Firing up a security framework

Like anything in the cyber security arena, things have to move fast and just after the Obama Administration signed an Executive Order calling for stronger security movement to help protect critical infrastructure, the first step in the development of a Cybersecurity Framework is moving forward.

02/14/2013


ISS SourceLike anything in the cyber security arena, things have to move fast and just after the Obama Administration signed an Executive Order calling for stronger security movement to help protect critical infrastructure, the first step in the development of a Cybersecurity Framework is moving forward.

That first step involves creating a set of voluntary standards and best practices to guide industry in reducing cyber risks to the networks and computers vital to the nation’s economy, security and daily life.

President Obama called for the Cybersecurity Framework in his Improving Critical Infrastructure Cybersecurity Executive Order. In accordance with the Executive Order, the Secretary of Commerce directed the director of the National Institute of Standards and Technology (NIST) to lead the development of a framework to reduce cyber risks to critical infrastructure, such as power plants and financial, transportation and communications systems.

NIST will issue a Request for Information from critical infrastructure owners and operators, federal agencies, state, local, territorial and tribal governments, standards-setting organizations, other members of industry, consumers, solution providers and other stakeholders.

NIST will use the input to identify existing consensus standards, practices and procedures that are effective and can truly undergo adoption to protect its digital information and infrastructure from the full range of cyber security threats. The framework will not dictate “one-size-fits-all” solutions, but will instead enable innovation by providing guidance that is technology neutral and recognizes the different needs and challenges within and among critical infrastructure sectors.

“The Commerce Department has a critical role to play in helping American businesses address their cyber security issues and risks,” said Deputy Secretary of Commerce Rebecca Blank. “As we move forward with the Cybersecurity Framework, NIST will be collecting input from a wide variety of stakeholders to come up with an effective set of voluntary standards that will safeguard our nation’s most critical infrastructure from cyber security threats. Protecting our businesses and systems from attacks, while also ensuring that new voluntary standards allow the flexibility for innovation, is crucial to ensuring our economy can continue to grow.”

In the official Request for Information, which will be in the Federal Register, NIST will ask organizations to share their current risk management practices; use of frameworks, standards, guidelines and best practices; and other industry practices. NIST plans to hold workshops over the next several months to collect additional input and will complete the framework within one year.

“The process for developing the framework reflects a core component of NIST’s work, bringing together various stakeholders to address a technical challenge,” said Under Secretary of Commerce for Standards and Technology and NIST Director Patrick Gallagher. “By collaborating with industry to develop the framework, we will better protect our nation from the cybersecurity threat while enhancing America’s ability to innovate and compete in a global market.”

The RFI will request additional information on a number of core practices NIST views as applicable across industry, like:

  • Encryption and key management: With multiple encryption tools in use at any given organization, how does one protect, store and organize encryption keys?
  • Asset identification and management: How does an organization determine which assets need protection and their value?
  • Security engineering practices: How does an organization design its systems to meet security needs?

The framework will consist of a roadmap and structure for future efforts, including a recommended process for how the standards within each sector will undergo review by each stakeholder community. NIST will continue to revise and update the framework to meet changing business and security needs.



No comments
Consulting-Specifying Engineer's Product of the Year (POY) contest is the premier award for new products in the HVAC, fire, electrical, and...
Consulting-Specifying Engineer magazine is dedicated to encouraging and recognizing the most talented young individuals...
The MEP Giants program lists the top mechanical, electrical, plumbing, and fire protection engineering firms in the United States.
High-performance buildings; Building envelope and integration; Electrical, HVAC system integration; Smoke control systems; Using BAS for M&V
Pressure piping systems: Designing with ASME; Lab ventilation; Lighting controls; Reduce energy use with VFDs
Smoke control: Designing for proper ventilation; Smart Grid Standard 201P; Commissioning HVAC systems; Boilers and boiler systems
Case Study Database

Case Study Database

Get more exposure for your case study by uploading it to the Consulting-Specifying Engineer case study database, where end-users can identify relevant solutions and explore what the experts are doing to effectively implement a variety of technology and productivity related projects.

These case studies provide examples of how knowledgeable solution providers have used technology, processes and people to create effective and successful implementations in real-world situations. Case studies can be completed by filling out a simple online form where you can outline the project title, abstract, and full story in 1500 words or less; upload photos, videos and a logo.

Click here to visit the Case Study Database and upload your case study.

Protecting standby generators for mission critical facilities; Selecting energy-efficient transformers; Integrating power monitoring systems; Mitigating harmonics in electrical systems
Commissioning electrical systems in mission critical facilities; Anticipating the Smart Grid; Mitigating arc flash hazards in medium-voltage switchgear; Comparing generator sizing software
Integrating BAS, electrical systems; Electrical system flexibility; Hospital electrical distribution; Electrical system grounding
Cannon Design’s blog is a place for the many voices of the firm to share thoughts and news related to current projects...
As brand protection manager for Eaton’s Electrical Sector, Tom Grace oversees counterfeit awareness...
Amara Rozgus is chief editor and content manager of Consulting-Specifier Engineer magazine.
IEEE power industry experts bring their combined experience in the electrical power industry...
Michael Heinsdorf, P.E., LEED AP, CDT is an Engineering Specification Writer at ARCOM MasterSpec.