OWASP Cyber Defense Matrix - Revision history

Sounilyu: /* Project Leader */ Removed defunct mailing lists. Replaced links to point to LinkedIn page that people can follow instead for updates.

2019-10-11T02:48:43Z

‎Project Leader: Removed defunct mailing lists. Replaced links to point to LinkedIn page that people can follow instead for updates.

Sounilyu: Updated with links to the 2019 RSA briefing. Updates to participation information.

2019-04-21T00:59:59Z

Updated with links to the 2019 RSA briefing. Updates to participation information.

Brennan at 20:30, 3 November 2017

2017-11-03T20:30:08Z

Sounilyu: Several more formatting edits and added roadmap

2017-07-02T00:13:55Z

Several more formatting edits and added roadmap

Sounilyu: Minor typos. Made the Cyber Defense Matrix image larger.

2017-07-01T23:11:33Z

Minor typos. Made the Cyber Defense Matrix image larger.

Sounilyu: /* Main */

2017-07-01T22:43:11Z

‎Main

Brennan at 19:43, 28 June 2017

2017-06-28T19:43:40Z

Brennan at 19:43, 28 June 2017

2017-06-28T19:43:16Z

Brennan: /* Openhub */

2017-06-28T19:38:11Z

‎Openhub

Brennan: /* News and Events */

2017-06-27T17:34:07Z

‎News and Events

@@ Line 65: / Line 65: @@
 * [https://twitter.com/sounilyu Sounil Yu (@sounilyu)]
 == FAQs ==
@@ Line 91: / Line 88: @@
 == MAILING LIST ==
-* [https://lists.owasp.org/mailman/listinfo/owasp_cyber_defense_matrix CLICK TO JOIN]
+* [https://www.linkedin.com/company/cyber-defense-matrix/ CLICK TO JOIN]
 == News and Events ==

@@ Line 22: / Line 22: @@
 Although the Cyber Defense Matrix was initially created to help organize security technologies, many other use cases have been discovered to help build, manage, and operate a security program. This project intends to capture these use cases and their implementations to help security practitioners mature their security programs.
-==Description of the Cyber Defense Matrix==
+==Structure of the Cyber Defense Matrix==
 The basic construct of the Cyber Defense Matrix starts with two dimensions. The first dimension captures the five operational functions of the NIST Cybersecurity Framework:
@@ Line 58: / Line 58: @@
 == Presentations and Other Media ==
-[https://www.rsaconference.com/writable/presentations/file_upload/pdil-w02f_understanding_the_security_vendor_landscape...-final.pdf Cyber Defense Matrix Presentation at RSA Conference 2016]
+[https://bit.ly/cyberdefensematrix Cyber Defense Matrix Presentation at RSA Conference 2016]
 == Project Leader ==
-* [[Sounil@gmail.com|Sounil Yu]]
+* [https://twitter.com/sounilyu Sounil Yu (@sounilyu)]
 == Mailing List: ==
@@ Line 72: / Line 72: @@
 * TBD
-== Roadmap ==
+== Things To Do ==
-* Document structure of the Cyber Defense Matrix (July 2017)
+* Document structure of the Cyber Defense Matrix
-* Map vendors to the Cyber Defense Matrix (September 2017 and ongoing)
+* Map vendors to the Cyber Defense Matrix
-* Map NIST NICE NCWF skillsets to the Cyber Defense Matrix (September 2017)
+* Map NIST NICE NCWF skillsets to the Cyber Defense Matrix
-* Define attributes that can support measurement of efficacy of capability (December 2017 and ongoing)
+* Define attributes that can support measurement of efficacy of capability
-* Define Design Patterns and Business Constraints aligned against the Cyber Defense Matrix (June 2018 and ongoing)
+* Define Design Patterns and Business Constraints aligned against the Cyber Defense Matrix
-* Capture anecdotal and empirical measurements of capability degradation rates (December 2018)
+* Capture anecdotal and empirical measurements of capability degradation rates
-* Incorporate and document new use cases as they are discovered (Ongoing)
+* Incorporate and document new use cases as they are discovered
 == Related Projects ==
@@ Line 95: / Line 95: @@
 == News and Events ==
-* [01 May 2017] Project updated
+* [01 May 2017] Project created
-* [26 June 2017] Update
+* [20 April 2019] Added links to 2019 briefing at RSA
 ==Classifications==
@@ Line 117: / Line 117: @@
 == How can I participate in your project? ==
-Join the mailing list, say hello!
+Everyone is invited to collaborate on this project.  Contact the Project Leaders. The project needs different skills and expertise and different times during its development. Currently, we are looking for help in the following areas:
-= Contributors =
+* Documenting new use cases
 = Events and Opportunities to Get Involved =
 <!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->

@@ Line 1: / Line 1: @@
 = Main =
 <!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
 <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>

@@ Line 1: / Line 1: @@
-=Main=
+= Main =
 <!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
 <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>
 <!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
 {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 | valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |
-==Introduction==
+==Introduction to the Cyber Defense Matrix==
 Imagine going into a grocery store to shop for Thanksgiving dinner, but instead of seeing nice, orderly aisles, you see a massive pile of food in the middle of the grocery store. Finding the ingredients that you need to make dinner is going to be extremely hard because there’s no organizational system helping you understand where things are. The disorganization makes it very difficult to find what you need and compare competing products.
@@ Line 18: / Line 17: @@
 Although the Cyber Defense Matrix was initially created to help organize security technologies, many other use cases have been discovered to help build, manage, and operate a security program. This project intends to capture these use cases and their implementations to help security practitioners mature their security programs.
-==Description==
+==Description of the Cyber Defense Matrix==
 The basic construct of the Cyber Defense Matrix starts with two dimensions. The first dimension captures the five operational functions of the NIST Cybersecurity Framework:
@@ Line 40: / Line 39: @@
 !USERS
 |}
-When these two dimensions are put into a grid, we arrive at with a five-by-five matrix that we call the “Cyber Defense Matrix.”[[File:Cyber Defense Matrix.png|thumb|none|800x800px]]
+When these two dimensions are put into a grid, we arrive at with a five-by-five matrix that we call the “Cyber Defense Matrix.”
 There is one more important piece of this matrix.  At bottom of the grid, we show a continuum that characterizes the degree of dependency on technology, people, and process as we progress through the five operational functions of the NIST Cybersecurity Framework.  TECHNOLOGY plays a much greater role in IDENTIFY and PROTECT. As we move to DETECT, RESPOND, and RECOVER, our dependency on TECHNOLOGY diminishes and our dependency on PEOPLE grows. Throughout all five operational functions, there's a consistent level of dependency on PROCESS. This continuum helps us understand where we might have imbalances in our reliance on PEOPLE, PROCESS, and TECHNOLOGY when trying to tackle our cybersecurity challenges.
@@ Line 47: / Line 47: @@
 If you discover a new use of the Cyber Defense Matrix, we would love to hear about it. Likewise, if you find a problem with the matrix in that it doesn't seem to properly describe something that we do in cybersecurity, please point that out, and we'll either adjust the matrix or clarify how that perceived discrepancy can be addressed or explained through the matrix.
 <!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
 | valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
-== What is OWASP Security Principles Project? ==
+== Presentations and Other Media ==
-The end goal is to identify, cite, and document the fundamental principles of information security. Once this is well organised, I think it would be great to publish this through the [http://scriptogr.am/dennis-groves/post/owasp-press OWASP Press]. Of course, it will always remain freely available, and any money collected will go directly into the project to absorb costs with any remaining funds going to the OWASP Foundation.
+[https://www.rsaconference.com/writable/presentations/file_upload/pdil-w02f_understanding_the_security_vendor_landscape...-final.pdf Cyber Defense Matrix Presentation at RSA Conference 2016]
-This document should serve as a guide to technical architects and designers outlining the fundamental principles of security.
+[[Cyber Defense Matrix Handouts]]
 == Project Leader ==
@@ Line 69: / Line 61: @@
 * [[Tomb@owasp.org|Tom Brennan]]
-== Mailing List:  [https://lists.owasp.org/mailman/listinfo/owasp_cyber_defense_matrix owasp_cyber_defense_matrix@lists.owasp.org] ==
+== Mailing List: ==
-== Related Projects ==
+== FAQs ==
-* [[OWASP_CISO_Survey]]
+== Roadmap ==
-== Openhub ==
+== Related Projects ==
-* [https://www.openhub.net/orgs/OWASP OWASP Project Openhub]
+== Licensing ==
 <!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
@@ Line 106: / Line 109: @@
 |}
-=FAQs=
+= FAQs =
-Coming Soon..
+== How can I participate in your project? ==
 Join the mailing list, say hello!
@@ Line 115: / Line 117: @@
 Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.
-= Acknowledgements =
+= Roadmap =
-==Contributors==
+= Contributors =
 Everyone is invited to collaborate on this project.
-= Road Map and Getting Involved =
+= Events and Opportunities to Get Involved =
 April 5th 2017 project announced publicly at the [https://www.meetup.com/owaspnyc/events/236400067/ OWASP NYC Chapter Meeting] call for DATA is OPEN
@@ Line 130: / Line 139: @@
 Sept 2017 - AppSecUSA Project Summit
 <!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->

@@ Line 8: / Line 8: @@
 ==Introduction==
-Imagine going into a grocery store to shop for Thanksgiving dinner, but instead of seeing nice, orderly aisles, you see a massive pile of food in the middle of the store. Finding the ingredients that you need to make dinner is going to be extremely hard because there’s no organizational system helping you understand where things are or if you already have something. The disorganization makes it very difficult to find what you need.
+Imagine going into a grocery store to shop for Thanksgiving dinner, but instead of seeing nice, orderly aisles, you see a massive pile of food in the middle of the grocery store. Finding the ingredients that you need to make dinner is going to be extremely hard because there’s no organizational system helping you understand where things are. The disorganization makes it very difficult to find what you need and compare competing products.
 The cybersecurity vendor marketplace is like this disorganized grocery store. A proof of this assertion can be seen by looking at the vendor hall at any major security conference. The cacophony of sounds from vendors hawking their wares, the confusing language of the vendor’s marketecture, and the lack of any semblance of organization (aside from biggest to smallest) does not help buyers understand what they need or where to find it.
-Because the cybersecurity community does not use consistent terminology to describe what we need, there is much confusion about what many vendor products actually do. Instead of a clear articulation of a product's capabilities, vendors bombard us with overused, trendy jargon that usually leaves buyers wondering if the product can really solve any of our woes. Some organizations even organize themselves according to the jargon. We need to stop letting marketing pitches dictate our terminology and not lose sight of the more bland descriptors that actually tell us what something does.
+Because the cybersecurity community does not use consistent terminology to describe what we need, there is much confusion about what many vendor products actually do. Instead of a clear articulation of a product's capabilities, we are bombarded with overused, trendy jargon that usually leaves us wondering if the product can really solve any of our woes. Some organizations even organize themselves according to the jargon. We need to stop letting marketing pitches dictate our terminology and not lose sight of the more bland descriptors that actually tell us what something does.
 The Cyber Defense Matrix helps us understand what we need organized through a logical construct so that when we go into the security vendor marketplace, we can quickly discern what products solve what problems and be informed on what is the core function of a given product. In addition, the Cyber Defense Matrix provides a mechanism to ensure that we have capabilities across the entire spectrum of options to help secure our environments.
@@ Line 40: / Line 40: @@
 !USERS
 |}
-When these two dimensions are put into a grid, we arrive at with a five-by-five matrix that we call the “Cyber Defense Matrix.”[[File:Cyber Defense Matrix.png|thumb]]
+When these two dimensions are put into a grid, we arrive at with a five-by-five matrix that we call the “Cyber Defense Matrix.”[[File:Cyber Defense Matrix.png|thumb|none|800x800px]]
 There is one more important piece of this matrix.  At bottom of the grid, we show a continuum that characterizes the degree of dependency on technology, people, and process as we progress through the five operational functions of the NIST Cybersecurity Framework.  TECHNOLOGY plays a much greater role in IDENTIFY and PROTECT. As we move to DETECT, RESPOND, and RECOVER, our dependency on TECHNOLOGY diminishes and our dependency on PEOPLE grows. Throughout all five operational functions, there's a consistent level of dependency on PROCESS. This continuum helps us understand where we might have imbalances in our reliance on PEOPLE, PROCESS, and TECHNOLOGY when trying to tackle our cybersecurity challenges.
@@ Line 46: / Line 46: @@
 We believe that this matrix is a realistic model describes a broad range of cybersecurity practices. In this website, you will find several insights on the Cyber Defense Matrix and examples of how to leverage it to address the challenges that we face in cybersecurity.
-If you discover a new use of the Cyber Defense Matrix, we would love to hear about it. Likewise, if you find a problem with the matrix in that it doesn't seem to properly describe something that we do in cybersecurity, please point that out, and we'll either adjust the matrix or clarify how that problem can be address through the matrix.
+If you discover a new use of the Cyber Defense Matrix, we would love to hear about it. Likewise, if you find a problem with the matrix in that it doesn't seem to properly describe something that we do in cybersecurity, please point that out, and we'll either adjust the matrix or clarify how that perceived discrepancy can be addressed or explained through the matrix.
 ==Licensing==

← Older revision		Revision as of 19:43, 28 June 2017
Line 117:		Line 117:
	=Project About=		=Project About=

−	~~{{:Projects/OWASP_Example_Project_About_Page}}~~