Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Federal Cybersecurity Guidelines Now Cover Cloud, Mobility

Emerging technologies and cyber threats are focus of NIST's first update to feds' security handbook in three years.

Top 10 Open Government Websites
Top 10 Open Government Websites
(click image for larger view and for slideshow)
New technologies, such as mobile and cloud computing, that are rapidly being adopted by the federal government have informed a major update to federal cybersecurity standards.

The National Institute of Standards and Technology (NIST) has released the first public draft of Security and Privacy Controls for Federal Information Systems and Organizations, Special Publication (SP) 800-53.

The document is the federal handbook for cybersecurity standards to support the Federal Information Security Management Act (FISMA) and is used across agencies to protect IT systems from cyber threats.

The publication is the first update to the guide since 2009, and a lot has changed in the federal cybersecurity landscape over the last several years. The publication includes changes that reflect the new technologies and threats that have emerged in that timeframe.

[ A new report offers federal agencies guidelines on cloud services. Read more at Feds Offer Agencies Guidance On Cloud Implementation. ]

When the last edition was published, for example, cloud computing was in its nascent stages and smartphones like the iPhone were mainly a consumer phenomenon. Now the federal government has instituted a "cloud-first" policy that has made the former technology a priority for current and future IT projects. And iPhones, iPads, and Android-based mobile devices and tablets are being used government-wide, sometimes as part of a "bring your own device" policy agencies are instituting to allow employees to choose what smartphone they use at work.

The update does not categorize new security controls that focus on these technologies specifically, but distributes them "throughout the control catalog in various families" and provides "specific security capabilities that are needed to support those new computing technologies and computing approaches," NIST said in notes about the publication.

However, NIST has given guidance around privacy--another new area addressed in the publication--its own appendix because of its importance.

The update also includes security standards for other new threats that have surfaced since the last update, including supply-chain risk and the possibility of security breaches from insider personnel.

Both are areas that federal agencies themselves also have been focusing on in their own cybersecurity efforts. The Department of Defense, for example, has been developing technology that can preemptively detect when personnel may be about to turn on the department and stop an insider threat before it happens.

The updated publication comes as the feds' entire approach to creating safer IT systems undergoes "a significant transformation," according to NIST.

"Near real-time risk management and the ability to design, develop, and implement effective continuous monitoring programs depends first and foremost on the organization's ability to develop a strong information technology infrastructure--in essence, building stronger, more resilient information systems using system components with sufficient security capability to protect core missions and business functions," the agency said.

The public has until April 6 to comment on the draft. The final version of the publication is expected in July, according to NIST. InformationWeek and InformationWeek Government are conducting a survey on IT security and cybersecurity in U.S. federal government agencies. Upon completion of our survey, you will be eligible to enter a drawing to receive an Apple 16-GB iPad 2. Take our Federal Government Cybersecurity Survey now. Survey ends March 9.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.