Risk
4/3/2013
02:22 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

No Bold Moves On U.S. Cybersecurity Framework

New cybersecurity framework, to be created per a February Obama administration executive order, likely will draw heavily from existing cybersecurity standards.

Military Drones Present And Future: Visual Tour
Military Drones Present And Future: Visual Tour
(click image for larger view and for slideshow)
Even after months of outreach and research, the critical infrastructure cybersecurity framework created pursuant to the recent White House executive order might wind up as an aggregation of references to other, pre-existing standards instead of a comprehensively new framework.

However, that's not necessarily a bad thing, according to government and private sector cybersecurity leaders speaking at the National Institute of Standards and Technology's (NIST) Cybersecurity Framework Workshop at Department of Commerce Headquarters in Washington on Wednesday.

"The framework will probably be a set of references to existing standards," NIST director Patrick Gallagher said in remarks to a room full of public and private sector cybersecurity pros. Gallagher added that the framework seeks to create a "strong common language" around cybersecurity.

[ Is the nation at risk of cyber attack? Read U.S. Cybersecurity Status Weak, Reports Charge. ]

NIST is overseeing the development of the voluntary cybersecurity framework, which is one of a number of elements required under a February executive order that aims to improve critical infrastructure cybersecurity and encourage information to be shared between public and private sectors.

Government officials said they hope extensive outreach will encourage adoption. "We recognize that there are leaders in the private sector already implementing strong policies and procedures," said Jane Holl Lute, deputy secretary of the Department of Homeland Security. "We believe that the companies driving cybersecurity in their own current initiatives can help create best practices for all across the nation's critical infrastructure."

In a panel discussion after Gallagher, Lute and other government officials made introductory remarks, private sector cybersecurity executives echoed the need for a collaborative framework development process that draws on existing cyber standards.

"The bottom line to me is that an adopt-and-go approach, even though you may have to tailor it to your own environment, is much better than building from scratch," said Reid Stephan, information security manager at St. Luke's Health System in Idaho. St. Luke's has joined the National Health Information Sharing and Analysis Center (NH-ISAC) and has adopted a risk assessment approach based on NIST standards for risk assessment.

Government might also spark participation with incentives to companies that adopt the framework. The Department of Homeland Security, Department of Commerce, and the Treasury plan to issue a report to the President detailing various possible incentives, and Commerce recently issued a "notice of inquiry" to ask members of the public about incentives.

Initial development of the critical infrastructure cybersecurity framework will take place between now and October, when the first draft of the framework is due. The government is already actively gathering public input on a framework, with responses to a request for information due next Monday. The Department of Commerce also plans to hold at least three additional events beyond the Tuesday workshop, with the next event scheduled at Carnegie Mellon University in late May.

Beyond the references to other standards, it is unclear exactly what might go into the framework. NIST plans to organize framework development around three areas: managing risk, "cyber hygiene," and tools and metrics. "These are the pieces that will be critical," Gallagher said. "How do we prepare for the threat, what are the core protections that should be in place regardless of your mission, and what are the tools and metrics to be successful?"

The private sector representatives at the event proposed a number of possible content areas. Merck associate VP of IT risk management and chief information security officer Terry Rice said he'd like to see higher-order, standardized risk management metrics that draw on tactical cybersecurity data, and perhaps greater cross-industry standardization around identity management. St. Luke's Stephan called for a more risk-based than control-based framework.

Whatever the case, the end product will need to be flexible enough to grow with changes in technology, said Department of Commerce deputy secretary Rebecca Blank.

A well-defended perimeter is only half the battle in securing the government's IT environments. Agencies must also protect their most valuable data. Also in the new, all-digital Secure The Data Center issue of InformationWeek Government: The White House's gun control efforts are at risk of failure because the Bureau of Alcohol, Tobacco, Firearms and Explosives' outdated Firearms Tracing System is in need of an upgrade. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3861
Published: 2014-09-02
Cross-site scripting (XSS) vulnerability in CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted reference element within a nonXMLBody element.

CVE-2014-3862
Published: 2014-09-02
CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log.

CVE-2014-5076
Published: 2014-09-02
The La Banque Postale application before 3.2.6 for Android does not prevent the launching of an activity by a component of another application, which allows attackers to obtain sensitive cached banking information via crafted intents, as demonstrated by the drozer framework.

CVE-2014-5452
Published: 2014-09-02
CDA.xsl in HL7 C-CDA 1.1 and earlier does not anticipate the possibility of invalid C-CDA documents with crafted XML attributes, which allows remote attackers to conduct XSS attacks via a document containing a table that is improperly handled during unrestricted xsl:copy operations.

CVE-2014-6041
Published: 2014-09-02
The Android Browser application 4.2.1 on Android allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a \u0000 character, as demonstrated by an onclick="window.open('\u0000javascript: sequence.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.