Two NIST Publications Recommend Organization-Wide IT Security Risk Management

Two new draft publications from the National Institute of Standards and Technology (NIST) provide the groundwork for a three-tiered risk-management approach that encompasses computer security risk planning from the highest levels of management to the level of individual systems. The draft documents have been released for public comment.

Both publications are a part of NIST’s risk management guidelines, which have been developed in support of the Federal Information Security Management Act (FISMA), and adopted government wide to improve the security of government systems and information.

Both call for upper-level management to understand that information security is a key component to mission-critical functions and that top managers need to manage information security risk in coordination with chief information officers, chief information security officers and system owners to meet the organization’s goals.

Integrated Enterprise-Wide Risk Management: Organization, Mission, and Information System View (Special Publication 800-39, available in pdf format at http://csrc.nist.gov/publications/PubsDrafts.html#SP-800-39), is the capstone document that applies this new perspective on how federal agencies and their contractors should manage information security risk.

“Most organizations currently manage risk using a tactical, system-by-system approach,” said Ron Ross, NIST Fellow and FISMA Implementation Project Leader. “This new framework suggests a three-tiered risk management approach that moves from organization to missions to information systems. The goal is for senior leaders and executives to manage risks strategically and drive investment and operational decisions based on the organization’s core missions and business functions.”

The new approach is particularly important as organizations address advanced persistent threats, which have the potential to degrade or debilitate federal information systems that support critical applications and operations of the federal government.

This publication is the fourth in the series developed by the Joint Task Force Transformation Initiative, a joint partnership among the Department of Defense, the Intelligence Community, NIST, and the Committee on National Security Systems. This draft provides significant changes from earlier versions of the publication and includes input from all partners in the Joint Task Force.

SP 800-39, once finalized, will supersede Risk Management Guide for Information Technology Systems (SP 800-30) as the source for guidance on risk management. A revised version of SP 800-30 will provide guidance on risk assessment consistent with SP 800-39 and is expected to be published in 2011.

Comments are requested on the draft of SP800-39. Please send them to sec-cert@nist.gov by Jan. 25.

The initial public draft of a second new NIST publication, Information Security Continuous Monitoring for Federal Information Systems and Organizations (Special Publication 800-137, available in pdf format at http://csrc.nist.gov/publications/PubsDrafts.html#SP-800-137), is a guide to developing and implementing a comprehensive continuous monitoring strategy for computer security risk management using a three-tiered approach, organization level, mission/business level and system level. A robust strategy for continuous monitoring of information security helps maintain ongoing awareness of information security and ensures that organizational security practice reflects the organization’s risk tolerance. It helps ensure that accurate, up-to-date information is available to enable timely risk management decisions.

“SP 800-137 encourages a holistic approach to managing risk through information security continuous monitoring.” said IT Specialist Kelley Dempsey. The publication describes how to develop a comprehensive continuous monitoring strategy. It provides methods to implement a continuous monitoring program including determination of measures and metrics, determination of monitoring frequencies, review and analysis of security-related information, response to information security risk, and revision of the strategy.

Featured

  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity

Webinars

New Products

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file. 3

  • XS4 Original+

    XS4 Original+

    The SALTO XS4 Original+ design is based on the same proven housing and mechanical mechanisms of the XS4 Original. The XS4 Original+, however, is embedded with SALTO’s BLUEnet real-time functionality and SVN-Flex capability that enables SALTO stand-alone smart XS4 Original+ locks to update user credentials directly at the door. Compatible with the array of SALTO platform solutions including SALTO Space data-on-card, SALTO KS Keys as a Service cloud-based access solution, and SALTO’s JustIn Mobile technology for digital keys. The XS4 Original+ also includes RFID Mifare DESFire, Bluetooth LE and NFC technology functionality. 3

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3