The enemy of risk management starts with a C (and it's not China)
Connecting state and local government leaders
Complexity is the enemy of security, says NIST's FISMA lead Ron Ross, and the cloud can help simplify networks.
Managing risk in a network requires knowing your assets and prioritizing defenses, says the National Institute of Standards and Technology’s Ron Ross. Complexity is the enemy, and moving to the cloud can help simplify.
“You can reduce the complexity of your infrastructure by 5 to 40 percent by moving to the public cloud,” said Ross. “Without reducing that complexity, we’re going to be doing what technicians call thrashing — a lot of activity with few results.”
Ross, who is NIST’s Federal Information Security Management Act implementation lead, made his comments in a discussion on risk management at last month’s RSA Conference in San Francisco. The potential security benefits of the cloud included not only off-loading assets and processes, but also the opportunity to automate the task of monitoring IT systems. Meeting requirements for continuous monitoring of government systems cannot be done manually, said John Streufert, director of network resilience at the Homeland Security Department.
“Use computers for what can be automated,” freeing up humans for those things that can’t, Streufert said.
With that in mind, DHS is planning to offer continuous monitoring for agencies as a vendor service. The offering is intended to improve automation, ensure consistency and take advantage of the economies of scale in a government-wide service hosted by a service provider.
DHS issued a request for quotes in December under its Continuous Diagnostics and Mitigation program, also known as Continuous Monitoring as a Service. It is seeking a blanket purchase agreement from a contractor under the General Services Administration’s Schedule 70, which includes a wide variety of IT products and services, including cloud services and security services. The BPA would have a base period of one year with four one-year options, with an expected value of $6 billion over all five years. It would include sensors for monitoring and a central dashboard for authorizing changes and fixes, as well as consulting services.
The agreement would include hardware and software asset management capabilities, configuration and vulnerability management, management of access controls and identity management, monitoring of user activity, as well as incident planning and response. Although it is intended for use primarily for civilian .gov networks, DHS also expects it also will be used by Defense Department networks in the .mil domain.
The cloud is not a panacea, the speakers warned. “Not all cloud providers are the same,” said Justin Somaini, former CISO at Yahoo and Symantec. The best provide good security, but it is up to the user to review security.
This task is eased somewhat by FedRAMP, the Federal Risk and Authorization Management Program, which provides governmentwide provisional authority for agencies to operate on cloud systems. FedRAMP ensures service providers have met baseline security controls for low, moderate and high impact systems, establishing a basic level of trust. But it still is up to the agency to ensure that the controls meet its needs and sign-off on operations.
Effective risk management means that agencies must decide what operations and functions can be safely moved to the cloud. This is a matter of comfort as well as technology, and Ross advised that agencies begin by moving low-impact activities that require the minimum level of security and consider other activities as they get more information about the process.