The federal government program that certifies cloud technologies for use in federal government is reaching out to agencies to gather threat intelligence reports to refine its certification process.<\/p>\n\n\n\n
Speaking Sept. 4 at the Billington CyberSecurity conference in Washington, D.C., Ashley Mahan, acting director of the General Services Administration\u2019s Federal Risk and Authorization Management Program, said that FedRAMP is expanding toward a \u201cthreat-based approach to authorization and risk-monitoring.\u201d<\/p>\n\n\n\n
\u201cRight now, we\u2019re working with various government agencies in obtaining that threat intelligence information, what kinds of threats are posed to our IT, and we\u2019re literally mapping that to the suite of controls and security requirements that our cloud service providers meet,\u201d Mahan said.<\/p>\n\n\n\n
By incorporating these threats into the FedRAMP authorization process, Mahan said the program is going to \u201cempower agencies to have a risk-based approach to this authorization.\u201d<\/p>\n\n\n\n
Adjusting the security requirements to protect against threats agencies actually face will help agencies be more prepared for threats on the first day of cloud deployment, she said.<\/p>\n\n\n\n
\u201cIt gives the agency the ability to start using the product faster … and not only that, we\u2019re going to take that information and also apply it to continuous monitoring,\u201d Mahan said.<\/p>\n\n\n\n
Mahan said that cloud services providers currently go through annual audits of security requirements, but with the integration of threat assessments, the audit process will be \u201csmarter.\u201d<\/p>\n\n\n\n
\u201cThe threat information will also dictate what are the things that we need to audit,\u201d Mahan said.<\/p>\n","protected":false},"excerpt":{"rendered":"
The Federal Risk and Authorization Management Program wants threat intelligence reports to make its audit process smarter.<\/p>\n","protected":false},"author":7,"featured_media":31184,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"9":{"categories":["cyber"],"primary_category":"cyber"}}},"categories":[104,63,106,36,31,110,14,33,6],"tags":[],"coauthors":[3242],"class_list":["post-14526","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-acquisition-update","category-cloud","category-daily-brief","category-gsa","category-home","category-it-cloud-report","category-it-networks","category-newsletters","category-acquisition"],"acf":{"subheadline":"","legacy_arc_id":"74HDUZJKZJGTHFMQTSJ2LH5N64","arc_canonical_url":"\/it-networks\/cloud\/2019\/09\/04\/a-fedramp-plan-to-strengthen-cloud-security\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n