@HTCPCP-TEA wrote:My question is this - I hear security model, and I go to Bell-La Padula, Biba etc, but the reference here is to a full list of NIST control mappings to risk scenarios.
Maybe someone is interchanging "framework" for "model?" This dives into the mind-numbing lexicon, but while Bell-Lapdula, etc. could be called "security models," a better description may be "machine state," or "system" security models whereas what you've been asked to do seems more along the lines of an "enterprise" or "organizational" model, framework, method, approach, etc.
I've been doing this for going a few decades now, and the older I get - maybe because I'm forgetting more than anything else these days - the more I ignore the semantics. Whether you call it a model or a framework (and you can even throw "standard" in there), the value is not that one is overwhelmingly better than the other; it's just that it offers a prescribed methodology so that 90 percent of the planning can be done for you. Sure, some are more suited based on industry and objectives, but all require a little (i.e. that 10 percent) additional work. As an analogy, if I am going to build a shed in my yard, I might start with the "NIST shed framework" as opposed to coming at it from the "ISO 27001 shed standard." Either way, I need to use them in the context of my yard, local zoning, and customization to my needs. The downside is at compliance time, you might have to do a little more work, but that just gets to the question of whether the goal is to check boxes or do something more substantive. I'd rather start with the latter and produce the former.
