Friday, June 15, 2018

NIST releases v1.1 of the Cybersecurity Framework

Hopefully by this point most are aware that NIST released after much work the updated version of the Cybersecurity Framework (CSF), now version 1.1.  This had been worked on over the last 2 years, was the topic of 2 workshops at NIST headquarters and produced 2 drafts.

It added one categories and 5-6 subcategories, and updated other items, like the information references.  They have also done a revamp of the website for the CSF, adding more resources there.  I do look forward to more informational references to be added, such as crosswalks to PCI-DSS, Standard of Good Practice, and others.

They have now announced that for 2018, instead of a workshop at NIST HQ, there will be a 3 day conference held in Baltimore in November.  Its now the "NIST Cybersecurity Risk Management Conference" and they have registration open along with a call for presentations.

I hope to attend the event, and based on what they are looking for from speakers, I think this will be a valuable conference.  As NIST is also working this year to update several documents related to FISMA, will be interesting how this affects this.  SP800-37 is scheduled to be released in October, and the final draft of SP800-53R5 is planned for October as well.

Wednesday, June 13, 2018

Report on HackMiamiCon6

HackMiami held its 6th Conference in 2018.  And this year we had another new location, tho it wasn't the organizers fault.  :)  The previous location suffered a fire, so this year they moved to Seacoast Suites.  This limited them a bit, as the rooms were not as spacious as with the Deauville.  And there were few food options within walking distance as with the Deauville. 

That aside, I thought overall they had another great conference.  This year they did an electronic badge, but this was a limited-run add-on, due to cost.

Two days, both kicked off with keynote addresses.  Both were good, and the second day we had Jack Daniel, who is kind of the father of BSides.  There were a good mix of talks and presentations, even a few longer workshops in the evening.  I spoke on the second day on cyber resilience/disaster recovery.  With the recent hit by Irma in Florida (and Maria in PR), I felt this was a good topic. I think it overall went well.

Congrats as always to the HM folks for putting on this conference.  Am surprised that they have already set the date and location for the 2019 conference, and will be back at the Deauville!  Registration is even open on their website!

Monday, June 11, 2018

Report on BSides Orlando 2018

Security BSides Orlando was back in 2018, the 6th year.  There were some issues this year.  They have been tied, scheduling-wise, to SANS in Orlando, but this year they had a weird schedule of April 3-10, which is Tuesday thru Tuesday, rather Sunday-Saturday like schedule.  So they went with April 7, right in the middle.

The other issue was location.  After several years at University of Central Florida, last year they were at Valencia College.  This year they were at Full Sail University's Live Venue location in Winter Park.  And, yes, another one day event.

The Full Sail location was interesting.  They added a lot of other activities to the schedule, which was nice, but I was sadden that this limited the number of actual talks, as this decreased the number of rooms available, so instead of having 4-5 talk tracks, there were only 2.  I had submitted several proposals, and none were picked.  So this was a personal disappointment for myself.

This year they did an electronic badge, which required participants to solder the items on the board.  They had a station setup to solder them, with people helping, which was great.  Probably needed to have a few more soldering irons, but still nice.  The blue badge was for participants, red was staff/volunteers.  Then they added a plastic hanger below to indicate speakers, sponsors, etc.

Here is a shot of the t-shirt and program book.

Overall a great event this year.  I look forward to next year's event.  SANS has set the date for SANS Orlando, so hopefully the BSides Orlando folks can set their date for next year's event.

Tuesday, March 20, 2018

Critical Security Controls v7 RELEASED

I have previously posted on the Critical Security Controls, which many still incorrectly called the "SANS Top 20" and the like, tho SANS hasn't been managing them for some time.  The current org that manages them is the Center for Internet Security, which has overseen them since around 2015.  They previously put out v6 and after about a year working on the have released v7.  You can download them from the CIS website, along with other materials.

I haven't had the chance to full look at v7 and take a look at the differences from v6.  There are still 20 "controls", but they've done some rearrangement and have made tweaks to the "subcontrols" by adding, spitting, merging, moving (from one control to another), rewording, or deleting some.

Monday, March 5, 2018

March Updates on Frameworks & Standards

Last month I posted some information on several information security framework/standards being updated and sense then there have been updated on all of them.  So here we go:
  • NIST CSF v1.1.  The second draft was released at the end of 2017, and we just wrapped up the comment period on this.  I believe the plans are to review and hopefully come out with the final release in a few months.  Not clear when.  They have also set a tentative date for the 2018 workshop as September 11-13 in "the DC area".  Now NIST headquarters is in Baltimore, so does that count as the "DC area"?  I should also point out that NIST has done a great job of revamping their NIST CSF website, with some more info.

  •  NIST SP 800-53 and 800-37.  NIST is also working on updated for a couple of important documents in FISMA/RMF.  SP 800-53 is the controls, and has now been expanded to include privacy controls as well as security. SP 800-37 defines the Risk Management Framework, and should also have info on how the RMF can work with the CSF.  As I had noted, the original plan was to come out with a second draft at the end of last year after they put out the discussion draft, but it slipped.  We were promised they they would re-asses and put out new dates, which they have: 
  • NIST Special Publication 800-37, Revision 2 (Risk Management Framework)
  • Initial Public Draft:  May 2018
  • Final Public Draft: July 2018
  • Final Publication:  October 2018
  • NIST Special Publication 800-53, Revision 5 (Security and Privacy Controls)
  • Final Public Draft:  October 2018
  • Final Publication:  December 2018
  • NIST Special Publication 800-53A, Revision 5 (Assessment Procedures for 800-53)
  • Initial Public Draft:  March 2019
  • Final Public Draft:  June 2019
  • Final Publication:  September 2019
  • FIPS Publication 200, Revision 1 (Minimum Security Requirements)
  • Initial Public Draft:  October 2018
  • Final Public Draft:  April 2019
  • Final Publication:  July 2019
  • FIPS Publication 199, Revision 1 (Security Categorization)
  • Initial Public Draft:  December 2018
  • Final Public Draft:  May 2019
  • Final Publication:  August 2019

  • CIS Critical Security Controls.  Better known as the "SANS Top 20", the Critical Security Controls are now managed by the Center for Internet Security.  The current version is 6.1 and they are working on a v7.  I had seen stuff on their site last year about this, but it disappeared, so I thought the effort was dead.  They put out a draft of v7 out with a short comment period.  And are rolling out v7 on March 19th in DC (or you can attend on-line).  So that is pretty quick
The only thing I am concerned is that both SP800-53 and the CSC are Informational References in the NIST CSF.  If they come out with new versions, will the Information References in the CSF be updated to these new versions?  I hope they will be.  Now NIST has on their new CSF website an on-line version of the Informational References that allows them to expand them.  Tho why they didn't include the HIPAA crosswalk here I don't know. Still awaiting the official PCI-CSF crosswalk to be made available as well.

As I learn more about these new updates, I'll be blogging about them.  I look forward to getting my hands on v7 of the CSC due to what I read in the draft version.

Wednesday, February 28, 2018

Report on BSides Tampa 2018

On Saturday, February 17th, I was in Tampa for the 5th Security BSides Tampa Conference.  This was my third time attending, and my third time speaking.  I spoke on the topic of the new "SOC for Cybersecurity" report.  I'll do a separate posting on this report, giving resources.

This conference had about 700 registered people there, not sure how many where there.  As with the prior couple of conferences, it was again held at the Stetson College of Law center in Tampa.

There were 5 tracks, a capture the flag game, lockpick village, training, and a recruitment track again.  Several great speakers.  Jack Daniel, Ira Winkler, Greg Hanis, and more.  I also had some good conversations with several people.

There were some problems last year, and I think they did a good job of addressing these.  My only personal complaint was it being on President's Day Weekend due to other commitments which I had to miss on.  Hopefully what ever date they pick next year won't conflict for me.

Monday, February 26, 2018

Report: The State of Cybersecurity in Florida

Just recently The Florida Center for Cybersecurity released their 2017 report, The State of Cybersecurity in Florida.

So what IS The Florida Center for Cybersecurity?  It's a statewide agency located at USF in Tampa that works with all State University System of Florida institutions, industry, the military, government, and the community to build Florida's cybersecurity workforce.

The report is the first they've done.  It looks at the cyber threat environment, workforce supply and demand, education and training opportunities, and research initiatives within the State of Florida.

In particular, here are some of its findings (and my comments):