Risk
4/3/2013
02:22 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

No Bold Moves On U.S. Cybersecurity Framework

New cybersecurity framework, to be created per a February Obama administration executive order, likely will draw heavily from existing cybersecurity standards.

Military Drones Present And Future: Visual Tour
Military Drones Present And Future: Visual Tour
(click image for larger view and for slideshow)
Even after months of outreach and research, the critical infrastructure cybersecurity framework created pursuant to the recent White House executive order might wind up as an aggregation of references to other, pre-existing standards instead of a comprehensively new framework.

However, that's not necessarily a bad thing, according to government and private sector cybersecurity leaders speaking at the National Institute of Standards and Technology's (NIST) Cybersecurity Framework Workshop at Department of Commerce Headquarters in Washington on Wednesday.

"The framework will probably be a set of references to existing standards," NIST director Patrick Gallagher said in remarks to a room full of public and private sector cybersecurity pros. Gallagher added that the framework seeks to create a "strong common language" around cybersecurity.

[ Is the nation at risk of cyber attack? Read U.S. Cybersecurity Status Weak, Reports Charge. ]

NIST is overseeing the development of the voluntary cybersecurity framework, which is one of a number of elements required under a February executive order that aims to improve critical infrastructure cybersecurity and encourage information to be shared between public and private sectors.

Government officials said they hope extensive outreach will encourage adoption. "We recognize that there are leaders in the private sector already implementing strong policies and procedures," said Jane Holl Lute, deputy secretary of the Department of Homeland Security. "We believe that the companies driving cybersecurity in their own current initiatives can help create best practices for all across the nation's critical infrastructure."

In a panel discussion after Gallagher, Lute and other government officials made introductory remarks, private sector cybersecurity executives echoed the need for a collaborative framework development process that draws on existing cyber standards.

"The bottom line to me is that an adopt-and-go approach, even though you may have to tailor it to your own environment, is much better than building from scratch," said Reid Stephan, information security manager at St. Luke's Health System in Idaho. St. Luke's has joined the National Health Information Sharing and Analysis Center (NH-ISAC) and has adopted a risk assessment approach based on NIST standards for risk assessment.

Government might also spark participation with incentives to companies that adopt the framework. The Department of Homeland Security, Department of Commerce, and the Treasury plan to issue a report to the President detailing various possible incentives, and Commerce recently issued a "notice of inquiry" to ask members of the public about incentives.

Initial development of the critical infrastructure cybersecurity framework will take place between now and October, when the first draft of the framework is due. The government is already actively gathering public input on a framework, with responses to a request for information due next Monday. The Department of Commerce also plans to hold at least three additional events beyond the Tuesday workshop, with the next event scheduled at Carnegie Mellon University in late May.

Beyond the references to other standards, it is unclear exactly what might go into the framework. NIST plans to organize framework development around three areas: managing risk, "cyber hygiene," and tools and metrics. "These are the pieces that will be critical," Gallagher said. "How do we prepare for the threat, what are the core protections that should be in place regardless of your mission, and what are the tools and metrics to be successful?"

The private sector representatives at the event proposed a number of possible content areas. Merck associate VP of IT risk management and chief information security officer Terry Rice said he'd like to see higher-order, standardized risk management metrics that draw on tactical cybersecurity data, and perhaps greater cross-industry standardization around identity management. St. Luke's Stephan called for a more risk-based than control-based framework.

Whatever the case, the end product will need to be flexible enough to grow with changes in technology, said Department of Commerce deputy secretary Rebecca Blank.

A well-defended perimeter is only half the battle in securing the government's IT environments. Agencies must also protect their most valuable data. Also in the new, all-digital Secure The Data Center issue of InformationWeek Government: The White House's gun control efforts are at risk of failure because the Bureau of Alcohol, Tobacco, Firearms and Explosives' outdated Firearms Tracing System is in need of an upgrade. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4793
Published: 2014-12-27
The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request.

CVE-2013-5958
Published: 2014-12-27
The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a si...

CVE-2013-6041
Published: 2014-12-27
index.php in Softaculous Webuzo before 2.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in a SOFTCookies sid cookie within a login action.

CVE-2013-6043
Published: 2014-12-27
The login function in Softaculous Webuzo before 2.1.4 provides different error messages for invalid authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of requests.

CVE-2013-6227
Published: 2014-12-27
Unrestricted file upload vulnerability in plugins/editor.zoho/agent/save_zoho.php in the Zoho plugin in Pydio (formerly AjaXplorer) before 5.0.4 allows remote attackers to execute arbitrary code by uploading an executable file, and then accessing this file at a location specified by the format param...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.