02:44 PM

NIST Releases Federal Risk Assessment Guide

Federal technology standards body issues new guidelines for evaluating cyber security vulnerabilities.

Inside DHS' Classified Cyber-Coordination Headquarters
(click image for larger view)
Slideshow: Inside DHS' Classified Cyber-Coordination Headquarters
The federal organization for creating technology standards has released new guidance to help agencies assess risk within their IT systems as part of an overall strategy to instill more prevention in federal cybersecurity.

The National Institute for Standards and Technology (NIST) is currently seeking comments through Nov. 4 on its Guide for Conducting Risk Assessments, which updates an original version published nine years ago.

The guide is aimed at helping agencies evaluate the current threat landscape as well as identify potential vulnerabilities and the adverse impacts they may have on agency business operations and missions, according to NIST.

[Pacific Northwest National Laboratory CIO Jerry Johnson takes you inside the cyber attack that he faced down--and shares his security lessons learned, in Anatomy of a Zero-Day Attack.]

Risk assessment is one of four steps in agencies' general security risk-management strategy, according to NIST. Assessment helps agencies determine the appropriate response to cyberattacks or threats before they happen and guides their IT investment decisions for cyber-defense solutions, according to the organization.

It also helps agencies maintain ongoing situational awareness of the security of their IT systems, something that is becoming more important to the federal government as it moves from a mere reactionary or compulsory security approach to one that proactively addresses risks and takes more consistent, preventative measures.

Indeed, in testimony Wednesday before Congress, a federal IT official noted the government's new focus on risk mitigation as key to its future security measures, particularly as they pertain to cloud computing and its security risks.

The government is "shifting the risk from annual reporting under FISMA to robust monitoring and more mitigation" in an attempt to strengthen the security of federal networks, said David McClure, associate administrator for the General Services Administration's office of citizen services and innovative technologies during a House subcommittee on technology and innovation hearing.

To this end, NIST has been working to provide cybersecurity guidelines and standards to agencies as they work to better lock down federal IT systems.

Changes also have been made to how agencies report their security compliance. Agencies recently were required to report security data to an online compliance tool called CyberScope as part of fiscal year 2011 requirements for the Federal Information Security Management Act (FISMA), a standard for federal IT security created and maintained by NIST.

In the new, all-digital issue of InformationWeek Government: As federal agencies close data centers, they must drive up utilization of their remaining systems. That requires a well-conceived virtualization strategy. Download the issue now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest September 7, 2015
Some security flaws go beyond simple app vulnerabilities. Have you checked for these?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-08
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Published: 2015-10-06
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 21335999.

Published: 2015-10-06
Bluetooth in Android before 5.1.1 LMY48T allows attackers to remove stored SMS messages via a crafted application, aka internal bug 22343270.

Published: 2015-10-06
mediaserver in Android before 5.1.1 LMY48T allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bug 22954006.

Published: 2015-10-06
The Runtime subsystem in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23050463.

Dark Reading Radio
Archived Dark Reading Radio
What can the information security industry do to solve the IoT security problem? Learn more and join the conversation on the next episode of Dark Reading Radio.