Sea change at NIST aims to ease agencies’ tech adoption
Connecting state and local government leaders
Recent modifications to IT standards confirm a changing approach to security, interoperability, and performance metrics by the National Institute of Standards and Technology.
When it comes to IT security, the last eight weeks have been a busy time for the National Institutes of Standards and Technology.
In this period, NIST has tinkered with, or proposed retiring, a variety of IT standards. It also has proposed new standards for how cloud services should be measured; worked to highlight new cryptographic standards while promising more transparency for that process; and set rules for mobile devices.
The impact of all of these adjustments has not yet sunk in for most federal IT managers, but the long term impact is sure to be felt in the years ahead. In total, the announcements reflect a series of changes and a shift in viewpoint that confirms NIST is taking a different approach to security and interoperability.
We can see this change by the way it’s moving from set-in-stone requirements toward continuous monitoring and is setting frameworks for app security that may vary, depending on the application. NIST SP 800-137, for example, provides 80 pages of concepts and specifications for ways the continuous monitoring can be implemented at federal agencies.
Additionally, NIST is recognizing that service level agreements and solution standardization are a key way to deal with cloud procurements.
Here's the broad picture.
Security. NIST has proposed withdrawing or retiring six Federal Information Processing Standards (FIPS) from its collection of standards that federal IT systems are expected to support.
This proposal reflects NIST's interest in rethinking access control and encryption for government networks. This is important at a time when information sharing is being encouraged and more cloud services are being plugged into government networks. Meanwhile, NIST and other government agencies are refining access control solutions that are attribute-based rather ones relying on passwords or other access-controls.
The changes also show deference to the fact that it can be hard for agencies to obtain waivers for mandatory FIPS compliance. Thus, when a FIPS rule becomes obsolete, it needs to be updated or retired.
The announcement also marks an informal end to the era of the so-called Skipjack algorithm and associated chip. Dating to the mid-1990s, Skipjack was championed by the NSA as a way to build an encryption standard into computers while allowing access for law enforcement agencies who might need to conduct legal surveillance. But after broad objections commercial vendors never warmed to the idea.
So if these FIPS standards are being retired, what's replacing them? Updated views of specific frameworks can be found at NIST research efforts dedicated to CyberSecurity Frameworks, Cryptographic Standards and Attribute Based Access Control Frameworks. Here are nutshell descriptions.
Mobile. For mobile security, NIST proposed some specific ideas in Vetting the Security of Mobile Applications, a document that could change the way agencies approach their review of application procurement. This publication is meant to help organizations understand what's involved when vetting the security of mobile applications. It also provides suggestions for developing sets of app security requirements and suggests ways to set up and implement an app vetting process. It also helps agencies understand the types of app vulnerabilities and testing methods used to detect those vulnerabilities.
Cloud. For cloud procurement, NIST has published a guide for establishing cloud metrics. This effort was launched because it can be difficult for agencies to compare service offerings from multiple cloud service providers as they don't offer the exact same services, measurements and service level agreements (SLAs). So NIST has worked to establish a definition of cloud computing as measured services that meet one of the essential characteristics of a cloud computing model.
The proposed metrics cover 30 pages, but they boil down what agencies should consider when comparing cloud offerings. They also provide a framework that vendors should consider if they want agencies to accurately consider the merits of what they offer in the cloud.
Cryptography. Finally, NIST said it plans to be transparent in its work with the National Security Agency. The institute has proposed some operating procedures via an updated draft titled NIST Cryptographic Standards and Guidelines. Public comments can be made through March 27.
In total, these NIST efforts show that the government is moving forward, pulling some rules off the table and creating new frameworks to accommodate how technology changes the way government agencies approach their IT solutions.
NEXT STORY: 5 ways to maintain a high-performance app stack