Cyber Defense Matrix

├── .gitignore ├── 404.html ├── LICENSE.md ├── README.md ├── _config.yml ├── _data └── ow_attributions.json ├── assets └── images │ ├── CyberDefenseMatrix.png │ ├── README.md │ └── cyberdefensematrix.svg ├── index.md ├── info.md ├── leaders.md ├── subproject ├── index.md └── info.md ├── tab_media.md └── tab_todo.md /.gitignore: -------------------------------------------------------------------------------- 1 | /Gemfile 2 | /Gemfile.lock 3 | /favicon.ico 4 | _site/ -------------------------------------------------------------------------------- /404.html: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | title: 404 - Not Found 4 | layout: col-generic 5 | 6 | --- 7 | 8 |

9 |

10 |

WHOA THAT PAGE CANNOT BE FOUND

11 |

Try the SEARCH function in the main navigation to find something. If you are looking for chapter information, please see Chapters for the correct chapter. For information about OWASP projects see Projects. For common attacks, vulnerabilities, or information about other community-led contributions see Contributed Content.

12 | 13 |

14 |

If all else fails you can search our historical site.

15 |

16 | -------------------------------------------------------------------------------- /LICENSE.md: -------------------------------------------------------------------------------- 1 | The Cyber Defense Matrix, originally created by Sounil Yu [

](https://www.linkedin.com/in/sounil/)[

](https://twitter.com/sounilyu), is licensed under the [Creative Commons Attribution-ShareAlike 4.0 license](http://creativecommons.org/licenses/by-sa/4.0/), so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one. 2 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Introduction to the Cyber Defense Matrix 2 | 3 | This Project has beed archived. Content remains for historical purposes. 4 | 5 | Imagine going into a grocery store to shop for Thanksgiving dinner, but instead of seeing nice, orderly aisles, you see a massive pile of food in the middle of the grocery store. Finding the ingredients that you need to make dinner is going to be extremely hard because there’s no organizational system helping you understand where things are. The disorganization makes it very difficult to find what you need and compare competing products. 6 | 7 | The cybersecurity vendor marketplace is like this disorganized grocery store. A proof of this assertion can be seen by looking at the vendor hall at any major security conference. The cacophony of sounds from vendors hawking their wares, the confusing language of the vendor’s marketecture, and the lack of any semblance of organization (aside from biggest to smallest) does not help buyers understand what they need or where to find it. 8 | 9 | Because the cybersecurity community does not use consistent terminology to describe what we need, there is much confusion about what many vendor products actually do. Instead of a clear articulation of a product's capabilities, we are bombarded with overused, trendy jargon that usually leaves us wondering if the product can really solve any of our problems. Some security teams even organize themselves according to the jargon. We need to stop letting marketing pitches dictate our terminology and not lose sight of the more bland descriptors that actually tell us what something does. 10 | 11 | The Cyber Defense Matrix helps us understand what we need organized through a logical construct so that when we go into the security vendor marketplace, we can quickly discern what products solve what problems and be informed on what is the core function of a given product. In addition, the Cyber Defense Matrix provides a mechanism to ensure that we have capabilities across the entire spectrum of options to help secure our environments. 12 | 13 | Although the Cyber Defense Matrix was initially created to help organize security technologies, many other use cases have been discovered to help build, manage, and operate a security program. This project intends to capture these use cases and their implementations to help security practitioners mature their security programs. 14 | 15 | # Structure of the Cyber Defense Matrix 16 | 17 | The basic construct of the Cyber Defense Matrix starts with two dimensions. The first dimension captures the five operational functions of the NIST Cybersecurity Framework: 18 | 19 | | IDENTIFY | PROTECT | DETECT | RESPOND | RECOVER | 20 | |----------|---------|--------|---------|---------| 21 | 22 | The second dimension captures five assets classes that we try to secure: 23 | 24 | | DEVICES | 25 | |:---:| 26 | | **APPLICATIONS** | 27 | | **NETWORKS** | 28 | | **DATA** | 29 | | **USERS** | 30 | 31 | When these two dimensions are put into a grid, we arrive at with a five-by-five matrix that we call the “Cyber Defense Matrix.” 32 | 33 | ![Cyber Defense Matrix](/assets/images/CyberDefenseMatrix.png "Cyber Defense Matrix") 34 | 35 | There is one more important piece of this matrix. At bottom of the grid, we show a continuum that characterizes the degree of dependency on technology, people, and process as we progress through the five operational functions of the NIST Cybersecurity Framework. TECHNOLOGY plays a much greater role in IDENTIFY and PROTECT. As we move to DETECT, RESPOND, and RECOVER, our dependency on TECHNOLOGY diminishes and our dependency on PEOPLE grows. Throughout all five operational functions, there's a consistent level of dependency on PROCESS. This continuum helps us understand where we might have imbalances in our reliance on PEOPLE, PROCESS, and TECHNOLOGY when trying to tackle our cybersecurity challenges. 36 | 37 | We believe that this matrix is a realistic model describes a broad range of cybersecurity practices. In this website, you will find several insights on the Cyber Defense Matrix and examples of how to leverage it to address the challenges that we face in cybersecurity. 38 | 39 | If you discover a new use of the Cyber Defense Matrix, we would love to hear about it. Likewise, if you find a problem with the matrix in that it doesn't seem to properly describe something that we do in cybersecurity, please point that out, and we'll either adjust the matrix or clarify how that perceived discrepancy can be addressed or explained through the matrix. 40 | 41 | # How can I participate in this project? 42 | Everyone is invited to collaborate on this project. Contact the [Project Leaders](leaders.md "Project Leaders"). The project needs different skills and expertise and different times during its development. Currently, we are looking for help in the following areas: 43 | 44 | - Documenting new use cases 45 | - Developing a website / system to capture everything that is mapped to the Cyber Defense Matrix. This includes: 46 | - Mapping of vendors 47 | - Mapping of NIST NICE NCWF skillsets 48 | - Mapping of measurements and metrics 49 | - Security design patterns 50 | 51 | -------------------------------------------------------------------------------- /_config.yml: -------------------------------------------------------------------------------- 1 | remote_theme: "owasp/www--site-theme@main" 2 | plugins: 3 | - jekyll-include-cache-0.2.0 4 | 5 | -------------------------------------------------------------------------------- /_data/ow_attributions.json: -------------------------------------------------------------------------------- 1 | ["Sounil Yu"] 2 | -------------------------------------------------------------------------------- /assets/images/CyberDefenseMatrix.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-cyber-defense-matrix/1a08951d3eef0495fd4fda06f6294ee7bdb33469/assets/images/CyberDefenseMatrix.png -------------------------------------------------------------------------------- /assets/images/README.md: -------------------------------------------------------------------------------- 1 | # placeholder 2 | 3 | Put images you wish to link to in this folder 4 | 5 | link would be in form /assets/images/ 6 | -------------------------------------------------------------------------------- /assets/images/cyberdefensematrix.svg: -------------------------------------------------------------------------------- 1 | 42 | -------------------------------------------------------------------------------- /index.md: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | layout: col-sidebar 4 | title: OWASP Cyber Defense Matrix 5 | tags: cyberdefensematrix 6 | level: 2 7 | type: documentation 8 | 9 | --- 10 | 11 | [![Twitter Follow](https://img.shields.io/twitter/follow/cyberdefmatrix.svg?style=social&label=Follow)](https://twitter.com/cyberdefmatrix) 12 | 13 | 14 | # Introduction 15 | 16 | Imagine going into a grocery store to shop for Thanksgiving dinner, but instead of seeing nice, orderly aisles, you see a massive pile of food in the middle of the grocery store. Finding the ingredients that you need to make dinner is going to be extremely hard because there’s no organizational system helping you understand where things are. The disorganization makes it very difficult to find what you need and compare competing products. 17 | 18 | The cybersecurity vendor marketplace is like this disorganized grocery store. A proof of this assertion can be seen by looking at the vendor hall at any major security conference. The cacophony of sounds from vendors hawking their wares, the confusing language of the vendor’s marketecture, and the lack of any semblance of organization (aside from biggest to smallest) does not help buyers understand what they need or where to find it. 19 | 20 | Because the cybersecurity community does not use consistent terminology to describe what we need, there is much confusion about what many vendor products actually do. Instead of a clear articulation of a product's capabilities, we are bombarded with overused, trendy jargon that usually leaves us wondering if the product can really solve any of our problems. Some security teams even organize themselves according to the jargon. We need to stop letting marketing pitches dictate our terminology and not lose sight of the more bland descriptors that actually tell us what something does. 21 | 22 | The Cyber Defense Matrix helps us understand what we need organized through a logical construct so that when we go into the security vendor marketplace, we can quickly discern what products solve what problems and be informed on what is the core function of a given product. In addition, the Cyber Defense Matrix provides a mechanism to ensure that we have capabilities across the entire spectrum of options to help secure our environments. 23 | 24 | Although the Cyber Defense Matrix was initially created to help organize security technologies, many other use cases have been discovered to help build, manage, and operate a security program. This project intends to capture these use cases and their implementations to help security practitioners mature their security programs. 25 | 26 | # Structure of the Cyber Defense Matrix 27 | 28 | The basic construct of the Cyber Defense Matrix starts with two dimensions. The first dimension captures the five operational functions of the NIST Cybersecurity Framework: 29 | 30 |

IDENTIFY	PROTECT	DETECT	RESPOND	RECOVER

31 | 32 | The second dimension captures five assets classes that we try to secure: 33 | 34 | |DEVICES| 35 | |:---:| 36 | |**APPLICATIONS**| 37 | |**NETWORKS**| 38 | |**DATA**| 39 | |**USERS**| 40 | 41 | When these two dimensions are put into a grid, we arrive at a five-by-five matrix that we call the “Cyber Defense Matrix.” 42 | 43 | ![Cyber Defense Matrix](assets/images/CyberDefenseMatrix.png "Cyber Defense Matrix") 44 | 45 | There is one more important piece of this matrix. At bottom of the grid, we show a continuum that characterizes the degree of dependency on technology, people, and process as we progress through the five operational functions of the NIST Cybersecurity Framework. TECHNOLOGY plays a much greater role in IDENTIFY and PROTECT. As we move to DETECT, RESPOND, and RECOVER, our dependency on TECHNOLOGY diminishes and our dependency on PEOPLE grows. Throughout all five operational functions, there's a consistent level of dependency on PROCESS. This continuum helps us understand where we might have imbalances in our reliance on PEOPLE, PROCESS, and TECHNOLOGY when trying to tackle our cybersecurity challenges. 46 | 47 | We believe that this matrix is a realistic model describes a broad range of cybersecurity practices. In this website, you will find several insights on the Cyber Defense Matrix and examples of how to leverage it to address the challenges that we face in cybersecurity. 48 | 49 | If you discover a new use of the Cyber Defense Matrix, we would love to hear about it. Likewise, if you find a problem with the matrix in that it doesn't seem to properly describe something that we do in cybersecurity, please point that out, and we'll either adjust the matrix or clarify how that perceived discrepancy can be addressed or explained through the matrix. 50 | 51 | # How can I participate in this project? 52 | 53 | Everyone is invited to collaborate on this project. Contact the [Project Leaders](leaders.md "Project Leaders"). The project needs different skills and expertise and different times during its development. Currently, we are looking for help in the following areas: 54 | 55 | - Documenting new use cases 56 | - Developing a website / system to capture everything that is mapped to the Cyber Defense Matrix. This includes: 57 | - Mapping of vendors 58 | - Mapping of NIST NICE NCWF skillsets 59 | - Mapping of measurements and metrics 60 | - Security design patterns 61 | 62 | -------------------------------------------------------------------------------- /info.md: -------------------------------------------------------------------------------- 1 | [![Incubator Project][inc-proj-logo]{:height="66px"}][inc-proj] ![Documentation Project][doc-proj-logo] 2 | 3 | ### Homepage 4 | 5 | [https://cyberdefensematrix.com](https://cyberdefensematrix.com) 6 | 7 | ### Project Information 8 | 9 | * Incubator Project 10 | 11 | ### Classification 12 | 13 | * Documentation 14 | 15 | [![CC BY-SA 4.0][license-logo]][license] 16 | 17 | ### Audience 18 | 19 | * Builders 20 | * Defenders 21 | 22 | [![Builders][builders-logo]][builders] 23 | [![Defenders][defenders-logo]][defenders] 24 | 25 | ### Social Media 26 | 27 | * [![Twitter Follow](https://img.shields.io/twitter/follow/cyberdefmatrix?label=Follow)](https://twitter.com/cyberdefmatrix) 28 | * [LinkedIn](https://www.linkedin.com/company/cyber-defense-matrix) 29 | 30 | [inc-proj]: https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects 31 | [inc-proj-logo]: https://raw.githubusercontent.com/OWASP/www--site-theme/master/assets/images/common/owasp_level_incubator.svg?sanitize=true 32 | [builders]: https://www.owasp.org/index.php/Builders 33 | [builders-logo]: https://raw.githubusercontent.com/OWASP/www--site-theme/master/assets/images/common/owasp_builders.svg?sanitize=true 34 | [defenders]: https://www.owasp.org/index.php/Defenders 35 | [defenders-logo]: https://raw.githubusercontent.com/OWASP/www--site-theme/master/assets/images/common/owasp_defenders.svg?sanitize=true 36 | [license]: http://creativecommons.org/licenses/by-sa/3.0/ 37 | [license-logo]: https://mirrors.creativecommons.org/presskit/buttons/88x31/svg/by-sa.svg 38 | [doc-proj-logo]: https://raw.githubusercontent.com/OWASP/www--site-theme/master/assets/images/common/owasp_documentation_project.svg?sanitize=true 39 | -------------------------------------------------------------------------------- /leaders.md: -------------------------------------------------------------------------------- 1 | ### Leaders 2 | * [Sounil Yu](mailto:sounil.yu@owasp.org) 3 | -------------------------------------------------------------------------------- /subproject/index.md: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | layout: col-sidebar 4 | title: An example subdir 5 | 6 | --- 7 | 8 | # Just an example of a subdirectory using col-sidebar layout. Requires an info.md file within the subdir. 9 | 10 | -------------------------------------------------------------------------------- /subproject/info.md: -------------------------------------------------------------------------------- 1 | # My Subdir Info 2 | 3 | * One 4 | * Two 5 | * Three 6 | -------------------------------------------------------------------------------- /tab_media.md: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | title: Media 4 | layout: null 5 | tab: true 6 | order: 2 7 | tags: cyberdefensematrix 8 | 9 | --- 10 | 11 | # Presentations and Other Media 12 | 13 | ## Slides 14 | [Cyber Defense Matrix Presentation at RSA Conference 2016](https://bit.ly/cyberdefensematrix) 15 | 16 | - Slides from Sounil Yu's original presentation at RSA Conference 2016 providing 11 use cases of the Cyber Defense Matrix. 17 | 18 | [Cyber Defense Matrix Reloaded Presentation at RSA Conference 2019](https://bit.ly/cyberdefensematrixreloaded) 19 | 20 | - Slides from Sounil Yu's follow up presentation at RSA Conference 2019 providing 9 more use cases of the Cyber Defense Matrix. 21 | 22 | [Leveraging Four Types of Awareness to Secure Your AWS Environment](https://pages.awscloud.com/rs/112-TZM-766/images/How-to-prioritize-security-controls-for-situational-awareness-in-AWS-Slides.pdf) 23 | 24 | - Slides from Sounil Yu's March 2020 webinar on How to Increase Situational Awareness Using the Cyber Defense Matrix 25 | 26 | [Managing the Security of Your Pets and Cattle in the Cloud](https://pages.awscloud.com/rs/112-TZM-766/images/How-to-prioritize-security-controls-for-sensitive-AWS-assets_%20Slides.pdf) 27 | 28 | - Slides from Sounil Yu's June 2020 webinar on understanding Cloud Security capabilities through the Cyber Defense Matrix 29 | 30 | 31 | ## Videos 32 | 33 | [Leveraging Four Types of Awareness to Secure Your AWS Environment](https://pages.awscloud.com/awsmp-sme-sec-splunk-CDM-ty.html) 34 | 35 | - Video of Sounil Yu's March 2020 webinar on How to Increase Situational Awareness Using the Cyber Defense Matrix 36 | 37 | [Managing the Security of Your Pets and Cattle in the Cloud](https://pages.awscloud.com/awsmp-sme-sec-TrendMicro-PrioritizeSecurityControls-ty.html) 38 | 39 | - Video of Sounil Yu's June 2020 webinar on understanding Cloud Security capabilities through the Cyber Defense Matrix 40 | 41 | [Measuring and Managing Your Security Program Using the Cyber Defense Matrix](https://www.youtube.com/watch?v=LE-ds7LVk5o&t=3808s) 42 | 43 | - Video of Sounil Yu's presentation at OASIS's 2018 Borderless Cyber Conference. 44 | 45 | [CISO Series Vendor Relationship Video](https://www.youtube.com/watch?v=6VjkTI3haqA) 46 | 47 | - A short 4 min video interview about the Cyber Defense Matrix and its use cases. 48 | 49 | [Art into Science: The Cyber Defense Matrix: A Scientific Model for Cybersecurity](https://www.youtube.com/watch?v=ngp-WkXs4mc) 50 | 51 | - A video of Sounil Yu presenting a select set of use cases at the 2017 Art into Science Conference. 52 | 53 | [Art into Science: Cyber Portfolio Management Using the Cyber Defense Matrix](https://www.youtube.com/watch?v=C6S-WWhmwfg) 54 | 55 | - A video of Guillaume Ross presenting a Cyber Portfolio Management use case of the Cyber Defense Matrix, showing how to layout where money is spent and what effect it may have. This approach can help improve communications with executive management, avoid blind-spots, and improve our own understanding of our security program. This talk focuses on the practical aspects of building a defense portfolio. 56 | 57 | 58 | ## Audio / Podcasts 59 | [Security Conversations with Ryan Naraine](https://securityconversations.fireside.fm/sounil-yu-cyber-defense-matrix) 60 | 61 | - An interview with Ryan Naraine and Sounil Yu, explaining why the Cyber Defense Matrix framework was created and how organizations are using it to drive visibility and security decisions in multiple places. We discuss securing "cattle vs pets," the next era of security innovation, and the increasing security poverty line that hurts small- and medium-sized businesses. (March 17, 2020) 62 | 63 | [Defense in Depth: Cyber Defense Matrix Podcast](https://cisoseries.com/defense-in-depth-cyber-defense-matrix/) 64 | 65 | - A deeper 30 min interview with Allan Alford and Sounil Yu about the Cyber Defense Matrix and its use cases (October 17, 2019). 66 | 67 | [CISO Series Vendor Relationship Podcast](https://cisoseries.com/mapping-unsolvable-problems-to-unattainable-solutions/) 68 | 69 | - A 30 min interview with David Sparks, Mike Johnson, and Sounil Yu about the Cyber Defense Matrix and its use cases (October 1, 2019). 70 | 71 | -------------------------------------------------------------------------------- /tab_todo.md: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | title: todo 4 | displaytext: To-Do 5 | layout: null 6 | tab: true 7 | order: 3 8 | tags: cyberdefensematrix 9 | 10 | --- 11 | 12 | # Things To Do 13 | 14 | - Document structure of the Cyber Defense Matrix 15 | - Map vendors to the Cyber Defense Matrix 16 | - Map NIST NICE NCWF skillsets to the Cyber Defense Matrix 17 | - Define attributes that can support measurement of efficacy of capability 18 | - Define Design Patterns and Business Constraints aligned against the Cyber Defense Matrix 19 | - Capture anecdotal and empirical measurements of capability degradation rates 20 | - Incorporate and document new use cases as they are discovered 21 | - Write book --------------------------------------------------------------------------------