Tag Archives: NIST

Another hub in the cybersecurity Network

Former Washington Gov. Gary Locke is slated to be appointed Secretary of Commerce:

Experience in technology policy will also be important for the next commerce secretary, Cantwell said, since he will have to appoint the next director of the National Institute of Standards and Technology, oversee the U.S. Patent and Trademark Office, and provide leadership on issues like cybersecurity.

The National Institute of Standards and Technology (NIST) does important stuff — like set standards and prescriptions such as the new guide on maintaining data security while teleworking.  This riveting 46 page how to is written in “broad language in order to be helpful to any group that engages in telework. (see NIST release)”

In the executive summary you will find the important steps any individual should take before connecting at home or at the local cafe.

  • Before implementing any of the recommendations or suggestions in the guide, users should back up all data and verify the validity of the backups. Readers with little or no experience configuring personal computers, consumer devices, or home networks should seek assistance in applying the recommendations. Every telework device’s existing configuration and environment is unique, so changing its configuration could have unforeseen consequences, including loss of data and loss of device or application functionality.
  • Before teleworking, users should understand not only their organization’s policies and requirements, but also appropriate ways of protecting the organization’s information that they may access.
  • Teleworkers should ensure that all the devices on their wired and wireless home networks are properly secured, as well as the home networks themselves.
  • Teleworkers who use their own desktop or laptop PCs for telework should secure their operating systems and primary applications.
  • Teleworkers who use their own consumer devices for telework should secure them based on the security recommendations from the devices’ manufacturers.
  • Teleworkers should consider the security state of a third-party device before using it for telework.

Each of the steps are reasonable — but who will invest the resources required to make those steps effective?

Standards are being published and have been published for some time.  Yet, breaches continue to occur.  So, is the current status of policy and policy outcomes optimal or do we need to create another paradigm for cybersecurity?

Advertisements

Leave a comment

Filed under broadband, cybersecurity, electronic medical records, federal cyber security, Policy

New NIST Standards to protect PII

As you read the Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) (Draft, it looks more like the same ole’ policy : categorize, classify, protect the most important and pray for the rest!

PII should be graded by “PII confidentiality impact level,” the degree of potential harm that could result from the PII if it is inappropriately revealed. For example, an organization might require appropriate training for all individuals who are granted access to PII, with special emphasis on moderate- and high-impact PII, and might restrict access to high-impact PII from mobile devices, such as laptops and cellphones, which are generally at greater risk of compromise than non-portable devices, such as desktop computers at the organization’s headquarters.

Would be interesting to know how much these standards will cost to implement.

From NIST announcement

1 Comment

Filed under cybersecurity