Government // Cybersecurity
News
5/15/2014
11:05 AM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Retail Breaches Bolster Interest In NIST Cyber Security Advice

Target data breach highlighted risks in corporate supply chains, and companies are looking to government guidelines for ways to shore up cyber defense, says White House.

5 Online Tools Uncle Sam Wants You To Use
5 Online Tools Uncle Sam Wants You To Use
(Click image for larger view and slideshow.)

Last year's massive Target data breach, in which hackers infiltrated the retailer's point-of-sale system by exploiting a vendor's IT system, has prompted corporate executives to take a deeper look at the security posture of companies in their supply chains. It's also brought greater attention to recommendations released in February by the Obama administration, outlining voluntary national cyber security practices, a White House aide said this week.

The recommendations are part of a cyber security framework developed by the National Institute of Standards and Technology, together with private industry. The framework was originally aimed at critical infrastructure owners in 16 industries, including banks, utilities, and communications. But the document has caught the attention of executives in many fields, because it provides, for the first time, a common template for assessing corporate security practices across entire industries.

"One of the areas that we've seen companies... start to use the [cyber security] framework is in vendor management," as a tool for assessing cyber security risks in their supply chains, said Ari Schwartz, a cyber security advisor on the White House National Security Council.

[NIST wants your comments on cradle-to-grave IT development recommendations. Find out more: NIST Proposes Guidelines For More Secure IT Systems.]

Finding the weak security links in corporate supply chains has taken on greater urgency for top executives after investigators reported that hackers had gained access to Target's network using credentials obtained from a heating, ventilation, and air-conditioning (HVAC) vendor. The attackers ultimately made off with as many as 40 million credit and debit card numbers and personal information on 70 million customers. The breach also resulted in the March resignation of Target CIO Beth Jacobs and the departure of Target CEO Gregg Steinhafel earlier this month.

"The key to the cyber security framework is it allows a baseline across different sectors," said Schwartz. It allows banks, for instance, which have their own set of security practices, a way to better gauge the security practices of their suppliers and discuss that information with their boards of directors.

White House National Security Council Advisor Ari Schwartz and US Deputy CIO Lisa Schlosser at FOSE conference
White House National Security Council Advisor Ari Schwartz and US Deputy CIO Lisa Schlosser at FOSE conference

The framework has already fostered a new market for products that incorporate the cyber security standards outlined in the NIST framework, according to Schwartz.

PwC, for instance, offers a four-step process to implement the cyber security framework that emphasizes collaborative intelligence sharing, according to David Burg, PwC's global cyber security leader, who pointed to a PwC survey, which found that 82% of companies with high-performing security practices collaborate with others to achieve those goals.

"We feel federal agencies can use these [practices] as well," Schwartz said. He added that the administration's "goal is to take the language of the cyber security framework and make it the language of FISMA and the continuous diagnostics and mitigation process," referring to the federal law guiding agency security practices and to plans for protecting government IT systems.

The cyber security framework was a response to one of five primary areas of cyber security concerns at the White House, Schwartz said at a forum Tuesday at FOSE, a government technology tradeshow.

In addition to protecting the nation's critical infrastructure, Schwartz said the administration is also concentrating on securing federal networks, developing clearer thresholds for responding to cyberthreats, and working with allies and non-allies on international rules of engagement in dealing with cyber attacks.

Officials are also looking at research and development initiatives to try to get "ahead of the threats," and in particular, are looking for better identity management and credentialing systems. The user name and password system "is broken, and has been for many years," he said.

Getting agencies to identify and fix common vulnerabilities, using continuous diagnostics and monitoring (CDM) techniques, is a chief priority for the administration and US deputy CIO Lisa Schlosser.

"Ninety percent of cyber attacks are using common vulnerabilities," such as phishing and failing to keep patches up to date, and "96% of breaches can be avoided by employing basic controls and hygiene on networks," she said at the forum.

The White House Office of Management and Budget, the National Security Council, and the Department of Homeland Security have begun a three-phase effort to adopt CDM practices, Schlosser said. Administration officials just completed a government-wide contracting vehicle to help agencies purchase diagnostics hardware and software. Phase 2 will focus on understanding "who's on the network, where, and why," and Phase 3 will attempt to provide "real-time visibility, to see what threats are affecting one agency" and use that information to guard against attacks on other agencies, said Schlosser.

NIST's cyber security framework gives critical-infrastructure operators a new tool to assess readiness. But will operators put this voluntary framework to work? Read the Protecting Critical Infrastructure issue of InformationWeek Government today.

Wyatt Kash is a former Editor of InformationWeek Government, and currently VP for Content Strategy at ScoopMedia. He has covered government IT and technology trends since 2004, as Editor-in-Chief of Government Computer News and Defense Systems (owned by The Washington Post ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
asksqn
50%
50%
asksqn,
User Rank: Ninja
6/10/2014 | 5:00:11 AM
Security isn't brain surgery
Curiously enough, NIST doesn't actually specify obvious practices, like say, oh, hiring an Information Security Officer. Following are some pertinent numbers (excerpted from Krebs on Security) of the Target breach that have nothing whatsoever to do with having to read about it in NIST.

If the US had a government that paid any kind of attention to consumer data breaches instead of enabling industry to get away with shoddy/non-existent security practices, we wouldn't need a NIST bulletin to drop an anvil on the heads of executive bobbleheads too cheap to pay a head IS employee. 

<excerpt Target Breach by the Numbers>

0 – The number of customer cards that Chip-and-PIN-enabled terminals would have been able to stop the bad guys from stealing had Target put the technology in place prior to the breach (without end-to-end encryption of card data, the card numbers and expiration dates can still be stolen and used in online transactions).

0 - The number of people in Chief Information Security Officer (CISO) or Chief Security Officer (CSO) jobs at Target (according to the AP).
pfretty
50%
50%
pfretty,
User Rank: Moderator
5/24/2014 | 8:34:19 AM
Not the answer
Government guidelines may help with some consistency, but that is not the answer.  Hack sophistication is on the rise as demonstrated in the HP Ponemon Cost of Cyber Crime report.  The only way to buck the trend is to increase awareness, invest in governance and get involved at a level beyond just the government and security division.  

Peter Fretty
JaCa
50%
50%
JaCa,
User Rank: Apprentice
5/19/2014 | 12:19:43 PM
http://bit.ly/1c0f35M
Interesting article. The threat from hackers are ever increasing and its good to learn that the government has made recommendations to put in place a security framework that will help reduce security breaches and data loss.I work for McGladrey and there's a whitepaper on our website that offers good information on the above topic that readers will find interesting @  http://bit.ly/1c0f35M
WKash
50%
50%
WKash,
User Rank: Author
5/15/2014 | 6:25:27 PM
Next niche
White House cybersecurity adviser Ari Schwartz is a straight shooter, but he does work for the White House, so when he shared that companies are rolling out products to help companies implement some of the NIST Cybersecurity Framework practices, I was a little skeptical -- until I got my first pitch this week from for big consulting company offering to interview their folks about their newest product/consulting offering: aimed at helping companies incorporate the NIST Cyber framework into their operations.  A new niche is born.

 
Cyber Security Standards for Major Infrastructure
Cyber Security Standards for Major Infrastructure
The Presidential Executive Order from February established a framework and clear set of security standards to be applied across critical infrastructure. Now the real work begins.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest - September 10, 2014
A high-scale relational database? NoSQL database? Hadoop? Event-processing technology? When it comes to big data, one size doesn't fit all. Here's how to decide.
Flash Poll
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
A look at the top stories from InformationWeek.com for the week of September 7, 2014.
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.