blog

0
63
Monday, January 1, 2016

What has NIST done for me lately?

What has NIST done for me lately?

According to a study, 82 percent of federal IT professional respondents reported that they were using the NIST (National Institute of Standards and Technology) cybersecurity framework to improve their security stance. The survey also demonstrated that the document is being used as a stepping stone to a more secure government. When I first read this, my immediate reaction was a resounding, “So what!” These results tell me that US Federal Government agencies are using US Government guidance to do their US Government job. Isn’t that what you would expect? Making an impression on me would require a study across multiple industry verticals. If other industries were voluntarily using the NIST Framework, that would be saying something!

Wouldn’t you know it, but such an independent study was actually conducted earlier this year. In March of 2015, the National Cybersecurity Institute did a study of Chief Information Security Officers across multiple industries. This survey not only looked into cybersecurity practices of the US government and military, but it also delved into the security practices of other verticals including Energy/Utilities, Consulting, Information Technology and Banking/Finance. When asked about the specific security standards or frameworks their organization used, 53.1 percent of the respondents cited NIST! This response level was higher than those recorded for Information Technology Infrastructure Library (ITIL), ISO/IEC (International Organization for Standardization/International Electrotechnical Commission) HIPPA (Health Insurance Portability and Accountability Act of 1996), COBIT (Control Objectives for Information and Related Technology) and CMM (Capability Maturity Model). Yes, that impressed me.

What has NIST done for me lately?

When Paul Christman, vice president of federal for Dell Software was interviewed by FedScoop, a leading online publication that covers the US Government market, he said the framework is “just good policy”.

“It applies to schools, universities, hospitals, [the Defense Department], [the Intelligence Community], and civilian agencies. The document doesn’t say ‘This is how the government should protect the government,’ ‘This is how a bank should protect a bank.’ NIST was really trying to say ‘This wasn’t a government program or mandate;’ it’s just good practice.” Kent Landfield, director of standards and technology policy at Intel Security, echoed this sentiment saying that his company was able to fit the NIST recommendations nicely into the information technology security evaluation process as a whole.

And as if NIST had planned to stage an encore performance, two new standards – 800-173, Cloud-Adapted Risk Management Framework: Guide for Applying the Risk Management Framework to Cloud-based Federal Information Systems, and 800-174, Security and Privacy Controls for Cloud-based Federal Information Systems – are currently being drafted for released. According to Dr. Michaela Iorga, senior security technical lead for cloud computing at NIST, these new frameworks are designed to overlay and elaborate upon already-existing standards that lay out the basics for cloud architecture and security. Iorga also suggests that federal organizations should also use FedRAMP, CSA’s Security, Trust and Assurance Registry (STAR), and other certification and authorization programs to make decisions about cloud computing.

With all this new knowledge in my head, I really gained a new appreciation for NIST. The agency seems to be really taking a lead on protecting cyberspace across the board. As the economic value of our collective digital economy gains in importance, this relatively small agency has placed itself at the vanguard of cybersecurity and is truly living up to its mission:

To promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.

Thank you NIST!

(This post was written as part of the Dell Insight Partners program, which provides news and analysis about the evolving world of tech. Dell sponsored this article, but the opinions are my own and don’t necessarily represent Dell’s positions or strategies.)

Cloud Musings
↑ Grab this Headline Animator

( Thank you. If you enjoyed this article, get free updates by email or RSS – © Copyright Kevin L. Jackson 2016)

This blog has been verified by Rise: Re9cb99744b65eb009b71a970003c015e

This blog has been verified by Rise:  Re9cb99744b65eb009b71a970003c015e

This blog has been verified by Rise: Re9cb99744b65eb009b71a970003c015e
Follow me at https://Twitter.com/Kevin_Jackson

LEAVE A COMMENT

Name*
E-mail*
Phone number*
Your Message

Latest posts

0
109

2018 AT&T Business Summit: Security “in” and “of” the Cloud

While public cloud is undoubtedly an outsized piece of the conversation, news headlines of the latest data breach can...

0
60

My Brush with Royalty: Queen Latifah

Queen Latifah! Hip Hop Icon. Movie Star. Television Star. Fashion Model. Songwriter. Producer. Entrepreneurial Genius...

0
68

What’s New in Puppet 5?

Puppet 5 is released and comes with several exciting enhancements and features that promise to make configuration man...

0
85

5 Reasons Why Ansible is the Best CM Tool Out There?

Amidst volatile markets, dynamic technology shifts, and ever-increasing customer demands, it is imperative for IT org...

0
111

Machine learning APIs for Google Cloud Platform

Google Cloud Platform (GCP) is considered to be one of the Big 3 cloud platforms among Microsoft Azure and AWS. GCP i...

0
71

What Is The Most Important Part of Architecture?

I always find it interesting to hear what people view architecture as. A lot of people think it’s just about the desi...

0
1657

Cloud migration best practice Part 4: Executing the migration

This series has stepped through cloud migration best practices. After providing an overview, we discussed: Classifyin...

0
238

Cloud Migration Best Practice Part 3: Application Portfolio Analysis

In part three of this series on cloud migration best practice, I will focus on migrating the application itself. If y...

0
329

Why Use Immutable Storage?

Data has become a global currency, and its value has nowhere to go but up.  According to The Economist online, the wo...

0
734

CLOUD ACT: What Does That Mean for Your Cloud Storage

When Congress names a law after you, it’s getting serious.  That is where we are now with cloud computing.  The Clari...