xIoT How NetRise Enables CJIS Compliance

The Criminal Justice Information Services (CJIS) Security Policy document represents a mandate criminal justice agencies and their vendors must adhere to in order to meet the security requirements of handling protected information. The regulations and best practices provisioned in the document include firmware security requirements that can only be met with comprehensive software component vulnerability identification and organized, effective remediation.

Supply Chain Risk Management (SCRM) hinges on deep binary analysis of firmware and having accurate and complete Software Bills of Materials (SBOMs). The NetRise Platform empowers users to make informed decisions by automatically and continuously assessing risks and vulnerabilities latent within software and firmware.

Risks are prioritized based on exploitability so that users have a clear path to the most effective and impactful remediations, with assessment based on factors such as inclusion in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog. Understanding which risks have the greatest potential impact and likelihood of exploitation allows for significant reductions in the overall risk of the environment much quicker than would be possible otherwise.

The NetRise Platform enables criminal justice information security professionals to meet the requirements established in the CJIS Security Policy with the following capabilities.

Firmware Analysis & Security

Firmware is the trusted foundation for every hardware device. The ubiquity of firmware betrays the lack of attention cybersecurity professionals have given it in the past, creating a massive unaddressed attack surface. Too often an afterthought when considering the overall cybersecurity of organizations, the contemporary reality is that the components within firmware are routinely found to have an overwhelming number of vulnerabilities — many of which are either exploitable, public knowledge, or both, with high profile disclosures such as Ripple20 in recent years.

• How many of my devices possess a particular vulnerability?
• Are any of my devices using default or easily guessed credentials?
• Are my devices compliant with industry standard frameworks?
• How prevalent is a particular file within the devices in my environment?
• Are there any backdoors present in my devices?
• How does my device risk compare across vendors?

Risk & Vulnerability Management

• The Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog
• Known usage of an exploit by botnets, ransomware groups, or other threat actors
• Marketing nomenclature raising awareness, such as Ripple20, Log4j, and others
• Availability and weaponization of an exploit via toolkits and other easy to use methods
• Misconfigurations, leaked credentials, and more

Remediation Enablement

The risk and vulnerability assessments provided by the NetRise Platform enable organizations to address remediation in an effective and efficient manner, mitigating the risks with the greatest potential for exploitation and impact on operations. Having a clear understanding of what vulnerabilities to address next allows organizations to rapidly reduce their overall risk and drastically improve the security of the greater environment without having to spend valuable time and resources on prioritization and management of risks and vulnerabilities.

Organizations can also rest assured that the vulnerabilities they choose to deprioritize do not represent a pressing risk, and can address them if and when the likelihood of exploitation becomes significant.

Asset Build Assurance

The NetRise Platform allows users to assess the risks and vulnerabilities of a given build for an asset, enabling accurate analysis of new products and versions before deployment. The device transparency and version comparison provided by NetRise enables:

• Safer patching, with the assurance that the decision to patch or not patch devices will have a positive impact on the overall security of environments.
• Safer procurement, with the ability to assess the risks and vulnerabilities within devices before making investments.
• More effective compliance efforts, with the ability to avoid undesirable or insecure software components such as code developed in nations outside the US and its allies.

To learn more about how the NetRise Platform enables CJIS compliance, schedule a demo today or read our brief on CJIS compliance enablement.