For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Feds look to finalize IT security controls
or
Other Security Stories
|
|
|
|
February 07, 2005 (Computerworld) -- The National Institute of Standards and Technology (NIST) has released the final draft of a set of recommended security controls for federal information systems.
The controls are likely to become a mandatory and nonwaivable Federal Information Processing Standard by the end of this year for all federal systems except those related to national security.
Some analysts predicted that the mandatory controls will cause problems for agencies, especially smaller ones.
"It's OK to specify certain objectives. But it becomes hard if things are mandated down to the specific controls," said Michael Rasmussen, an analyst at Forrester Research Inc. "You can't apply a one-size-fits-all set of controls."
The third and final version of NIST's Special Publication 800-53 document incorporates several recommendations from people who commented on previously published versions, said Ron Ross, project leader of NIST's Federal Information Security Management Act (FISMA) Implementation Project.
Passed in 2002, FISMA is the primary legislation covering the security of federal information systems.
Draft Changes
According to Ross, major changes in the final draft include a reduction in the number of security controls for low-impact systems, a new set of application-level controls and greater discretionary powers for organizations to downgrade controls.
Also included in the final draft is language that allows federal agencies to keep their existing security measures if they can demonstrate that the level of security is equivalent to the standards being proposed by NIST.
Following a two-week public comment period, a final version of SP 800-53 is expected to be approved by the U.S. Commerce Department by the end this month, Ross said.
Around June, NIST will publish a guide that federal agencies can use to assess the security measures they have put in place, Ross added. "It will allow them to see if the controls they have implemented are producing the desired results," he said.
Adopting standards such as those proposed by NIST is crucial to the security of federal systems and to overall Internet security, said Larry Clinton, chief operating officer at the Internet Security Alliance (ISA) in Arlington, Va. But mandating compliance, even in the public sector, is a bad idea, he said.
ISA is a collaboration between the CERT Coordination Center at Carnegie Mellon University and the Electronic Industries Alliance, a federation of trade associations.
"The problem we're trying to solve changes far too quickly," Clinton said. "A traditional regulatory process just can't keep pace."
Except when dealing with classified information, there's little reason to apply mandatory controls to federal systems, added Will Ozier, president of OPA Inc., a Vacaville, Calif.-based risk management consultancy. Controls should be applied based on "a quantitative risk assessment that anticipates the prospective loss" resulting from a cyberattack, Ozier said.
Security Mandate
FISMA requires agencies to:
Group their information systems into low-, medium- and high-risk categories.
Select and implement an initial set of baseline security controls for each category.
Adjust the initial controls based on an assessment of local risks and conditions.
Monitor the controls on a continual basis in order to gauge their effectiveness.
Source: NIST
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
 |
|
All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Why SaaS is Vital to Email and Web Security
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs.
Get this white paper now!
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
- Microsoft promises four patches next week
- Google gives away home-cooked Web application security scanner
- Storm botnet stages Fourth of July attacks
- More top stories
Security Management ZoneSecurity management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones
|
 Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.New baits 
|
"Security Directions" virtual trade show2008's Code-Red Security Issues for Protecting the EnterpriseWebcasts, white papers, demos, and more. Presented in a unique 3-d environment. Enter our show right now! Click here to enter
|
 In SecuritySecurity's important, and risk must be addressed, right? Sure, but watch for four signs your policies go a bit overboard. Click here to read the latest column by Jon Espenschied |
CIO
Computerworld
CSO
DEMO
GamePro
Games.net
IDG Connect
IDG World Expo
Infoworld
The Industry Standard
ITworld
JavaWorld
LinuxWorld
MacUser
Macworld
Network World
PC World
Playlist
Copyright © 2008 Computerworld Inc. All
rights reserved. Reproduction in whole or in part in any form or medium
without express written permission of Computerworld Inc. is prohibited.
Computerworld and Computerworld.com and the respective logos are
trademarks of International Data Group Inc.
|
