Building A Cybersecurity Program From Scratch - Thoughts?

egrizzly

Salutations to all the CISOs, Cyber Managers, and Directors out there.  If you have the time could you go through these steps in setting up a cybersecurity program from the scratch and offer your thoughts?  A dozen thanks in advance for the suggestions and tips.  You can also use the link at the very bottom if viewing/downloading the stand-alone PDF is better.

Setup A Cybersecurity Program From Scratch
from ChatGPT 4

 This is for a 200 user office.

 Step 1: Identify

1. **Risk Assessment**: Use tools like Tenable Nessus for comprehensive vulnerability scanning.

2. **Asset Management**: Implement an asset management system using IBM Maximo.

3. **Business Environment Understanding**: Collaborate with department heads using collaborative tools like Microsoft Teams for insights.

4. **Governance**: Develop policies and procedures with guidance from frameworks like ISO 27001.

 

Step 2: Protect

1. **Access Control**: Deploy Cisco Identity Services Engine (ISE) for network access control.

2. **Awareness and Training**: Use KnowBe4 for cybersecurity awareness training.

3. **Data Security**: Implement Symantec Endpoint Protection for data encryption and security.

4. **Maintenance**: Use ManageEngine Patch Manager Plus for system updates and patching.

5. **Protective Technology**: Install Cisco ASA 5525-X Firewalls for network protection.

 

Step 3: Detect

1. **Anomalies and Events**: Utilize Splunk Enterprise for security information and event management (SIEM).

2. **Continuous Monitoring**: Implement SolarWinds Network Performance Monitor for network monitoring.

3. **Detection Processes**: Establish processes using Splunk insights and alerts.

 

Step 4: Respond

1. **Response Planning**: Document incident response plans using Microsoft SharePoint for organization and accessibility.

2. **Communications**: Set up a rapid response communication channel with Slack.

3. **Analysis**: Utilize IBM QRadar for in-depth incident analysis.

4. **Mitigation**: Have a ready-to-deploy response toolkit with tools like Cisco Advanced Malware Protection (AMP).

 

Step 5: Recover

1. **Recovery Planning**: Use Veeam Backup & Replication for data recovery solutions.

2. **Improvements**: Post-incident, update protocols and tools based on lessons learned.

3. **Communications**: Prepare templates for external communication in the event of an incident using MailChimp.

 

Continuous Improvement

- Regularly assess the effectiveness of implemented tools and adapt as needed.

- Engage in ongoing training and certification programs for staff on the latest cybersecurity practices.

- Stay updated with cybersecurity trends and evolve the program accordingly.

 LINK TO STAND-ALONE DOCUMENT

HIRING

### During the Initial Phase (Identify and Early Protect Phase)

 

1. **Cybersecurity Program Manager**: This is one of the first roles to hire. This individual will oversee the development and implementation of the cybersecurity program, coordinate the team, and ensure alignment with business objectives.

 

2. **Cybersecurity Analyst/Engineer**: Responsible for conducting the initial risk assessment, identifying vulnerabilities, and starting the implementation of protective measures. This role involves hands-on technical work, including setting up firewalls (like pfSense), and other security measures.

 

### During the Protect Phase

 

3. **Network Security Specialist**: Once you start setting up network security measures (like firewalls, VPNs, etc.), a specialist in network security is crucial. They will configure and maintain these systems, ensuring robust network defense.

 

4. **Systems Administrator with a Security Focus**: Responsible for implementing and maintaining the overall IT infrastructure with a focus on security, including the deployment of updates and patches.

 

### During the Detect Phase

 

5. **Security Operations Center (SOC) Analyst**: As you implement detection systems like Security Onion for SIEM, a SOC analyst becomes crucial. They monitor, analyze, and respond to security alerts.

 

### During the Respond and Recover Phases

 

6. **Incident Response Manager/Coordinator**: Hired to develop and manage the incident response plan. They lead the efforts in case of a security breach and coordinate the response.

 

7. **Disaster Recovery Specialist**: Focuses on implementing and maintaining the recovery solutions like Clonezilla and ensuring that data backup and recovery processes are robust and tested.

 

### Throughout the Process

 

8. **Cybersecurity Trainer/Educator**: Responsible for developing and delivering ongoing cybersecurity training to the staff, a key component of the Protect phase.

 

9. **Compliance Officer**: Particularly important if the business operates in a regulated industry. This role ensures that cybersecurity policies and procedures comply with legal and regulatory requirements.

 

### Continuous Improvement Phase

 

10. **IT Auditor/Cybersecurity Auditor**: Hired to regularly assess the effectiveness of the cybersecurity measures, identify gaps, and recommend improvements.

 

### Additional Considerations

 

- **Outsourcing Options**: For an office with 200 endpoints, consider whether some roles could be outsourced, especially highly specialized ones, to managed security service providers (MSSPs).

- **Cross-Training**: Encourage cross-training among your IT staff. For example, a systems administrator might also be trained in basic incident response or network security.

- **Professional Development**: Invest in continuous professional development for your cybersecurity team, including certifications and training in the latest cybersecurity trends and technologies.

JDMurray

What's the size of your org and your budget, your timeline for Initial Operating Capability, and how high up in your org will this program be championed?

FluffyBunny

I for one wouldn't use ChatGPT as the primary source for my security program. Instead, I'd start with one of the bigger frameworks, like the CSC18 (critical security controls). 

Now, step 1 of 1 is already where I dislike that ChatGPT output.

1. **Risk Assessment**: Use tools like Tenable Nessus for comprehensive vulnerability scanning.

Nessus or vulnerability scanning has nothing to do with risk assessing your organisation. 

CSC20, ISO27001 and NIST CSF and the likes exist for a reason. 

UnixGuy

you need someone with actual experience to spend some time at the organisation that this program is for. It's not something that can be done on a forum post and yeah that chatgpt answer is a disaster, I hope thats not used in a real environment