NIST SP 800-137

From: FCW

By Sean Lyngaas

Twelve years after its creation, the Department of Homeland Security is at a crossroads in how it handles its ever-evolving cybersecurity mission. On the one hand, the department says it lacks the legal authority to tackle the subject, and it struggles to hire and retain cybersecurity experts. On the other hand, former DHS officials say key cybersecurity programs and the department’s ability to coordinate the response to cyber threats — internally, with other agencies and with industry — has markedly improved.

From: InfoSec Community Forums

Quoting Diary:

Continuing our theme of False Positives this month, I’d like to talk about the process of managing false positives we encounter in the course of analysis.  False positives will almost always show at some point during a security analysis, which leads to unwanted additional work on the part of either the sysadmins, security teams, or both.  Even worse, continued false positives can lead to complacency during analysis, where things are ‘assumed’ false because they have been seen before, and allowed to pass as normal when indeed it would be a symptom of malicious behavior. 

From: Federal Times

By AARON BOYD

Contract solicitations for the remaining groups of Phase I of the Continuous Diagnostics and Mitigation (CDM) IT security program will be released during fiscal 2015 and a number of awards are expected during that time, as well, according to program managers overseeing the rollout. The new timetable represents a delay from the original schedule, which projected award announcements before the end of the calendar year.

Federal agencies have been split into six groups – A through F – based on their integration with other agencies and the maturity of their cybersecurity postures. The full program will be implemented in three phases.

From: FederalNewsRadio.com 1500AM

The Homeland Security Department is pushing the continuous diagnostics and  mitigation program to the cutting edge. CDM is just over a year old, but DHS is  already reviewing new cyber technologies to include in the contract. John  Streufert, director of Federal Network Resilience at the National Protection and  Programs Directorate in DHS, tells Federal News Radio’s Executive Editor Jason  Miller how the Leap Ahead program is ensuring agencies get the latest and  greatest cyber tools.

From: FCW

By Mark Rockwell

The General Services Administration is looking forward to providing continuous diagnostics and mitigation services through the federal cloud authorization program, but that effort faces some challenges before it becomes a reality, according to a top CDM manager at GSA.

“At some point, the two will marry,” said Jim Piche, manager of the agency’s Federal Systems Integration and Management Center DHS Group.

Read Complete Article

From: FedBiz

Steve Charles

The federal cybersecurity market segment has finally started to gel into a definable, addressable market – valued at $13 billion, if you believe the Office of Management and Budget estimates. But it might actually be even higher than that.

For more than 10 years federal agencies have been buying assorted tools and services tightening the security controls and improving risk postures of federal business systems to get good grades on their annual report cards to Congress. But for nearly six years, bigger picture thinkers have been trying to set up a coherent cyber policy backed by legislation that would point the way for the entire country. New legislation still hasn’t arrived, but a funded program called continuous diagnostics and mitigation — CDM for short – has taken hold as the next phase of fighting cyber attacks in federal information systems.

From: RT

After failing to identify the potentially disastrous Heartbleed bug, the United States Department of Homeland Security has successfully lobbied to have the ability to conduct “regular and proactive scans” of civilian agency systems.

Beth Cobert, the deputy director for management at the White House Office of Management and Budget, wrote on Friday that “growing cybersecurity threats,” including this year’s Heartbleed bug, have prompted the federal government to embrace better tactics aimed at ensuring the computer networks used by agencies stays secure.

From: GCN/Cybereye

The news in government cybersecurity is not all bad.

***

In the report for FY 2013 however, overall performance jumped to 81 percent, “with significant improvements in areas such as the adoption of automated configuration management, remote access authentication and email encryption.”

I am the first to admit that FISMA compliance – or compliance with any standards – does not equate to security. But the reports provide a useful baseline and indicate that agencies are paying attention to their security and the maturity of their programs.

Read Complete Article