NIST Reacts To FISMA Allegations
An article I wrote in CongressDaily on March 11 previewing a Senate Homeland Security and Governmental Affairs Federal Financial Management Subcommittee hearing about the Federal Information Security Management Act struck a nerve over at the National Institute of Standards and Technology -- big time.
In the story, Alan Paller, director of research at the SANS Institute, a nonprofit cybersecurity research group, blamed NIST for some of FISMA's failings. He said NIST's guidelines are too broad and he claimed that "the people at NIST, if they ever ran IT systems, it's been decades."
Since the piece was written on a tight deadline, I was unable to reach out to get a reaction from NIST at the time, so Ron Ross, leader of NIST's FISMA implementation project offered up some thoughts on Monday (per my suggestion). So, here goes...
The NIST team includes plenty of private and public sector expertise in development and testing of IT products and systems, and conducting simulated attacks on networks, he wrote. They also work closely with those who run NIST's own IT systems "to get feedback on the practicality of proposed safeguards and countermeasures."
"To complement this broad base of technical and management expertise, NIST employs a comprehensive public review process on every FISMA standard and guideline. In most cases, the FISMA security publications go through three full public vetting cycles," Ross wrote, noting that NIST also seeks input from security and IT professionals nationwide.
His bottom line: "The process employed by NIST to develop FISMA standards and guidelines does work. FISMA security publications are widely accepted and appreciated by federal IT managers and security professionals, and are in fact frequently adopted on a voluntary basis by many organizations in the private sector."
Categories:
Follow Up
Join the Discussion
The National Journal Group has the right (but not the obligation) to monitor the comments and to remove any materials it deems inappropriate.
Comments powered by Disqus