top 10 myths - nist · 8/25/2014 · forum - august 2014 - top ten myths: q&a session...
TRANSCRIPT
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 1
Federal Computer Security Program Managers’ Forum
Top 10 Myths FISMA, RMF, 800-53, Continuous Monitoring, and Life
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 2
First, a quick refresher course.
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 3
Risk management 101.
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 4
Risk. Function (threat, vulnerability, impact, likelihood)
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 5
The unlikely threat.
Our three-year old adopted pit bull.
Cute. Lovable. Smart.
Hi. I’m Sophie. Welcome to the Forum!
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 6
The vulnerability.
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 7
The impact.
and the likelihood?.
100%
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 8
And a few family photos.
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 9
Our newest addition.
7-week old kitten rescued yesterday from a storm drain next to Starbucks...
Named him “Bucks”
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 10
Now on to business.
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 11
Myth #1 FISMA focuses more on compliance
than effective security. X
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 12
Myth #2 Organizations have to implement all security controls in NIST SP 800-53. X
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 13
Myth #3 NIST does not prioritize the security
controls in SP 800-53. X
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 14
Myth #4 FISMA is just a paperwork exercise. X
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 15
Myth #5 The new Cybersecurity Framework is
going to replace the RMF. X
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 16
Myth #6 Organizations can obtain FISMA certifications for their products,
systems, and services. X
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 17
Myth #7 FISMA requires organizations to assess
every security control annually. X
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 18
Myth #8 The DHS Continuous Diagnostics and
Mitigation Program is intended to replace the current CM efforts. X
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 19
Myth #9 Hiring more people with hacking
skills is the best way to improve your cybersecurity work force. X
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 20
Myth #10 Mitigating vulnerabilities is the best
way to ensure that your critical systems are resilient. X
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 21
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 22
Contact Information 100 Bureau Drive Mailstop 8930
Gaithersburg, MD USA 20899-8930
Project Leader Administrative Support Dr. Ron Ross Peggy Himes (301) 975-5390 (301) 975-2489
[email protected] [email protected]
LinkedIn http://www.linkedin.com/in/ronrossnist
Senior Information Security Researchers and Technical Support Pat Toth Kelley Dempsey (301) 975-5140 (301) 975-2827 [email protected] [email protected]
Web: csrc.nist.gov Comments: [email protected]