Tool Library For Security Assessments
egrizzly
Member Posts: 533 ■■■■■□□□□□
Hi all,
Is there somewhere where you can get a "library of tools organized according to the solution they provide for each "requirement" outlined in the NIST CSF framework? For instance, for the controls identified below namely ID.AM-1, there would be a list of commonly available software such as LanSweeper, etc, and a control like ID.AM-2 would have names like "Asset Explorer, Asset Panda, etc as part of the library?
What problem does it solve? Well if a comprehensive tool library such as this for security assessments was available then security practitioners would not have to go through the pains researching the available tools to meet each and every control they need.
Is there somewhere where you can get a "library of tools organized according to the solution they provide for each "requirement" outlined in the NIST CSF framework? For instance, for the controls identified below namely ID.AM-1, there would be a list of commonly available software such as LanSweeper, etc, and a control like ID.AM-2 would have names like "Asset Explorer, Asset Panda, etc as part of the library?
What problem does it solve? Well if a comprehensive tool library such as this for security assessments was available then security practitioners would not have to go through the pains researching the available tools to meet each and every control they need.
B.Sc (Info. Systems), CISSP, CCNA, CCNP, Security+
Tagged:
Comments
-
SteveLavoie
Member Posts: 1,133 ■■■■■■■■■□
I never saw this kind of listing. There are so many tools and so many different company that it may be impossible to build a right list.
By example, ID.AM-1 and ID.AM-2 could be satisfied by an Excel spreadsheet and a few Powershell script. It is viable if you dont have a big network. But it's not viable in larger one.
-
egrizzly
Member Posts: 533 ■■■■■□□□□□
SteveLavoie said:I never saw this kind of listing. There are so many tools and so many different company that it may be impossible to build a right list.
By example, ID.AM-1 and ID.AM-2 could be satisfied by an Excel spreadsheet and a few Powershell script. It is viable if you dont have a big network. But it's not viable in larger one.
Me neither, but having a list like this would be super convenient, instead of having to manually go through the selection process by searching google, then contact each company with the associated tool and schedule demos....then selecting a product. Their's no "silver bullet" list....true, however a good number of organizations would typically use the same tools for the same reasons. I know so as I've used EDR tools like CrowdStrike and Carbon Black in three completely different companies back-to-back, and they were there for the exact same NIST controls.B.Sc (Info. Systems), CISSP, CCNA, CCNP, Security+ -
JDMurray
Admin Posts: 13,025 Admin
NIST CSF is a "framework" and therefore independent of vendors and organizations. Someone might tackle compiling a generalized list of CS-compliant tools, but such a list will be only a guideline and never be perfectly tailored for any organization. You would need to compare the tools listed to that listed in Gartner Magic Quadrants to see what are the "best" in function for your org and price for your budget. Also realize that there is rarely a 1-to-1 mapping of a single product to a single subcategory.
Forum Admin at www.techexams.net
--
LinkedIn: www.linkedin.com/in/jamesdmurray
Twitter: www.twitter.com/jdmurray -
UnixGuy
Mod Posts: 4,564 Mod
That's because this is not a 'tool' issue.Those are controls, you pick and choose what's relevant to your environment and you prioritise accordingly. Then, so meet the control's requirement it's not always a 'tool'. Usually it's a mix of people/process and yes a tool.The example you have above is Asset inventory, the solution is most definitely not a tool. You can have a spreadsheet or even RSA Archer, that alone won't solve anything. Who is going to populate the inventory? how often? who's going to review? how are you going to ensure that it is consistent and complete? (so it;s a mix of process, procedures, testing, people, and a tool).Also tools change and evolve, it doesn't really matter what tool you use today vs in 20 yrs time, Asset management as a concept is not going to change.Data protection is data protection, whether you do it in house SAN storage, in the cloud, or in a sattelite somewhere, the principles of protecting data remain the same -
egrizzly
Member Posts: 533 ■■■■■□□□□□
-
UnixGuy
Mod Posts: 4,564 Mod
@egrizzly I'm not aware of any mapping, but you might find something online. It's just really hard and context dependent, a spreadsheet might be sufficient for one organisation but not for another. I just am not a fan of thinking in terms of 'tools', that's when problems happen
-
SteveLavoie
Member Posts: 1,133 ■■■■■■■■■□
Just kidding