Regulatory Open Forum

My first question is, "Disclose to whom"? It seems to me there are (at least) two different parties – regulators and users. The answer is different in each case.

Cast in terms of the NIST post, I infer the cybersecurity risk control measures are a digital fence - a perimeter. The question, then is which aspects of the perimeter to disclose and to whom. My  presumption is that there are two types of controls which I will call obvious and hidden. Obvious controls are "user name + password" and "two point authentication" to prevent unauthorized access. The hidden controls might be something in another layer of your "defense in depth" strategy. The concern, I infer, is that user knowledge of the hidden controls, such as in an IFU, will provide an opportunity for somebody to figure out how to circumvent the control and gain access to the system.

The NIST post suggests that one cannot prevent unauthorized access – somebody will always figure out how to breach the perimeter and gain access. The zero trust strategy recognizes that the concept of inside and outside the perimeter is not adequate. You need controls inside as well. To quote the post, "Every access request [from inside the perimeter] to a resource must be thoroughly evaluated dynamically and in real time based on access policies in place and current state of credentials, device, application and service, as well as other observable behavior and environmental attributes, before access may be granted."

One common scenario is a weak-link attack on a device on a network to gain network access. An example might be access to a hospital network through a device with weak cybersecurity controls.

My recommendation for your device is to make the obvious controls known to the user, but keep the hidden controls hidden. This won't prevent an attack but will make it more difficult. If the attack is on a network, not your device, then the attack will turn to the weak link. Don't let it be your device.

On your device implement zero trust controls and recommend it for any network to which the user would connect your device.<o:p></o:p>

Dear Dan,

Thank you so much for sharing those details. It was very informative to know about what the actual cybersecurity measures are. 

Our concern now is how much we can share the cybersecurity information with the regulator, which we don't know how much we can trust. 

My first question is, "Disclose to whom"? It seems to me there are (at least) two different parties – regulators and users. The answer is different in each case.

Cast in terms of the NIST post, I infer the cybersecurity risk control measures are a digital fence - a perimeter. The question, then is which aspects of the perimeter to disclose and to whom. My  presumption is that there are two types of controls which I will call obvious and hidden. Obvious controls are "user name + password" and "two point authentication" to prevent unauthorized access. The hidden controls might be something in another layer of your "defense in depth" strategy. The concern, I infer, is that user knowledge of the hidden controls, such as in an IFU, will provide an opportunity for somebody to figure out how to circumvent the control and gain access to the system.

The NIST post suggests that one cannot prevent unauthorized access – somebody will always figure out how to breach the perimeter and gain access. The zero trust strategy recognizes that the concept of inside and outside the perimeter is not adequate. You need controls inside as well. To quote the post, "Every access request [from inside the perimeter] to a resource must be thoroughly evaluated dynamically and in real time based on access policies in place and current state of credentials, device, application and service, as well as other observable behavior and environmental attributes, before access may be granted."

One common scenario is a weak-link attack on a device on a network to gain network access. An example might be access to a hospital network through a device with weak cybersecurity controls.

My recommendation for your device is to make the obvious controls known to the user, but keep the hidden controls hidden. This won't prevent an attack but will make it more difficult. If the attack is on a network, not your device, then the attack will turn to the weak link. Don't let it be your device.

On your device implement zero trust controls and recommend it for any network to which the user would connect your device.<o:p></o:p>

Dear Dan,

Thank you so much for sharing those details. It was very informative to know about what the actual cybersecurity measures are. 

Our concern now is how much we can share the cybersecurity information with the regulator, which we don't know how much we can trust. 

My first question is, "Disclose to whom"? It seems to me there are (at least) two different parties – regulators and users. The answer is different in each case.

Cast in terms of the NIST post, I infer the cybersecurity risk control measures are a digital fence - a perimeter. The question, then is which aspects of the perimeter to disclose and to whom. My  presumption is that there are two types of controls which I will call obvious and hidden. Obvious controls are "user name + password" and "two point authentication" to prevent unauthorized access. The hidden controls might be something in another layer of your "defense in depth" strategy. The concern, I infer, is that user knowledge of the hidden controls, such as in an IFU, will provide an opportunity for somebody to figure out how to circumvent the control and gain access to the system.

The NIST post suggests that one cannot prevent unauthorized access – somebody will always figure out how to breach the perimeter and gain access. The zero trust strategy recognizes that the concept of inside and outside the perimeter is not adequate. You need controls inside as well. To quote the post, "Every access request [from inside the perimeter] to a resource must be thoroughly evaluated dynamically and in real time based on access policies in place and current state of credentials, device, application and service, as well as other observable behavior and environmental attributes, before access may be granted."

One common scenario is a weak-link attack on a device on a network to gain network access. An example might be access to a hospital network through a device with weak cybersecurity controls.

My recommendation for your device is to make the obvious controls known to the user, but keep the hidden controls hidden. This won't prevent an attack but will make it more difficult. If the attack is on a network, not your device, then the attack will turn to the weak link. Don't let it be your device.

On your device implement zero trust controls and recommend it for any network to which the user would connect your device.<o:p></o:p>