CISO

Enterprise Information Security

NIST guide for managing cloud security and privacy

by Leave a Comment

Cloud computing is gaining its popularity in an accelerated mode and many businesses and government entities are adopting cloud computing for supporting their business needs. NIST has recently released a a special publication on .Guidelines on Security and Privacy in Public Cloud Computing..

The SP 800-144 document covers the security requirements to be met by federal agencies opting for cloud computing. The key guidelines are based on the following:

  • Carefully plan the security and privacy aspects of cloud computing solutions before engaging them.
  • Understand the public cloud computing environment offered by the cloud provider.
  • Ensure that  a cloud computing solution satisfies  organizational security and privacy requirements. 
  • Ensure that the client-side computing environment meets organizational security and privacy requirements for cloud computing.
  • Maintain accountability over the privacy and security of data and applications implemented and deployed in public cloud computing environments.

There are 7 chapters, chapters from 2 to 6 are the key sections. These chapters cover topics such as:

  • Basics of cloud computing
  • Various models of public cloud computing
  • The benefits and drawbacks of public cloud computing from a security and privacy perspective
  • Key threats to the security and privacy of information in public cloud computing
  • Potential risk mitigation option in the cloud computing
  • Outsourcing data to public cloud computing

The publication also provides a detailed list of Federal Information Processing Standards and NIST special publications that provide materials particularly relevant to cloud computing and are recommended to be used in conjunction with SP 800-144.

The document can be downloaded from here (PDF).

NIST Guide for Conducting Risk Assessments

by Leave a Comment

NIST has updated the Guide for Conducting Risk Assessments (NIST Special Publication 800-30) to a great extent and the draft is publicly available for comments. The focus of this Guidance is on Risk Assessment as the risk management is covered by another guidance from NIST (SP 800-39).

In today.s world of complex and sophisticated threats, risk assessments are an essential tool for organizations to employ as part of a comprehensive risk management program. Risk assessments can help organizations:

  • Determine the most appropriate risk responses to on going cyber attacks or threats from manmade or natural disasters;
  • Guide investment strategies and decisions for the most effective cyber defences to help protect organizational operations (including missions, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and
  • Maintain on going situational awareness with regard to the security state of organizational information systems and the environments in which the systems operate.

though this Guidance is primarily for the federal information systems, it is highly useful for private organizations as well. The draft guidance is available here for download

NIST Updates Automated Computer Security Validation Guidelines

by Leave a Comment

The National Institute of Standards and Technology (NIST) has issued a draft publication for public comment that describes changes to the Security Content Automation Protocol (SCAP). SCAP is a suite of specifications that use the eXtensible Markup Language (XML) to standardize how software products exchange information about software flaws and security configurations.

SP 800-126 Revision 1, The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.1 can be found at http://csrc.nist.gov/publications/drafts/800-126-r1/draft-sp800-126r1.pdf. The public comment period runs through Jan. 23, 2010. Comments should be addressed to [email protected]

image from www.newswise.com