2.1 Cybersecurity Governance: NIST CSF 2.0 & STRIDE Threat Modeling

🎯 Essential Technical Takeaways

• NIST CSF 2.0 expanded the framework by adding 'Govern' as a foundational function alongside Identify, Protect, Detect, Respond, Recover.
• ISO/IEC 27001 specifies formal auditable ISMS requirements; ISO/IEC 27002 provides advisory guidance for Annex A control implementation.
• STRIDE categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
• Tampering violates data integrity (modifying packets); Spoofing violates authenticity (impersonation); Information Disclosure violates confidentiality.

Enterprise cybersecurity governance requires standardized frameworks to identify, assess, and manage risks systematically. Published in 2024, the NIST Cybersecurity Framework (CSF) 2.0 provides an internationally recognized structure organized into six core functions: Govern (GV), Identify (ID), Protect (PR), Detect (DE), Respond (RS), and Recover (RC). The newly introduced 'Govern' function emphasizes that cybersecurity risk management is an integral component of enterprise corporate governance, demanding executive oversight, risk strategy alignment, and supply chain risk management.

ISO/IEC 27001 is the international specification for an Information Security Management System (ISMS), using a risk-based approach to protect organizational assets. While organizations achieve formal third-party accredited certification against ISO 27001, ISO/IEC 27002 serves as the companion implementation guide providing detailed best practices for the 93 controls cataloged in ISO 27001 Annex A.

Threat modeling identifies vulnerabilities early in the software design lifecycle. Microsoft's STRIDE framework evaluates system components against six threat classes: Spoofing identity (authenticity), Tampering with data (integrity), Repudiation of actions (non-repudiation), Information disclosure (confidentiality), Denial of service (availability), and Elevation of privilege (authorization). Categorizing threats via STRIDE allows engineers to implement targeted cryptographic and architectural controls before code is written.

⚠️ CPA Evolution Exam Traps & Control Pitfalls

• Confusing NIST CSF functions (Govern, Protect, etc.) with internal control types (preventative, detective, corrective).
• Attempting to obtain an accredited organization certification against ISO 27002 (certification is against ISO 27001 only).
• Treating Tampering under STRIDE as an attack on confidentiality rather than integrity.