Risk
9/21/2011
02:44 PM
50%
50%

NIST Releases Federal Risk Assessment Guide

Federal technology standards body issues new guidelines for evaluating cyber security vulnerabilities.

Inside DHS' Classified Cyber-Coordination Headquarters
(click image for larger view)
Slideshow: Inside DHS' Classified Cyber-Coordination Headquarters
The federal organization for creating technology standards has released new guidance to help agencies assess risk within their IT systems as part of an overall strategy to instill more prevention in federal cybersecurity.

The National Institute for Standards and Technology (NIST) is currently seeking comments through Nov. 4 on its Guide for Conducting Risk Assessments, which updates an original version published nine years ago.

The guide is aimed at helping agencies evaluate the current threat landscape as well as identify potential vulnerabilities and the adverse impacts they may have on agency business operations and missions, according to NIST.

[Pacific Northwest National Laboratory CIO Jerry Johnson takes you inside the cyber attack that he faced down--and shares his security lessons learned, in Anatomy of a Zero-Day Attack.]

Risk assessment is one of four steps in agencies' general security risk-management strategy, according to NIST. Assessment helps agencies determine the appropriate response to cyberattacks or threats before they happen and guides their IT investment decisions for cyber-defense solutions, according to the organization.

It also helps agencies maintain ongoing situational awareness of the security of their IT systems, something that is becoming more important to the federal government as it moves from a mere reactionary or compulsory security approach to one that proactively addresses risks and takes more consistent, preventative measures.

Indeed, in testimony Wednesday before Congress, a federal IT official noted the government's new focus on risk mitigation as key to its future security measures, particularly as they pertain to cloud computing and its security risks.

The government is "shifting the risk from annual reporting under FISMA to robust monitoring and more mitigation" in an attempt to strengthen the security of federal networks, said David McClure, associate administrator for the General Services Administration's office of citizen services and innovative technologies during a House subcommittee on technology and innovation hearing.

To this end, NIST has been working to provide cybersecurity guidelines and standards to agencies as they work to better lock down federal IT systems.

Changes also have been made to how agencies report their security compliance. Agencies recently were required to report security data to an online compliance tool called CyberScope as part of fiscal year 2011 requirements for the Federal Information Security Management Act (FISMA), a standard for federal IT security created and maintained by NIST.

In the new, all-digital issue of InformationWeek Government: As federal agencies close data centers, they must drive up utilization of their remaining systems. That requires a well-conceived virtualization strategy. Download the issue now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7896
Published: 2015-03-03
Multiple cross-site scripting (XSS) vulnerabilities in HP XP P9000 Command View Advanced Edition Software Online Help, as used in HP Device Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Tiered Storage Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Replication Manager 6.x and 7.x before ...

CVE-2014-9283
Published: 2015-03-03
The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.

CVE-2014-9683
Published: 2015-03-03
Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.

CVE-2015-0890
Published: 2015-03-03
The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.

CVE-2015-2168
Published: 2015-03-03
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in customer-controlled software. Notes: none.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.