Department of Commerce Launches Collaborative Privacy Framework Effort | NIST
https://www.nist.gov/news-events/news/2018/09/department-commerce-launches-collaborative-privacy-framework-effort

#nist #privacy

Довольно интересный практический гайд по управлению ит-активами от NIST. Небольшой акцент на финансовые организации.
Стоит отметить попытку мапинга требований по управлению активами между nist 800-53, 27001, FFIEC CAT.
В разделе how-to даны подробные(!) инструкции как настроить сбор логов с помощью splunk с базовых источников информации об ит активах.

#NIST #IT_Asset_Management #splunk

https://www.nccoe.nist.gov/projects/use-cases/financial-services-sector/it-asset-management

По ссылке можно найти сам отчет 150 страничный отчет.
Фактически у Ниста получился экономический и исторический обзор использования криптографии в США, что можно попробовать использовать для Для обоснования применения криптографии в организации. Язык доступен не только для криптогиков.
#nist #encryption

https://csrc.nist.gov/publications/detail/white-paper/2018/09/07/economic-impacts-of-the-advanced-encryption-standard-1996-2017/final

Нист выпустил драфт стандарта по управлению кибербезопасностью интернета вещей.
Предложения принимаются до 24 октября.

#nist #IoT #cybersecurity

NIST Requests Public Comments on Draft NISTIR 8228

NIST has released Draft NIST Internal Report (NISTIR) 8228, Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks, an introductory document that will serve as the foundation for a planned series of publications on how to manage cybersecurity and privacy risks associated with IoT devices. The document is intended to aid both federal agencies and private organizations by identifying three high-level considerations for how IoT devices differ from conventional IT devices, as well as defining three accompanying goals for risk mitigation.

A public comment period for this draft document is open until October 24, 2018. See the Publication Details link (below) for the draft document and a template for providing comments.

CSRC Update:
https://csrc.nist.gov/news/2018/nist-releases-draft-nistir-8228-for-comment

Publication Details:
https://csrc.nist.gov/publications/detail/nistir/8228/draft

NICE 2018 Fall eNewsletter | NIST
Осенний информационный листок национальной инициативы США в области образования по кибербезопасности-NICE.

Стоит обратить внимание на
Интервью специалиста SOC. 4 разноплановых высших образования и суппорт 25 000 эндпоинтов.
#nice #soc #nist #education

https://www.nist.gov/itl/applied-cybersecurity/nice/nice-2018-fall-enewsletter#NICE Framework in Focus

Нист опубликовал драфт третей редакции глоссария по инфобезу. Предложения принимаюся до 30 ноября.
#nist #глоссарий

Glossary of Key Information Security Terms

NIST has created an easily accessible repository of terms and definitions extracted verbatim from NIST’s FIPS, Special Publications (SPs), and Internal or Interagency Reports (IRs), as well as from the Committee on National Security Systems Instruction 4009 (CNSSI-4009).

This repository—an online database whose methodology is described in Draft NIST Internal Report (NISTIR) 7298 Revision 3, Glossary of Key Information Security Terms—is intended to help users understand terminology, recognize when and where multiple definitions may exist, and identify a definition that they can use.

We encourage careful review of the online glossary database as well as the methodology described in the draft NISTIR. Specifically, we request feedback on any areas that may need changes to improve their accuracy and long-term usability.

A public comment period for this document—including the associated database and online glossary—is open until November 30, 2018.

Publication details:
https://csrc.nist.gov/publications/detail/nistir/7298/rev-3/draft

Online Glossary:
https://csrc.nist.gov/glossary

CSRC Update:
 https://csrc.nist.gov/News/2018/nist-releases-draft-nistir-7298-rev-3-for-comment

NIST announces the final public draft Special Publication 800-37, Revision 2, Risk Management Framework for Information Systems and Organizations--A System Life Cycle Approach for Security and Privacy.

There are seven major objectives for this update:

To provide closer linkage and communication between the risk management processes and activities at the C-suite or governance level of the organization and the individuals, processes, and activities at the system and operational level of the organization;To institutionalize critical risk management preparatory activities at all risk management levels to facilitate a more effective, efficient, and cost-effective execution of the RMF;To demonstrate how the NIST Cybersecurity Framework can be aligned with the RMF and implemented using established NIST risk management processes;To integrate privacy risk management processes into the RMF to better support the privacy protection needs for which privacy programs are responsible;To promote the development of trustworthy secure software and systems by aligning life cycle-based systems engineering processes in NIST Special Publication 800-160, Volume 1, with the relevant tasks in the RMF;To integrate security-related, supply chain risk management (SCRM) concepts into the RMF to address untrustworthy suppliers, insertion of counterfeits, tampering, unauthorized production, theft, insertion of malicious code, and poor manufacturing and development practices throughout the SDLC; andTo allow for an organization-generated control selection approach to complement the traditional baseline control selection approach and support the use of the consolidated control catalog in NIST Special Publication 800-53, Revision 5.

The addition of the Prepare step is one of the key changes to the RMF—incorporated to achieve more effective, efficient, and cost-effective security and privacy risk management processes.

In addition to seeking your comments on this final public draft, we are specifically seeking feedback on a new RMF Task P-13, Information Life Cycle. The life cycle describes the stages through which information passes, typically characterized as creation or collection, processing, dissemination, use, storage, and disposition, to include destruction and deletion. Identifying and understanding all stages of the information life cycle have significant implications for security and privacy. We are seeking comment on how organizations would executive this task and how we might provide the most helpful discussion to assist organizations in the execution.  

The public comment period for the draft publication is October 2 through October 31. Please submit comments using the comment template to sec-cert@nist.gov.

Links:

Publication Details (including Draft and Comment Template):
https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/draft

CSRC Updates:
https://csrc.nist.gov/news/2018/final-public-draft-sp-800-37-rev-2-for-comment

NIST Cybersecurity Framework:
https://www.nist.gov/cyberframework

NIST SP 800-160 Volume 1:
https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/final

NIST SP 800-53 Rev. 5 (Draft):
https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/draft
#nist #risk_management

Опубликован черновик стандарта nist по управлению привилегированным доступом для финансовых организаций.
#nist #pam #financial
Privileged Account Management | NCCoE
https://www.nccoe.nist.gov/projects/use-cases/privileged-account-management

Опубликована финальная версия стандарта nist по блокчейн.
#nist #Blockchain

NISTIR 8202, Blockchain Technology Overview | CSRC
https://csrc.nist.gov/publications/detail/nistir/8202/final#pubs-abstract-header

Вебинар nist по новому стандарту мультифакторной аутентификации для e-commerce.
#nist #e_commerce #authentication

Retail Sector October 2018 COI Webinar | NCCoE
https://www.nccoe.nist.gov/webform/retail-sector-october-2018-coi-webinar

Нист выпустил черновик Чеклиста безопасных настроек макос.
#nist #mac

NIST Releases Draft SP 800-179 Rev. 1 for Comment | CSRC
https://csrc.nist.gov/news/2018/nist-releases-draft-sp-800-179-rev-1-for-comment