Threat management

8 minutes

It's important to manage any threats and vulnerabilities that were identified during your assessment to defend and protect against cyber incidents. With Microsoft Security solutions like Microsoft Defender, you can confidently address these identified threats and vulnerabilities, ensuring a proactive and resilient system.

Cybersecurity frameworks

A cybersecurity framework (CSF) is a guide that helps organizations manage cybersecurity risks. A CSF often lists high-level outcomes like identifying threats or protecting infrastructure along with standards that can then be used to understand, assess, prioritize, and communicate cybersecurity initiatives. Most CSFs provide guidance on how to meet standards and outcomes without prescribing specific steps to follow.

Many comprehensive threat management systems follow the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0) to proactively manage cyberthreats and lower cyber risk. It's organized around six essential cybersecurity functions that IT teams perform.

Many schools use this framework as a blueprint for increasing cybersecurity protocols and managing threats across functional areas. Although the scope of a CSF can feel overwhelming, checking for alignment or gaps in your infrastructure can dramatically reduce the risks that your school faces throughout the year.

Circle chart of the NIST Cybersecurity Framework. Inner most circle labeled Govern. Outer circle parts are Identify, Protect, Detect, Respond, and Recover.

Govern

The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored.

Organizational Context (GV.OC): The circumstances - mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements - surrounding the organization's cybersecurity risk management decisions are understood.
Risk Management Strategy (GV.RM): The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions.
Roles, Responsibilities, and Authorities (GV.RR): Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated.
Oversight (GV.OV): Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy.
Cybersecurity Supply Chain Risk Management (GV.SC): Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders.

Identify

The organization's current cybersecurity risks are understood.

Asset Management (ID.AM): Assets (for example, data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy.
Risk Assessment (ID.RA): The cybersecurity risk to the organization, assets, and individuals is understood by the organization.
Improvement (ID.IM): Improvements to organizational cybersecurity risk management processes, procedures, and activities are identified across all CSF Functions.

Protect

Safeguards to manage the organization's cybersecurity risks are used.

Identity Management, Authentication, and Access Control (PR.AA): Access to physical and logical assets is limited to authorized users, services, and hardware and managed commensurate with the assessed risk of unauthorized access.
Awareness and Training (PR.AT): The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks.
Data Security (PR.DS): Data are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information.
Platform Security (PR.PS): The hardware, software (for example, firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability.
Technology Infrastructure Resilience (PR.IR): Security architectures are managed with the organization's risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience.

Detect

Possible cybersecurity attacks and compromises are found and analyzed.

Continuous Monitoring (DE.CM): Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events.
Adverse Event Analysis (DE.AE): Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents.

Respond

Actions regarding a detected cybersecurity incident are taken.

Incident Management (RS.MA): Responses to detected cybersecurity incidents are managed.
Incident Analysis (RS.AN): Investigations are conducted to ensure effective response and support forensics and recovery activities.
Incident Response Reporting and Communication (RS.CO): Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies.
Incident Mitigation (RS.MI): Activities are performed to prevent expansion of an event and mitigate its effects.

Recover

Assets and operations affected by a cybersecurity incident are restored.

Incident Recovery Plan Execution (RC.RP): Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents.
Incident Recovery Communication (RC.CO): Restoration activities are coordinated with internal and external parties.