Federal Cybersecurity Guidelines Now Cover Cloud, Mobility
February 29, 2012
New technologies, such as mobile and cloud computing, that are rapidly being adopted by the federal government have informed a major update to federal cybersecurity standards.
The National Institute of Standards and Technology (NIST) has released the first public draft of Security and Privacy Controls for Federal Information Systems and Organizations, Special Publication (SP) 800-53.
The document is the federal handbook for cybersecurity standards to support the Federal Information Security Management Act (FISMA) and is used across agencies to protect IT systems from cyber threats…
The publication is the first update to the guide since 2009, and a lot has changed in the federal cybersecurity landscape over the last several years. The publication includes changes that reflect the new technologies and threats that have emerged in that timeframe.
When the last edition was published, for example, cloud computing was in its nascent stages and smartphones like the iPhone were mainly a consumer phenomenon. Now the federal government has instituted a "cloud-first" policy that has made the former technology a priority for current and future IT projects. And iPhones, iPads, and Android-based mobile devices and tablets are being used government-wide, sometimes as part of a "bring your own device" policy agencies are instituting to allow employees to choose what smartphone they use at work.
The update does not categorize new security controls that focus on these technologies specifically, but distributes them "throughout the control catalog in various families" and provides "specific security capabilities that are needed to support those new computing technologies and computing approaches," NIST said in notes about the publication.
However, NIST has given guidance around privacy–another new area addressed in the publication–its own appendix because of its importance.
The update also includes security standards for other new threats that have surfaced since the last update, including supply-chain risk and the possibility of security breaches from insider personnel.
Both are areas that federal agencies themselves also have been focusing on in their own cybersecurity efforts. The Department of Defense, for example, has been developing technology that can preemptively detect when personnel may be about to turn on the department and stop an insider threat before it happens.
The updated publication comes as the feds’ entire approach to creating safer IT systems undergoes "a significant transformation," according to NIST.
"Near real-time risk management and the ability to design, develop, and implement effective continuous monitoring programs depends first and foremost on the organization’s ability to develop a strong information technology infrastructure–in essence, building stronger, more resilient information systems using system components with sufficient security capability to protect core missions and business functions," the agency said.
The public has until April 6 to comment on the draft. The final version of the publication is expected in July, according to NIST.