NIST
NIST Cybersecurity Framework (CSF)
Scenario: Cyberattack on Acme Corp.
Background:
Acme Corp., a mid-sized technology firm, recently experienced a sophisticated cyberattack. Their customer database, financial records, and internal communications were compromised. The security team is investigating the incident and implementing measures to prevent future attacks.
Your task is to apply the NIST Cybersecurity Framework (CSF) to help Acme Corp. identify threats, detect intrusions, respond effectively, and recover operations.
Question 1: Identifying Critical Assets
Before responding to the attack, Acme Corp. must identify its most critical assets and potential risks.Which NIST CSF function should be prioritized?
Question 2: Evaluating Supply Chain Risks
Investigation reveals that a third-party vendor handling cloud storage was the initial attack vector. What NIST CSF category should be used to assess external security risks?
Question 3: Detecting Anomalous Activity
Acme Corp.’s SIEM system flagged unusual outbound data transfers at 2 AM from an employee account that wasn’t active during that time. Which NIST CSF function should be used to analyze this?
Question 4: Strengthening Access Control
The attack exploited weak employee passwords to gain access to sensitive systems. The security team is now implementing Multi-Factor Authentication (MFA). Which NIST CSF function and category does this align with?
Question 5: Securing Sensitive Data
The attackers exfiltrated customer data. Acme Corp. now wants to implement encryption and Data Loss Prevention (DLP). Which NIST CSF category applies?
Question 6: Incident Response Plan Activation
Once the attack was detected, Acme Corp.’s Incident Response Team (IRT) took charge. What NIST CSF function covers this phase?
Question 7: Communicating the Incident
Acme Corp. needs to notify customers, regulators, and law enforcement about the data breach. Which NIST CSF category covers incident-related communication?
Question 8: Root Cause Analysis
Security teams conduct a post-incident analysis to determine how the attack happened and prevent recurrence. What NIST CSF function supports this?
Question 9: Restoring Business Operations
Acme Corp. suffered severe downtime due to the attack. IT teams are now restoring services, validating system integrity, and re-establishing normal operations. Which NIST CSF category does this fall under?
Question 10: Continuous Monitoring and Future Prevention
Acme Corp. decides to increase security monitoring, deploy AI-driven anomaly detection, and conduct regular cybersecurity training for employees. Which NIST CSF category applies?