Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

12/9/2011
03:51 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

White House Plans Cloud Security Program's Next Steps

Federal CIO Steven VanRoekel marked the official "launch" of the FedRAMP security accreditation service yesterday, but more needs to be done before agencies can take advantage the new program.

50 Most Influential Government CIOs
Slideshow: 50 Most Influential Government CIOs
(click image for larger view and for slideshow)
The White House on Thursday officially released a highly anticipated security framework that it says will accelerate the adoption of cloud computing in government, but agencies won't be able to take advantage of the Federal Risk and Authorization Management Program (FedRAMP) just yet.

FedRAMP will create a government-wide security authorization process that federal CIO Steven VanRoekel estimated on a phone call with reporters Thursday will save the government 30% to 40% in assessing, authorizing, and procuring cloud services.

That's thanks to what he called the program's "do-once, use-many-times framework" in which the FedRAMP program management office would authorize a service, and then other agencies could leverage that authorization, obviating the duplicative and time-consuming security accreditation process that's required today. Without FedRAMP, agencies that want to adopt cloud computing typically duplicate the tests already done by other agencies, which leads to longer-than-necessary lead times to deploy new services.

Although FedRAMP will change this, the program's initial launch, which included the release of a policy memo detailing the program in new depth and setting deadlines for its ramp-up, is just a first step. FedRaMP won't become fully operational and able to take on its full assessment, authorization, and monitoring duties until sometime within the next six months.

[Should we worry about government migrating to the cloud? See Feds: Cloud Computing Doesn't Increase Security Risk.]

FedRAMP has been a long time coming already. The program began in October 2009 in the Cloud Computing Advisory Council's security working group and was first publicly discussed in March 2010. The first draft iteration of the FedRAMP process was released in November 2010. The government missed several deadlines it had publicly announced for the project's release.

The new guidance outlines how the FedRAMP program will actually operate. The General Services Administration and the Department of Homeland Security will run FedRAMP's Joint Authorization Board, which will oversee the overall FedRAMP process. That will include approving private sector companies to assess cloud services for government agencies, prioritizing service authorizations, and issuing initial operational authority to cloud service providers.

In addition to the Joint Authorization Board, FedRAMP will be managed through a program management office in the GSA's Office of Citizen Services and Innovative Technologies. "We'll be performing a lot of the punt, pass, and kick to make it run smoothly," says Dave McClure, director of the office of citizen services and innovative technologies.

The office will create service level agreements, templates, and other elements for the program, as well as a repository to house and securely share assessment, accreditation, and authorization information across agencies.

The National Institute of Standards and Technology, meanwhile, has played a critical role in the development of FedRAMP, developing the applicable system requirements under FISMA and designing and implementing the assessment program itself, and will continue to work on standard assessment procedures.

There are several steps between where FedRAMP is today and its actual initial operating capacity. Within 30 days, the CIO Council will publish FedRAMP's standardized baseline security controls. Within 60 days, the program management office will publish more-detailed process documentation. Within 90 days, the Joint Authorization Board will publish its governance model.

GSA will hold an industry day on Dec. 16 to educate industry members on FedRAMP and its third-party assessment process, which will allow private companies to perform "initial and periodic assessment" of cloud systems in line with FedRAMP requirements, according to an overview of the program.

Our annual Federal Government IT Priorities Survey shows how agencies are managing the many mandates competing for their limited resources. Also in the new issue of InformationWeek Government: NASA veterans launch cloud startups, and U.S. Marshals Service completes tech revamp. Download the issue now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3154
PUBLISHED: 2020-01-27
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
CVE-2019-17190
PUBLISHED: 2020-01-27
A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe (which is running as NT AUTHORITY\SYSTEM) when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, the...
CVE-2014-8161
PUBLISHED: 2020-01-27
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
CVE-2014-9481
PUBLISHED: 2020-01-27
The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.
CVE-2015-0241
PUBLISHED: 2020-01-27
The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric ...