C2M2 V2.1：2022年美国能源部网络安全能力成熟度模型提升组织防护

需积分: 5 64 浏览量更新于2024-06-19 收藏 1.63MB PDF 举报

美能源部网络安全成熟度模型C2M2 Version 2.1（June 2022）是一个针对各类组织设计的框架，旨在提升网络安全能力，对抗日益增长的网络威胁。这个模型针对信息、信息技术（IT）和运营技术（OT）资产的保护，以及这些资产在其运营环境中的管理，重点关注组织如何有效地评估、检验和改进其网络安全计划，以确保关键基础设施的稳定性并增强业务连续性。 C2M2模型的核心概念包括成熟度模型理论，强调企业、组织和职能层面的整合。其中，职能部分着重于明确各个部门在网络空间中的角色和责任，例如，确保IT、OT资产和信息资产的安全管理。模型架构分为若干域、目标和实践，如网络安全程序管理、风险管理、以及网络安全架构等，每个领域都有不同的成熟度指标等级（MIL），以描述组织在特定方面的进步程度。该模型鼓励自评估，通过提供易于使用的工具，组织可以在一天之内进行初步评估，同时，也适用于深入的审查。C2M2强调的是描述性的指导，而非详尽的操作指南，这意味着它适应不同行业、规模和结构的组织，能够灵活应用于各种情境。通过C2M2，组织可以更好地理解和优先处理网络安全问题，确定投资和行动计划，从而提升整体的网络安全水平。在模型的具体实施过程中，例如在网络安全架构领域，C2M2定义了清晰的网络安全架构，提供了一个框架来指导架构的设计和实现。组织需要关注网络安全架构的定义、架构框架的构建，以及如何将这个框架融入到实际操作中，确保其与组织的整体战略和业务目标保持一致。总结来说，C2M2 Version 2.1 是一个强大的工具，它帮助组织系统化地提升网络安全能力，通过量化评估和实践经验分享，促进组织间的信息交流，提高应对网络威胁的能力，从而保障国家的安全和经济稳健发展。

Cybersecurity Capability Maturity Model, Version 2.1

CORE CONCEPTS

3. CORE CONCEPTS

This section describes several core concepts that are important for interpreting the content

and structure of the model.

3.1 Maturity Models

A maturity model is a set of characteristics, attributes, indicators, or patterns that represent

capability and progression in a particular discipline. Model content typically exemplifies best

practices and may incorporate standards or other codes of practice of the discipline.

A maturity model thus provides a benchmark against which an organization can evaluate the

current level of capability of its practices, processes, and methods and set goals and

priorities for improvement. Also, when a model is widely used in a particular industry and

assessment results are anonymized and shared, organizations can benchmark their

performance against other organizations. An industry can determine how well it is

performing overall by examining the capability of its member organizations.

To measure progression, maturity models typically have a scale defining levels of maturity.

C2M2 uses a scale of maturity indicator levels (MILs) 0–3, which are described in Section

4.3. A set of attributes defines each level. If an organization demonstrates these attributes,

it has achieved both that level and the capabilities that the level represents. Having

measurable transition states between the levels enables an organization to use the scale to:

 Define its current state

 Determine its future, more mature state

 Identify the capabilities it must attain to reach that future state

3.2 Enterprise, Organization, and Function

The terms enterprise, organization, and function identify which part of an entity the text of

the model is referring to. Function refers to the part of an entity to which the C2M2 will be

applied (as described further in Section 3.2.1). Organization is a higher-level administrative

unit in which the function resides (e.g., an operating company). Enterprise refers to the

highest-level administrative unit within an entity using the C2M2 (e.g., a parent company).

Cybersecurity Capability Maturity Model, Version 2.1

CORE CONCEPTS

It is also important to consider that the C2M2 model was designed to apply to a wide variety

of entity types. Some enterprises may consist of multiple organizations (e.g., a holding

company with multiple operating companies); other organizations may have a more

homogenous structure that does not necessitate any differentiation between the terms

enterprise and organization. For those organizations, enterprise and organization may be

used interchangeably. Figure 1 depicts how the enterprise, organization, and function may

be organized in a notional entity.

Figure 1: Example of the Structure of a Notional Entity

3.2.1 Function

In the model, the term function refers to the part of the organization that is being evaluated

based on the model. It is common for an organization to use the model to evaluate a subset

of its operations. The model broadly defines the function to allow organizations the greatest

degree of flexibility in determining the scope of the self-evaluation that is appropriate for

them. Functions can align with organizational boundaries, or they can align to a single

product line or system. They might include departments; lines of business; distinct facilities;

network security zones; groupings of assets; or assets, processes and resources managed

externally, such as assets that reside in the cloud.

Selection of the function defines which IT, OT, and information assets will be in scope for the

evaluation including interconnected or interdependent business and technology systems

and the environment in which they operate. The function also defines the people who should

participate in the self-evaluation. Specifically, appropriate participants should be included to

ensure there is someone familiar with the way that the activities described in each of the

C2M2 domains are implemented for the selected function.

Picking the right scope improves the accuracy of self-evaluation results. Selecting a scope

that includes a part of the organization that manages cybersecurity homogenously avoids a

situation where two different groups must combine two different responses into one. Care

should be given to select a scope that provides a good balance between accuracy and time

spent performing individual self-evaluations. A general rule for finding the right balance is to

Cybersecurity Capability Maturity Model, Version 2.1

CORE CONCEPTS

Table 3: Examples of IT Assets, OT Assets, and Information Assets

Examples of IT Assets Examples of OT Assets

Examples of

Information Assets

 Workstations

 Switches, routers, and

firewalls

 Servers

 Virtual machines

 Software

 Mobile computing

devices

 Cloud assets

 Workstations

 Switches, routers, and

firewalls

 Servers

 Virtual machines

 Software

 Mobile computing

devices

 Cloud assets

 Programmable Logic

Controllers

 Remote Terminal Units

 Industrial Control

Systems (ICS)

 Safety Instrumented

Systems

 Physical access

control devices

 Business data

 Intellectual property

 Customer information

 Contracts

 Security logs

 Metadata

 Set points

 Operational data

 Financial records

 Security information and

event management log

files

 Historian data

 Configuration files

3.3.2 Additional Asset Subgroupings

In some cases, C2M2 practices refer to specific subgroupings of assets. These subgroupings

focus on importance to the function and potential impact if accessed or misused by a threat

actor. They may include any combination of IT, OT, and information assets. These

subgroupings are defined as:



Assets that are important to the delivery of the function:

Assets that are required

for a normal state of operation of the function and output of the function’s

products or services. Loss of an asset that is considered important to the delivery

of the function may not directly result in an inability to deliver the function but

could result in operations being degraded. Identification of an important asset

should focus on loss of the service or role performed by that asset and should not

include consideration of asset redundancy or other protections applied to assets.



Assets within the function that may be leveraged to achieve a threat objective:

Assets that may be used in the pursuit of the tactics or goals of a threat actor that

are of concern to the organization. Identifying assets within the function that may

be leveraged to achieve a threat objective enables the organization to view assets

Cybersecurity Capability Maturity Model, Version 2.1

CORE CONCEPTS

from the perspective of a threat actor. Examples of assets within the function that

may be leveraged to accomplish a threat objective include:

- public-facing assets that may serve as an initial access point

- assets that, if compromised, may allow lateral movement within an

organization’s network

- assets with administrative rights that would enable privilege escalation

- information assets such as personally identifiable information that may

cause harm to the organization or its stakeholders if lost, stolen, or

disclosed

- assets that are important to delivery of the function

A threat actor is any actor with the potential to adversely impact organizational

operations or resources through IT, OT, or communications infrastructure. Threat

objectives are the potential outcomes of threat actor activities that are of concern

because they would have negative impacts on the organization. For example, an

organization that does not process confidential data may not be concerned about

data theft but may be very concerned about an incident that causes an

operational outage.

Threat actors may leverage multiple tactics or techniques, like those defined in

MITRE ATT&CK [MITRE ATT&CK] or MITRE ATT&CK for Industrial Control Systems

[MITRE ATT&CK for ICS]), to achieve their goals. Threat objectives may be

described in an organization’s threat profile and may change over time or in

different situations. Threat objective examples include data manipulation, IP

theft, damage to property, denial of control, loss of safety, or operational outage.

Note that an organization’s inventory of assets that are important to the delivery

of the function might include assets within the function that may be leveraged to

achieve a threat objective and vice versa. It is not the intention of the model that

all assets be categorized as assets that might be leveraged to achieve a threat

objective, but only those that a risk-based approach identifies as being worthy of

attention and further analysis.



All assets within the function:

All assets that operate or are used within the

function. These assets may not be considered important to the delivery of the

function and may not be likely to be leveraged to achieve a threat objective (for

example, printers, radios, badge readers, or telephones).

剩余95页未读，继续阅读

MR_4chen

粉丝: 0
资源: 43

C2M2 V2.1：2022年美国能源部网络安全能力成熟度模型提升组织防护

网络安全能力成熟度模型C2M2 V2.0（中译版）.pdf

信息安全能力成熟度模型_IS_CMM_的建构

网络安全管理模型（美国能源部C2M2)

Cybersecurity capability maturity model（C2M2）V2.0.pdf

2022能源部门的网络安全状况（英）.pdf

网络安全能力成熟度模型(c2m2)

网络安全C2是什么意思

网络安全攻防红蓝对抗 c2是什么

预测液体浓度的数学模型

使用Python用最小二乘法拟合模型，计算参数c1和c2

最新资源