Assessing and strengthening cybersecurity maturity : a NIST-based index approach

• Main Author: Bernardo, Luís António
• Publication Date: 2024
• Format: Master thesis
• Language: eng
• Source: Repositórios Científicos de Acesso Aberto de Portugal (RCAAP)
• Download full: http://hdl.handle.net/20.500.11960/3989
• topic: Cybersecurity; COVID-19; Home office; NIST CSF; Maturity; Cyber security maturity; Maturity index; Cyber resilience; Cyber security risk; Cyber security framework; Cyber risk quantification; Ciberseguranca; Trabalho remoto; Maturidade; Maturidade em cibersegurança; Índice de maturidade; Resiliência cibernética; Risco em cibersegurança; Estrutura de cibersegurança; Quantificação de risco cibernético

This master thesis focuses on the importance of the implementation of cybersecurity reinforcement measures and the evaluation of cybersecurity maturity within organizations. With the continuous evolution of cybersecurity threats, organizations face significant challenges in protecting their data and systems. The COVID-19 pandemic and the rise of remote work have further increased risks, making cybersecurity an even more essential aspect for organizations. The objective of this research is to evaluate and contribute to the growth of cybersecurity maturity in organizations, by adopting NIST Cybersecurity Framework (NIST CSF) as an auxiliary tool. This framework provides a comprehensive structure to manage cybersecurity risks and is widely adopted by organizations due to its flexibility and ease of implementation. The methodological approach of this research is based on the development of customized questionnaires aimed at different audiences, including cybersecurity experts and employees at different hierarchical levels in organizations. The objective of this method is to identify the level of cybersecurity maturity, providing a comprehensive analysis. The responses obtained from these questionnaires are analyzed to calculate a cybersecurity maturity index, which reflects the current state of the organization’s cybersecurity practices. The findings of this research highlight the importance of prevention in cybersecurity as a fundamental approach to protect organizations against cyber threats. By identifying areas for improvement and implementing effective prevention strategies, organizations can improve their cybersecurity posture and mitigate risks. The research also emphasizes the importance of complying with data protection regulations, such as the General Data Protection Regulation (GDPR), to ensure the privacy and security of personal data. Overall, this research contributes to the advancement of knowledge and practices in cybersecurity by providing valuable information on cybersecurity maturity and the importance of prevention. By adopting preventive measures and promoting a culture of cybersecurity awareness, organizations can strengthen their security defenses and safeguard their digital assets.