NIST SP 800-137

From: SearchCloudSecurity

Marcia Savage, Site Editor

Cloud computing is an inevitable shift in IT that security teams can’t stop, but innovative security pros can figure out ways to ensure it’s adopted safely. 

That was the message conveyed by a panel of security executives at the RSA Conference 2012 on Wednesday. The cloud computing trend is accelerating and security teams need to adapt, panelists said.

“Most people in this room underestimate how fast we’ll move to cloud,” said Jerry Archer, senior vice president and CSO at Sallie Mae. With some estimating that cloud computing can cut IT costs by 85%, “security is not likely going to stand in the way,” he added.

 Editor’s Note: The joint CIO Council – Chief Acquisition Officers Council publication, “Creating Effective Cloud Computing Contracts for the Federal Government: Best Practices for Acquiring IT as a Service,” is attached below. 

From: Information Week

As agencies adopt cloud services, a new report helps set some guidelines around SLAs, security, and privacy.

By Elizabeth Montalbano

Since cloud computing services represents a paradigm shift from the way federal agencies historically have acquired IT systems, they have a number of new factors to consider–service-level agreements (SLAs), security and privacy among them–as they make plans to implement the cloud, according to a new report.

From: GovInfoSecurity.com

A Perfect Fit: Continuous Monitoring and Cloud Initiative

By Eric Chabrow

NIST information risk management evangelist Ron Ross sees continuous monitoring playing a vital role in securing cloud computing.

The Federal Risk and Authorization Management Program known as FedRAMP  fits very nicely with continuous monitoring by allowing agencies to define good sets of security requirements for cloud computing providers, Ross says in an interview previewing a presentation he will make at the RSA Conference 2012 in San Francisco later this month.

Attached below are the Center for Regulatory Effectiveness’ comments on the Second Draft of the CAESARS Framework Extension (NIST Interagency Report 7756).  The goal of the CAESARS FE document “is to facilitate enterprise continuous monitoring by presenting a reference model that enables organizations to aggregate collected data from across a diverse set of security tools, analyze that data, perform scoring, enable user queries, and provide overall situational awareness.”

CRE’s comments explain that “one reason why the CAESARS FE is an important IT security document is that it was written to be useful to industry as well as government.” 

From: WhiteSpace

by Patrick Dean

From: BankInfoSecurity.com

Privacy, Insider Threat, Mobile, Cloud Added to SP 800-53 Revision

By Eric Chabrow

NIST’s Ron Ross will be quite busy at RSA Conference 2012, not only promoting revised guidance on security and privacy controls to be unveiled at the securing conclave, but also participating in a panel on one of his favorite topics: continuous monitoring.

Ross, in an interview with Information Security Media Group, says National Institute of Standards and Technology will use the assemblage of information security experts in San Francisco later this month to release one of NIST’s most important pieces of guidance: Special Publication 800-53 Rev. 4, Recommended Security and Privacy Controls for Federal Information Systems and Organizations.

Editor’s Note:  The OIG 2011 Annual FISMA Report is attached below.

From: FierceGovernmentIT

From: FierceGovernmentIT

Attached below is the Janauary bulletin from NIST’s Information Technology Laboratory discussing SCAP revisions.

january-2012_itl-bulletin

CRE recommended to the Information Security and Privacy Advisory Board (ISPAB) that metrics are needed to assess whether FedRAMP is living up to its promise.  Specifically, metrics need to be developed which would accurately, objectively and transparently measure the security effectiveness and the cost effectiveness of Cloud Service Providers under the FedRAMP program. 

Moreover, since the federal government will eventually regulate the IT security of critical infrastructure, the metrics developed for FedRAMP will also be needed for whatever new regulatory program(s) come out of the various cybersecurity legislative proposals being deliberated by Congress.  CRE expects that federal regulation of critical infrastructure cyberdefenses will be based on FedRAMP’s conformity assessment approach to regulatory compliance.