NIST SP 800-137

From: FederalNewsRadio.com 1500AM

By Jason Miller | @jmillerWFED

***

Goodrich also said related to the high baseline is a continuous monitoring pilot. He said the PMO is testing a tool to take all scan reports, including those from the Plan of Action and Milestones (POAM), deviation requests and similar security data, and report the data to the JAB about the cloud service providers. The goal is to ensure the CSP is continually meeting the cyber standards.

“We are going through the pilot to see what level of effort is for the PMO to take on for agencies,” he said.

From: Channel Life [N.Z.]

Heather Wright

A new report from 451 Research has Splunk leading the way for enterprise security information and event management, with its querying capability and ease of integrating new data feeds winning favour.

***

“SIEM solutions still retain a reputation for being difficult to set up, difficult to add new feeds to, and difficult to tune,” Kennedy says. “That said, their value to the enterprise security manager is increasingly understood, and while many SIEM implementations may have started out as a compliance check mark, they have transcended those roots.”

Read Complete Article

From: FedScoop

Among the good: High-value assets appear to be locked up. Among the bad: Windows XP is on machines with top secret data.

By Greg Otto

The Department of Homeland Security has made significant progress in meeting the demands of the administration’s cybersecurity priorities but needs to do more, according to the department’s inspector general.

In a report released Thursday, the IG detailed an IT audit that looked at the full scope of the department, measuring various benchmarks attached to the 2014 Federal Information Security Management Act.

Read Complete Article

From: Data Protection Report

By Boris Segalis (US), Andrew Hoffman (US) and Kathryn Linsky

***

Immunity

In the provision that both raised the concerns of privacy advocates and was viewed as essential to enabling the sharing of cyber threat information with the government by businesses, CISA authorizes businesses to monitor their information systems and all information stored on, processed by, or transiting the information system, as long as the monitoring is for the purpose of protecting the information or information systems. The law grants to businesses full immunity from government and private lawsuits and other claims that may arise out of CISA-compliant monitoring in which businesses may engage.