Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

NIST Releases Federal Risk Assessment Guide

Federal technology standards body issues new guidelines for evaluating cyber security vulnerabilities.

Inside DHS' Classified Cyber-Coordination Headquarters
(click image for larger view)
Slideshow: Inside DHS' Classified Cyber-Coordination Headquarters
The federal organization for creating technology standards has released new guidance to help agencies assess risk within their IT systems as part of an overall strategy to instill more prevention in federal cybersecurity.

The National Institute for Standards and Technology (NIST) is currently seeking comments through Nov. 4 on its Guide for Conducting Risk Assessments, which updates an original version published nine years ago.

The guide is aimed at helping agencies evaluate the current threat landscape as well as identify potential vulnerabilities and the adverse impacts they may have on agency business operations and missions, according to NIST.

[Pacific Northwest National Laboratory CIO Jerry Johnson takes you inside the cyber attack that he faced down--and shares his security lessons learned, in Anatomy of a Zero-Day Attack.]

Risk assessment is one of four steps in agencies' general security risk-management strategy, according to NIST. Assessment helps agencies determine the appropriate response to cyberattacks or threats before they happen and guides their IT investment decisions for cyber-defense solutions, according to the organization.

It also helps agencies maintain ongoing situational awareness of the security of their IT systems, something that is becoming more important to the federal government as it moves from a mere reactionary or compulsory security approach to one that proactively addresses risks and takes more consistent, preventative measures.

Indeed, in testimony Wednesday before Congress, a federal IT official noted the government's new focus on risk mitigation as key to its future security measures, particularly as they pertain to cloud computing and its security risks.

The government is "shifting the risk from annual reporting under FISMA to robust monitoring and more mitigation" in an attempt to strengthen the security of federal networks, said David McClure, associate administrator for the General Services Administration's office of citizen services and innovative technologies during a House subcommittee on technology and innovation hearing.

To this end, NIST has been working to provide cybersecurity guidelines and standards to agencies as they work to better lock down federal IT systems.

Changes also have been made to how agencies report their security compliance. Agencies recently were required to report security data to an online compliance tool called CyberScope as part of fiscal year 2011 requirements for the Federal Information Security Management Act (FISMA), a standard for federal IT security created and maintained by NIST.

In the new, all-digital issue of InformationWeek Government: As federal agencies close data centers, they must drive up utilization of their remaining systems. That requires a well-conceived virtualization strategy. Download the issue now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
What the FedEx Logo Taught Me About Cybersecurity
Matt Shea, Head of Federal @ MixMode,  6/4/2021
Edge-DRsplash-10-edge-articles
A View From Inside a Deception
Sara Peters, Senior Editor at Dark Reading,  6/2/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23394
PUBLISHED: 2021-06-13
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
CVE-2021-34682
PUBLISHED: 2021-06-12
Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature.
CVE-2021-31811
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-31812
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-32552
PUBLISHED: 2021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.