Feds look to finalize IT security controls

Computerworld - The National Institute of Standards and Technology (NIST) has released the final draft of a set of recommended security controls for federal information systems.

The controls are likely to become a mandatory and nonwaivable Federal Information Processing Standard by the end of this year for all federal systems except those related to national security.

Some analysts predicted that the mandatory controls will cause problems for agencies, especially smaller ones.

"It's OK to specify certain objectives. But it becomes hard if things are mandated down to the specific controls," said Michael Rasmussen, an analyst at Forrester Research Inc. "You can't apply a one-size-fits-all set of controls."

The third and final version of NIST's Special Publication 800-53 document incorporates several recommendations from people who commented on previously published versions, said Ron Ross, project leader of NIST's Federal Information Security Management Act (FISMA) Implementation Project.

Passed in 2002, FISMA is the primary legislation covering the security of federal information systems.

Draft Changes

According to Ross, major changes in the final draft include a reduction in the number of security controls for low-impact systems, a new set of application-level controls and greater discretionary powers for organizations to downgrade controls.

Also included in the final draft is language that allows federal agencies to keep their existing security measures if they can demonstrate that the level of security is equivalent to the standards being proposed by NIST.

Following a two-week public comment period, a final version of SP 800-53 is expected to be approved by the U.S. Commerce Department by the end this month, Ross said.

Around June, NIST will publish a guide that federal agencies can use to assess the security measures they have put in place, Ross added. "It will allow them to see if the controls they have implemented are producing the desired results," he said.

Adopting standards such as those proposed by NIST is crucial to the security of federal systems and to overall Internet security, said Larry Clinton, chief operating officer at the Internet Security Alliance (ISA) in Arlington, Va. But mandating compliance, even in the public sector, is a bad idea, he said.

ISA is a collaboration between the CERT Coordination Center at Carnegie Mellon University and the Electronic Industries Alliance, a federation of trade associations.

"The problem we're trying to solve changes far too quickly," Clinton said. "A traditional regulatory process just can't keep pace."

Except when dealing with classified information, there's little reason to apply mandatory controls to federal systems, added Will Ozier, president of OPA Inc., a Vacaville, Calif.-based risk management consultancy. Controls should be applied based on "a quantitative risk assessment that anticipates the prospective loss" resulting from a cyberattack, Ozier said.