifications, internal audits, security metrics, management reviews, application security testing, and employee awareness monitoring.
Assessing the effectiveness of your cybersecurity essentially means evaluating how well your current security controls, processes, and structures protect your information assets from various cyber threats. It involves understanding where you stand and what steps are needed to strengthen and improve your cybersecurity position.
Why assessing the effectiveness of security measures is important?
Understandvulnerabilities: Assessments boost your understanding of the different areas of cyber landscape that may be veering towards vulnerability. By identifying these areas, your organization is better equipped to prioritize actions and strengthen these weak points.
Findimprovements: Continuous improvement is the only route towards a strong information security management system.Assessments help you spot improvement ideas which you can then prioritize separately for further development.
Seethe big picture: Information security is such a broad topic, that without specific overall assessments it's easy to lose the big picture and drown on details.
Remember when addressing cybersecurity, a proactive approach is key. Regular assessments are possibilities for you to spot vulnerabilities in advance, before they turn into real-life incidents.
Different ways to assess effectiveness and proportionality of your security measures
There are numerous factors and point-of-views to consider when assessing cybersecurity effectiveness. You can take a very broad approach (e.g. internal audits) reviewing basically everything security-related that you do. You can take a more technological approach (e.g. penetration testing) and get detailed results. And in bestcase, you understand how to combine different approaches to work well for your organization.
We will present the following alternatives in this article:
- Assess security through certifications
- Assesssecurity through internal audits
- Assess security through information security metrics
- Assess security through management reviews
- Assess security through application security testing
- Assess security through employee awareness monitoring
Certifications: Get an external pro to assess your compliance against a framework
Information security certifications are valuable tools for organizations to assess, validate, and demonstrate the robustness of their security measures. These certifications are typically awarded by recognized bodies following a rigorous assessment process.They can help your organizations assess the proportionality of your security measures in multiple ways:
1. Benchmarking & standardization: Certifications provide a benchmark against established standards, such as ISO 27001 orSOC 2. When you're certitied against a standard, your stakeholders know your security measures align with the best practices of this framework that is familiar for many.
2. Third party assessment: Theprocess of obtaining a certification usually involves a thorough external audit conducted by accredited professionals. This external review allows for an unbiased assessment of your security posture, offering insights that might be overlooked internally.
3. Continuous improvement: To maintain certification, organizations must undergo periodic reviews and audits. This encourages continuous improvement and helps ensure that security measures stay effective and relevant as technology and threats evolve.
4. Competitive advantage & customer trust: Havinga recognized security certification can serve as a competitive advantage, demonstrating to clients, partners, and regulators that the organization is committed to maintaining high security standards. Certifications will also help you answer security questionnaires or prove compliance with legal requirements (like NIS2).
Internal audits: Assess your security generally towards a set of requirements
Internal audits in information security are systematic evaluations conducted by an organization to assess how well its information security actions comply with internal policies and external regulatory requirements. Performing an internal information security audits is like giving your organization a comprehensive health check-up - from information security perspective.
These audits aim to ensure that the organization's data handling and processing practices are secure, data integrity is maintained, and the risks related to cybersecurity threats are minimized. Whenyou spot something that isn't compliant, you document a non-conformity that needs to be separately fixed, to ensure continuous improvement.
You might decide e.g. to carry out two internal audits each year - and to cover yourwhole information security management systemwith internal audits every 3 years. These are quite normal approaches in ISO 27001 certified organizations. Youcan of course also use help of external consultants or partners to carry out these audits.
Information security metrics: Assess security by choosing key numbers to follow
Information security metrics are quantitative measures that help organizations assess the effectiveness of their security measures. These metrics are critical for monitoring the health of an organization's information security program, demonstrating compliance with regulations, and making informed decisions regarding security investments.
Good security metrics should combine different security point-of-views. Some examples:
Organizationalmetrics: Overdue items in your ISMS, compliance score towards a framework, amount of risks identified, amount of improvements done, time to fix a non-conformity
Technologicalmetrics: Timeto identify an incident, amount of identified vulnerabilities, % of centrally monitored access rights
People metrics: %of guidelines read, skill test average results, % of yearlytraining completed
Other approaches for assessing your security measures
Management reviews: Commit your top management through "big picture reviews"
Management reviews are periodic evaluations conducted by top management. They go through main information security aspects (e.g. resource allocation, overall progress towards objectives, results of risk management, internal audits) and document down management's view on things along with wanted additional actions. Management reviews can be arranged as meetings e.g. twice a year, where security key people present things for top management.
Application security testing: Assess how well your key assets are protected against technical vulnerabilities
Securitytesting refers to the suite of processes used to evaluate and identify vulnerabilities in information systems, applications, and networks. Here theapproach to assessing security is very technological, and thus only highlights certain vulnerabilities.
If your organization is working primarly on software development, tools like vulnerability scanning, penetration testing, application security audits andeven ethical hacking can be important for regularly assessing your security measures.
Employee awareness: Assess do your people act securely in everyday work?
Testing the awareness of your employees is also a crucial component of assessing an organization's overall information security measures. Goal is to evaluate how well employees understand and comply with organization's security policies, and how effectively they can respond to potential security threats on everyday work. At best, employees are the active first line of defense.
Tomonitor your "peoplecontrols", youmight choose tools like phishing simulations, security skill tests / quizzes, simulated social engineering attacks or incident response drills toassess your security.
Assessing the effectiveness of your cybersecurity essentially means evaluating how well your current security controls, processes, and structures protect your information assets from various cyber threats. It involves understanding where you stand and what steps are needed to strengthen and improve your cybersecurity position.
Why assessing the effectiveness of security measures is important?
Understandvulnerabilities: Assessments boost your understanding of the different areas of cyber landscape that may be veering towards vulnerability. By identifying these areas, your organization is better equipped to prioritize actions and strengthen these weak points.
Findimprovements: Continuous improvement is the only route towards a strong information security management system.Assessments help you spot improvement ideas which you can then prioritize separately for further development.
Seethe big picture: Information security is such a broad topic, that without specific overall assessments it's easy to lose the big picture and drown on details.
Remember when addressing cybersecurity, a proactive approach is key. Regular assessments are possibilities for you to spot vulnerabilities in advance, before they turn into real-life incidents.
Different ways to assess effectiveness and proportionality of your security measures
There are numerous factors and point-of-views to consider when assessing cybersecurity effectiveness. You can take a very broad approach (e.g. internal audits) reviewing basically everything security-related that you do. You can take a more technological approach (e.g. penetration testing) and get detailed results. And in bestcase, you understand how to combine different approaches to work well for your organization.
We will present the following alternatives in this article:
- Assess security through certifications
- Assesssecurity through internal audits
- Assess security through information security metrics
- Assess security through management reviews
- Assess security through application security testing
- Assess security through employee awareness monitoring
Certifications: Get an external pro to assess your compliance against a framework
Information security certifications are valuable tools for organizations to assess, validate, and demonstrate the robustness of their security measures. These certifications are typically awarded by recognized bodies following a rigorous assessment process.They can help your organizations assess the proportionality of your security measures in multiple ways:
1. Benchmarking & standardization: Certifications provide a benchmark against established standards, such as ISO 27001 orSOC 2. When you're certitied against a standard, your stakeholders know your security measures align with the best practices of this framework that is familiar for many.
2. Third party assessment: Theprocess of obtaining a certification usually involves a thorough external audit conducted by accredited professionals. This external review allows for an unbiased assessment of your security posture, offering insights that might be overlooked internally.
3. Continuous improvement: To maintain certification, organizations must undergo periodic reviews and audits. This encourages continuous improvement and helps ensure that security measures stay effective and relevant as technology and threats evolve.
4. Competitive advantage & customer trust: Havinga recognized security certification can serve as a competitive advantage, demonstrating to clients, partners, and regulators that the organization is committed to maintaining high security standards. Certifications will also help you answer security questionnaires or prove compliance with legal requirements (like NIS2).
Internal audits: Assess your security generally towards a set of requirements
Internal audits in information security are systematic evaluations conducted by an organization to assess how well its information security actions comply with internal policies and external regulatory requirements. Performing an internal information security audits is like giving your organization a comprehensive health check-up - from information security perspective.
These audits aim to ensure that the organization's data handling and processing practices are secure, data integrity is maintained, and the risks related to cybersecurity threats are minimized. Whenyou spot something that isn't compliant, you document a non-conformity that needs to be separately fixed, to ensure continuous improvement.
You might decide e.g. to carry out two internal audits each year - and to cover yourwhole information security management systemwith internal audits every 3 years. These are quite normal approaches in ISO 27001 certified organizations. Youcan of course also use help of external consultants or partners to carry out these audits.
Information security metrics: Assess security by choosing key numbers to follow
Information security metrics are quantitative measures that help organizations assess the effectiveness of their security measures. These metrics are critical for monitoring the health of an organization's information security program, demonstrating compliance with regulations, and making informed decisions regarding security investments.
Good security metrics should combine different security point-of-views. Some examples:
Organizationalmetrics: Overdue items in your ISMS, compliance score towards a framework, amount of risks identified, amount of improvements done, time to fix a non-conformity
Technologicalmetrics: Timeto identify an incident, amount of identified vulnerabilities, % of centrally monitored access rights
People metrics: %of guidelines read, skill test average results, % of yearlytraining completed
Other approaches for assessing your security measures
Management reviews: Commit your top management through "big picture reviews"
Management reviews are periodic evaluations conducted by top management. They go through main information security aspects (e.g. resource allocation, overall progress towards objectives, results of risk management, internal audits) and document down management's view on things along with wanted additional actions. Management reviews can be arranged as meetings e.g. twice a year, where security key people present things for top management.
Application security testing: Assess how well your key assets are protected against technical vulnerabilities
Securitytesting refers to the suite of processes used to evaluate and identify vulnerabilities in information systems, applications, and networks. Here theapproach to assessing security is very technological, and thus only highlights certain vulnerabilities.
If your organization is working primarly on software development, tools like vulnerability scanning, penetration testing, application security audits andeven ethical hacking can be important for regularly assessing your security measures.
Employee awareness: Assess do your people act securely in everyday work?
Testing the awareness of your employees is also a crucial component of assessing an organization's overall information security measures. Goal is to evaluate how well employees understand and comply with organization's security policies, and how effectively they can respond to potential security threats on everyday work. At best, employees are the active first line of defense.
Tomonitor your "peoplecontrols", youmight choose tools like phishing simulations, security skill tests / quizzes, simulated social engineering attacks or incident response drills toassess your security.
13
.
Internal audits in Cyberday ☑️: Overall introduction
14
.
Cyber hygiene and personnel security awareness 🧑💼: Intro to guidelines and training in Cyberday
In this video, we discuss the importance of security awareness in information security management. We demo the related features in Cyberday and highlight the need for clarifying security responsibilities for "normal" employees, taking advantage of automation processes, and starting with basic guidelines and examples rather than aiming for perfection in the beginning.
15
.
Encryption #️⃣: Additional protection layer for your data
This is the intro
This is the longer text version
This is the longer text version
16
.
Other important NIS2 topics: HR security, access, MFA and system management
17
.
NIS2 compliance report 🌐: Understanding your progress and standing
18
.
Continuous improvement in Cyberday ⏫: Overall introduction
