NIST CYBERSECURITY FRAMEWORK (CSF)

NIST Cybersecurity Framework (CSF)

The NIST Cybersecurity Framework (CSF) helps organizations prioritize activities that improve their security posture and reduce cybersecurity risks. The NIST CSF is organized into five core functions:
Identify, Protect, Detect, Respond, and Recover.

Identify

When Proficio first onboards a new client, we do a deep dive into the organization’s policies, users, systems, applications, and assets to better prioritize our detection and response efforts.

Each client’s environment is thoroughly documented in their runbook which acts as an operational playbook for service delivery. Business context modeling is used to define business critical assets, zones, and security policies to more effectively prioritize alerts and monitor compliance with controls and policies. Proficio uses industry leading vulnerability management scanning technology to discover assets and known vulnerabilities. Vulnerabilities are prioritized by the type of asset and whether the vulnerability is real and exploitable. Proficio uses a patent pending algorithm that quantifies risk and identifies gaps in security controls enabling continuous improvement in an organization’s security program.

Key Capabilities

Risk Assessment
Continuous Asset Discovery
Business Context Modeling
Customized Runbook
Lifecycle Management Services
Gap Analysis and Risk Scoring
Risk-Based Vulnerability Management
Real-Time Security Dashboards

Understand risk in the context of your systems, assets, and data.

Protect

NIST divides this function into the following key sub-categories: access control, awareness and training, data security, and protective technology.

Proficio monitors a client’s security controls and identifies any gaps in these controls across their perimeter, core, endpoints, and cloud. Limiting access to authorized users, processes or devices is critical to protecting data and preventing operational disruption. Proficio monitors user behavior and has developed use cases to detect credential abuse. We offer a full range of lifecycle management services for endpoint detection and response (EDR), next-generation firewalls, WAFs, and other security devices. These services maximize the benefits of perimeter, cloud, and endpoint protections and offload IT team members from tasks like configuration changes, patching, and tuning.

Key Capabilities

Implementing safeguards to protect critical infrastructure and services.

Detect

Not only is it important to detect suspicious activity, but it is also critical to do so in a timely manner. According to the 2019 Data Breach Report, more than half of data breaches took months to discover, underscoring this imperative.

Proficio uses a combination of threat discovery uses cases, AI-based threat hunting models and security analyst investigations to determine which security events should be escalated for incident response. This is all documented in a SOC operations runbook and presented in real-time in security dashboards. Proficio has developed an extensive library of threat discovery use cases and correlations rules that support a wide range of security products. Proficio’s proprietary Threat Intelligence Platform (TIP) enriches log data, provides context to alert notifications, and enables us to more accurately detect threats. We use the MITRE ATT&CK framework to analyze attacks in terms of tactics, techniques, and procedures (TTPs).

Key Capabilities

24/7 Continuous Security Monitoring and Alerting
Threat Discovery Use Cases
Integrated Threat Intelligence
Business Context Modeling
AI-Based Threat Hunting
MITRE ATT&CK Framework
Expert Investigations and Guided Remediation
Risk-Based Vulnerability Management
Real-Time Security Dashboards

Focus on the systems and processes that detect indicators of attack, threats, and anomalies.

Respond

While timely detection of the threat is very important, the respond function focuses efforts to analyze the issue, contain the damage and carry out response actions that minimize the impact of a compromise. An effective response requires planning, communication and coordination with internal and external stakeholders, as well as mitigation and process improvement.

Proficio’s Managed Detection and Response model is designed to automate incident response actions to contain a threat in near real-time and orchestrate a process for recovery. Proficio has developed playbook orchestrations integrated with industry leading products, that perform actions such as blacklisting the address of a known abusive attacker on a firewall. Through our Managed EDR service, we collect event data from the endpoint security solution and provide near-real time event correlation using SIEM use cases and AI/Machine Learning models. Our team of endpoint experts performs investigations and where possible, uses the tool to remediate issues like a virus infection.

Key Capabilities

Managed Detection and Response
Integrated Threat Intelligence
Security Orchestration and Automated Response (SOAR)
Automated and Semi-Automated Containment
Integrations with Industry Leading Security Products
Incident Response Retained Services
IR Planning
Customized Use Case Development
Expert Investigations and Guided Remediation
Risk-Based Vulnerability Management

Minimize the impact of an incident.

Recover

Recovery is an important part of the enterprise risk management lifecycle. It recognizes that despite an organization’s best efforts to detect and prevent attacks, cybersecurity incidents happen. Plans and processes are needed to quickly mitigate the damage.

Proficio can assist our clients to perform incident recovery and advise on process improvements that reduce the risk of an incident requiring recovery. We act as an extension of clients’ security team and in the event of an incident, we support and cooperate with other incident responders researching log data, identifying new use cases, and monitoring compensating controls. Proficio uses a patent pending algorithm that quantifies risk and identifies gaps in security controls, continuously improving in an organization’s security program.

Key Capabilities

Incident Response Planning
Retained Incident Response Services
Strategic Security Advisors
Experts on Call
24/7 Helpdesk
Continuous Asset Discovery
Business Context Modeling
Customized Runbook
Lifecycle Management Services
Gap Analysis and Risk Scoring

Restore impaired capabilities or services.

FORRESTER’S TOTAL ECONOMIC IMPACT REPORT

Forrester’s Total Economic Impact™ Report reveals positive ROI and overall cost savings with Proficio’s Managed Security Services.

Download the Forrester TEI

Learn how Proficio can help your organization meet NIST CSF

Contact a NIST Specialist

Cookie	Duration	Description
cookielawinfo-checkbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.

NIST CYBERSECURITY FRAMEWORK (CSF)