An Office of Management and Budget review is delaying the release of new supply chain and privacy security standards, subsequently creating a bottleneck that\u2019s delaying the release of several other security publications from National Institute of Standards and Technology, according to NIST fellow Ron Ross, who leads NIST\u2019s Federal Information Security (FISMA) Modernization Act Implementation Project.<\/p>\n\n\n\n
Ross said that OMB\u2019s Office of Information and Regulatory Affairs (OIRA) review of NIST\u2019s publication 800-53 revision 5, which provides new security controls for the government to follow, is delaying several other security publications that refer back to controls set in that document.<\/p>\n\n\n\n
\u201cThere are so many dependencies on 800-53,\u201d Ross said. \u201cThat document, as long as it\u2019s being held up for its final public draft, that\u2019s kind of put a hold on six other publications. We\u2019ve got things in the queue. We\u2019re just waiting for release from OIRA.\u201d<\/p>\n\n\n\n
NIST\u2019s fifth revision of the 800-53 publication removed privacy controls from the appendix and integrated them into the publication, Ross said.<\/p>\n\n\n\n
\u201cWe have now taken those privacy controls and fully implemented them across the entire catalog. \u2026 A lot of privacy controls got integrated into security controls where one control can do double duty,\u201d Ross said. \u201cIt\u2019s much more efficient to operate that way.\u201d<\/p>\n\n\n\n
Giving a brief overview of the revision of 800-53, which Ross said he hoped would be released \u201csoon,\u201d he said there are three new families of security controls in this final draft: program management, privacy control and supply chain security controls. There are now 20 families of controls, up from 17.<\/p>\n\n\n\n
Another important NIST publications awaiting release is 800-171B, which Ross said has been written in response to cyberthreats from nation-state actors. NIST 800-171B, which was started and then delayed after the government shutdown, was finished \u201cin record time\u201d post-shutdown. The Pentagon had pushed for the B-version in the aftermath of a breach of a Navy subcontractor a few years ago, he said.<\/p>\n\n\n\n
\u201cThe longer this bleeding continues, you\u2019re going to see our capabilities continue to degrade,\u201d Ross said. \u201cThat\u2019s why we have a sense of urgency about all of these requirements and the publications.\u201d<\/p>\n\n\n\n
Ross said the 800-171B publication has 30 new \u201cenhanced requirements\u201d that are specifically geared toward stopping advanced persistent threats. Ross called the requirements \u201csome of the best we\u2019ve ever had before.\u201d<\/p>\n\n\n\n
\u201cThat document, just like a bunch of other publications, has a dependency on the 853 security and privacy control catalog,\u201d Ross said. “Because those 30 new requirements we reference those … security controls in [853].\u201d<\/p>\n\n\n\n
Ross also said that the final draft of NIST\u2019s 800-160 Vol. 2 will be released Sept. 5, updating Vol. 1 that outlined 30 processes to build a system with proper cybersecurity controls into the lifecycle. Volume two is about cyber resiliency, he said, calling it \u201cone of the most important publications we\u2019ve ever had.\u201d<\/p>\n\n\n\n
Ross said that the publication is trying to move away from a \u201cone-dimensional\u201d strategy of entities using boundary protection technologies, like firewalls, to a multidimensional approach that prepares agencies if an adversary enters the network.<\/p>\n\n\n\n
\u201cWe have to be able to build into systems the capability to limit the damage the adversaries can do once they\u2019re on target,\u201d Ross said.<\/p>\n","protected":false},"excerpt":{"rendered":"
New NIST controls will include supply chain security and privacy controls … if they get past review.<\/p>\n","protected":false},"author":7,"featured_media":62031,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":14,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[106,31,15,110,14,33],"tags":[],"coauthors":[3242],"class_list":["post-21418","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-home","category-management","category-it-cloud-report","category-it-networks","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"2JBKPSLTPFA2PHM6UR2YYVZC4U","arc_canonical_url":"\/civilian\/omb\/2019\/08\/20\/many-government-cybersecurity-how-to-manuals-are-delayed\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n