Page 17 - Ron Ross News Today : Breaking News, Live Updates & Top Stories | Vimarsana

New guidelines from NIST on how to avoid cyberattacks from a nation-state defense (Getty Images) Feb 5, 2021 | FEDSCOOP The National Institute for Standards and Technology has some new advice for contractors that handle sensitive information desirable to adversarial nation-states. In a new special publication, NIST SP 800-172, the agency details how systems administrators should arrange networks and which security practices could provide additional protection from advanced persistent threats (APTs) — the industry term for hac...

By Justin Katz   While both public- and private-sector entities are still reeling from the consequences from the SolarWinds Orion hack, the National Institute of Standards and Technology this week published new tools to help organizations defend sensitive information against nation-state backed threats. The tools are mostly aimed at non-governmental entities responsible for housing sensitive, but unclassified government information. The security controls largely fall into one of three categories: structuring systems to be resistant against malicious actors, improving an organization's abilit...

Credit: Myimagine/Shutterstock Nations around the world are adding cyberwarfare to their arsenal, employing highly skilled teams to launch attacks against other countries. These adversaries are also called the “advanced persistent threat,” or APT, because they possess the tools and resources to pursue their objectives repeatedly over an extended period, adapting to defenders’ efforts to resist them.  Vulnerable data includes the sensitive but unclassified information managed by government, industry and academia in support of various federal programs. Now, a finalized publica...

Quick Hits *** The National Institute of Standards and Technology's Special Publication 800-53 is the bible of security and privacy controls for federal IT systems, so revisions are a big deal. Starting this summer, however, those updates will start coming far more frequently. NIST Fellow Ron Ross said at FCW's Jan. 27 Cloud Security Workshop that a "web-based, automated content control development and delivery system" is in the works, and will debut mid-year. "We're basically not going to wait five or six years to update 800-53," he said. "We're going to have an online development process ...

How the adversaries "live in the cracks"; The urgency to change defensive strategies and tactics; How to approach systems security engineering going forward. Ross specializes in information security, systems security engineering and risk management. He leads NIST's Federal Information Security Management Act Implementation Project, which includes the development of key security standards and guidelines for the federal government and critical information infrastructure. Ross also leads the Joint Task Force, an interagency partnership with the Department of Defense, Office of the Director Natio...