After Healthcare.gov debacle, group pushes for tests of NIST cybersecurity framework

More needs to be done to identify what adoption of framework really means, ISA says

The Internet Security Alliance, a multi-sector trade association, wants to know what adoption of a new cybersecurity framework will entail for companies in critical infrastructure industries.

In a proposal pitched to the Department of Homeland Security and sector specific agencies, the ISA this week called for beta tests on the National Institute of Standards and Technology's framework to identify the cost-effectiveness of adopting the controls it recommends.

""We have already seen the results of not doing enough testing before launching a major program with Healthcare.gov," said Larry Clinton, president and CEO of the ISA. "Similarly, the cybersecurity framework needs to be tested just as the private sector would do with any major product or service before it was rolled," he said in a statement

The framework is a core component of President Obama's Cybersecurity Executive Order issued in February. It is designed to serve as a security best practices guide for companies in critical industries, including telecommunications, financial services and energy.

The framework offers specific guidance on how companies can identify assets that need to be protected, the controls and the standards that they can use to achieve that goal and measures they can take to detect, respond and recover from a cyberattack.

The framework, which was developed with extensive input from industry stakeholders, is not a standard by itself but more of an information resource that companies can use to identify and close gaps in their security. It is also designed to help companies evaluate their security posture and move them toward specific security goals.

The NIST released a draft version of the framework in October and is scheduled to release a final version in February.

Critical infrastructure companies are not required to follow the advice in the framework. But many expect that once the framework is released, it will become a de facto best practices guide for information security in critical sectors. Some legal experts have warned that companies that don't have the security controls referenced in the framework could find themselves exposed to liability issues in the event of a breach.

The government has said it will consider offering incentives to get companies to adopt the security measures recommended in the framework.

The big issue is that there is little to no clarity on what "adopting" the framework means, Clinton said in an interview with Computerworld on Friday.

"The government is saying that adopting the framework will get you this incentive. But first you've got to know what you have to do in order to get the incentives," he said. "We are going to have to get some clarity on what it means to adopt the framework," he continued. "Does it depend on the sector, do you have to adopt everything? These are issues we need to wrestle to the ground," before NIST rolls out the framework next year, he said.

According to Clinton, the best approach is to see how companies, especially small to medium-size businesses in critical infrastructure areas, hold up against the measures recommended in the framework. The goal should be to identify security gaps and to see how much it would typically cost for these companies to implement the recommended controls. The beta tests should also focus on the effectiveness of these controls, he said.

Without such information, many companies in critical sectors won't know what to do with the framework once it becomes available, or how much it would cost them to adopt the recommended controls, he said.

Testing the cost-effectiveness of the NIST's protocols is a good idea in theory, but would likely be hard to pull off, said Scott Vernick, an attorney who advises his clients on cybersecurity liabilities at the law firm Fox Rothschild in Philadelphia.

One of the major goals of the NIST framework is to help critical infrastructure operators enable measures for better threat-information sharing between other companies and the government.

To effectively test the recommended NIST controls, beta testers will need to share information with other testers, which could pose a challenge for many, Vernick said. There are other major issues as well, he said. "Who would pay for the tests? How do you share information on the outcome of the tests and who would own the results?"

Jason Wool, a lawyer specializing in cybersecurity issues with Venable, LLP, called the beta testing proposal a good idea but one that is probably unnecessary for now because adoption is voluntary.

"If the framework were mandatory, I would be far more inclined to agree that a beta phase would be necessary," Wool said. "That said, gathering data from those entities that adopt the framework over the course of their respective implementations is a great idea, particularly given that the framework may well serve as the basis of future, mandatory regulations," some time in future.

"If the framework does form the basis of future regulations, the agencies involved should be obligated to justify their requirements, at least in part, using data collected from entities that adopt the framework," he said.

This article, After healthcare.gov debacle, group pushes for tests of NIST cybersecurity framework, was originally published at Computerworld.com.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is jvijayan@computerworld.com.

See more by Jaikumar Vijayan on Computerworld.com.

FREE Computerworld Insider Guide: IT Certification Study Tips
Join the discussion
Be the first to comment on this article. Our Commenting Policies