No Bold Moves On U.S. Cybersecurity Framework

New cybersecurity framework, to be created per a February Obama administration executive order, likely will draw heavily from existing cybersecurity standards.

Military Drones Present And Future: Visual Tour (click image for larger view and for slideshow)
Even after months of outreach and research, the critical infrastructure cybersecurity framework created pursuant to the recent White House executive order might wind up as an aggregation of references to other, pre-existing standards instead of a comprehensively new framework.
However, thats not necessarily a bad thing, according to government and private sector cybersecurity leaders speaking at the National Institute of Standards and Technologys (NIST) Cybersecurity Framework Workshop at Department of Commerce Headquarters in Washington on Wednesday.
The framework will probably be a set of references to existing standards, NIST director Patrick Gallagher said in remarks to a room full of public and private sector cybersecurity pros. Gallagher added that the framework seeks to create a strong common language around cybersecurity.
[ Is the nation at risk of cyber attack? Read
U.S. Cybersecurity Status Weak, Reports Charge
. ]
NIST is overseeing the development of the voluntary cybersecurity framework, which is one of a number of elements required under a February
executive order
that aims to improve critical infrastructure cybersecurity and encourage information to be shared between public and private sectors.
Government officials said they hope extensive outreach will encourage adoption. We recognize that there are leaders in the private sector already implementing strong policies and procedures, said Jane Holl Lute, deputy secretary of the
Department of Homeland Security
. We believe that the companies driving cybersecurity in their own current initiatives can help create best practices for all across the nations critical infrastructure.
In a panel discussion after Gallagher, Lute and other government officials made introductory remarks, private sector cybersecurity executives echoed the need for a collaborative framework development process that draws on existing cyber standards.
The bottom line to me is that an adopt-and-go approach, even though you may have to tailor it to your own environment, is much better than building from scratch, said Reid Stephan, information security manager at St. Lukes Health System in Idaho. St. Lukes has joined the National Health Information Sharing and Analysis Center (NH-ISAC) and has adopted a risk assessment approach based on
NIST
standards for risk assessment.
Government might also spark participation with incentives to companies that adopt the framework. The Department of Homeland Security, Department of Commerce, and the Treasury plan to issue a report to the President detailing various possible incentives, and Commerce recently issued a notice of inquiry to ask members of the public about incentives.
Initial development of the critical infrastructure cybersecurity framework will take place between now and October, when the first draft of the framework is due. The government is already actively gathering public input on a framework, with responses to a request for information due next Monday. The Department of Commerce also plans to hold at least three additional events beyond the Tuesday workshop, with the next event scheduled at Carnegie Mellon University in late May.
Beyond the references to other standards, it is unclear exactly what might go into the framework. NIST plans to organize framework development around three areas: managing risk, cyber hygiene, and tools and metrics. These are the pieces that will be critical, Gallagher said. How do we prepare for the threat, what are the core protections that should be in place regardless of your mission, and what are the tools and metrics to be successful?
The private sector representatives at the event proposed a number of possible content areas. Merck associate VP of IT risk management and chief information security officer Terry Rice said hed like to see higher-order, standardized risk management metrics that draw on tactical cybersecurity data, and perhaps greater cross-industry standardization around identity management. St. Lukes Stephan called for a more risk-based than control-based framework.
Whatever the case, the end product will need to be flexible enough to grow with changes in technology, said Department of Commerce deputy secretary Rebecca Blank.
A well-defended perimeter is only half the battle in securing the governments IT environments. Agencies must also protect their most valuable data. Also in the new, all-digital
Secure The Data Center
issue of InformationWeek Government: The White Houses gun control efforts are at risk of failure because the Bureau of Alcohol, Tobacco, Firearms and Explosives outdated Firearms Tracing System is in need of an upgrade. (Free registration required.)

Last News
▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
No Bold Moves On U.S. Cybersecurity Framework