{"id":651,"date":"2017-11-03T14:07:16","date_gmt":"2017-11-03T14:07:16","guid":{"rendered":"https:\/\/securitycurve.com\/?p=651"},"modified":"2017-11-03T14:07:16","modified_gmt":"2017-11-03T14:07:16","slug":"building-cybersecurity-savvy-lawmakers","status":"publish","type":"post","link":"https:\/\/securitycurve.com\/?p=651","title":{"rendered":"Building cybersecurity savvy lawmakers"},"content":{"rendered":"

So this morning, I came across this article.<\/a>\u00a0It describes a call to action, given by\u00a0Sen. Sheldon Whitehouse (D-R.I) at the FCW (Federal Computing Week) “Big Issues Conference”, about the NIST Cybersecurity Framework (CSF).\u00a0 In general, it makes me feel better about the world that the sentiments in it are being expressed – and that this lawmaker considers it a “big issue”.\u00a0 I care about security.\u00a0 It’s refreshing that lawmakers do too.<\/p>\n

However, “caring about it,” while absolutely a fantastic starting point, is not – as a practical measure – good enough.\u00a0 The second step is doing something about it.\u00a0 And it’s here where I start to have criticisms.\u00a0\u00a0Before I get into this in detail, I want to STRESS HEAVILY that I’m not calling any of this out to slam any particular political point of view…\u00a0 I also honestly happen to think that this lawmaker is most likely coming from a good place. So let me start with reiterating “props to him” for caring about the topic generally — and further “attaboys” for paying attention more specifically to the CSF and, by extension, the regulatory and security considerations for civilian agencies.<\/p>\n

All that said, I do think there is “room to grow” in the specifics – and I level that criticism at all parties in this discussion.\u00a0 I think, if you unpack this discussion, it illustrates why it is incumbent on us, as an industry, to better inform lawmakers about security issues.<\/p>\n

Here’s what I mean.\u00a0 From the article:<\/p>\n

\u201cThe NIST Framework has never been adequately validated,\u201d Whitehouse said at FCW\u2019s Big Issues Conference on Nov. 1.<\/p>\n

Whitehouse said that he wonders whether agencies have accepted the NIST Framework because it\u2019s effective or because \u201ccompliance demands so little effort.\u201d Whitehouse said that the framework needs to be tested.<\/p>\n

One way to test the framework would be to assign a white hat hacking team to attempt to breach a system that\u2019s compliant with the framework.<\/p><\/blockquote>\n

There are two things going on here that I have criticisms about.\u00a0 The first is the use of “compliance” to describe the CSF.\u00a0 Yes, it is true that federal agencies have a regulatory obligation to use the CSF to manage cybersecurity risk (that’s per the May executive order<\/a>.)\u00a0 For reference, it says:\u00a0“Effective immediately, each agency head shall use The Framework for Improving Critical Infrastructure Cybersecurity (the Framework) developed by the National Institute of Standards and Technology, or any successor document, to manage the agency’s cybersecurity risk.”<\/em><\/p>\n

So the answer to why agencies accepted it?\u00a0 It’s because they are required to.<\/p>\n

However, there’s more going on here.\u00a0 These same agencies have also<\/span> been required to use the NIST Risk Management Framework (RMF) for nigh on the past decade (since 2010 to be precise about it.)\u00a0 The CSF and the RMF are not the same thing.\u00a0 If there’s a problem in the federal government – specifically civilian agencies – with risk management (spoiler alert: there is), the issue isn’t the CSF.\u00a0 It’s instead with compliance efforts more generally.\u00a0 Maybe it’s that the RMF describes a risk management model that is at a level of sophistication beyond what most organizations are ready to meet (“in spirit” anyway) without significant work and investment — work they can’t don’t have time\/staff to put in and investment they’re not getting.\u00a0 Or maybe it’s that risk management is difficult to get right and pretty much nobody is doing it well as it is.\u00a0 Or maybe it’s something else.\u00a0 But the core issue – and there absolutely is one – isn’t the fault of the CSF.<\/p>\n

Then there’s the question of “compliance” with it in the first place.\u00a0 If you read the CSF<\/a>, you’ll notice it’s not about compliance. Like not even a little bit.\u00a0 From the framework:<\/p>\n

Building from those standards, guidelines, and practices, the Framework provides a common taxonomy and mechanism for organizations to: 1) Describe their current cybersecurity posture; 2) Describe their target state for cybersecurity; 3) Identify and prioritize opportunities for improvement within the context of a continuous and repeatable process; 4) Assess progress toward the target state; 5) Communicate among internal and external stakeholders about cybersecurity risk. The Framework complements, and does not replace, an organization\u2019s risk management process and cybersecurity program<\/p><\/blockquote>\n

What exactly would “compliance” with that look like?\u00a0 That they use the common taxonomy?\u00a0 That they communicate or prioritize?\u00a0 The short version is that it’s hard to imagine because it’s not written in such a way that it’s about compliance<\/em> in the first place: it’s not intended to be (per feedback from the community at large) and, as an artifact, it isn’t written that way.\u00a0 SP800-53 is arguably about compliance.\u00a0 The RMF is (arguably in concept but for sure in terms of how it’s used) about compliance.\u00a0 The CSF?\u00a0 It’s about something else.\u00a0 The fact that we have made it be used the way it is belies a misunderstanding (I think) of what the document is for.\u00a0 A discussion about how best to use it that way is like me arguing with my neighbor about the best way to use a bottle of shampoo as a hedge trimmer.\u00a0 The whole conversation is flawed from the start.\u00a0 Should we choose to pursue the discussion to it’s logical conclusion, we might wind up with some compromise that lets you (with significant expenditure of effort) trim hedges, but wouldn’t asking a landscaper the right way to do it be a whole lot more productive?<\/p>\n

The second thing is the utility of drawing a line between a pentest and efficacy of the framework. If you want to do pentests of federal agencies, I’m all over that.\u00a0 However, what you’re testing, should you do so, isn’t the utility (or lack of it) of the CSF.\u00a0 There are two reasons for that.\u00a0 One is that you could find numerous examples of places that use it that have terrible security – and examples of places that don’t that have great security.\u00a0 The same is true of PCI – or HIPAA – or the ten commandments.\u00a0 When I was a QSA (PCI DSS assessor), we used to joke that “the difference between a compliant or non-compliant environment is how hard you look”.\u00a0 The same is true here.\u00a0 The second is that the measuring instrument proposed (pentesting) doesn’t measure what you want to test (risk management practices.)\u00a0 If you want to test patch management efficacy, application hardening practices, incident response capability, or any number of other things, a pentest could be a great way to do that.\u00a0 Risk management?\u00a0 Not so much.\u00a0 I will assume you know already why that is (since it would take me another thousand words to argue why this is true), so will allow it to stand on it’s own.\u00a0 But trust me, it’s not a great instrument for that.<\/p>\n

I could go on and pick at other things about the call to action, but I feel like I’ve made my point.\u00a0 The underlying current is that the executive branch and the legislative branch are having a detailed discussion about something that neither of them fully understands.\u00a0 Mandating the use of the CSF and RMF (simultaneously) for risk management isn’t addressing the root cause people are concerned about.\u00a0 Mandating the use of the CSF at all misunderstands what it is for.\u00a0 Setting up pentests to validate their utility also doesn’t solve for what’s wrong.<\/p>\n

How do you address these things?\u00a0 The first step is caring about the topic.\u00a0 We’re there.\u00a0 The second step is having an informed, no-bullshit discussion about it.\u00a0 We’re close to being “bullshit free” I think – or at least we’re farther along than we were.\u00a0 That’s good.\u00a0 Where we need work is on “informed”.\u00a0 We’re nowhere near “informed” yet.\u00a0 How do we get informed?\u00a0 We, as an industry, need subject matter representation at the table for these discussions.\u00a0 And I DO NOT mean more people who also don’t know anything about the topic — but yet say they are “experts” because of the Dunning-Kruger effect<\/a>.\u00a0 I mean people who really get it.\u00a0 I could list dozens of examples (Ron Ross, Ed Felten, Susan Landau, Gene Spafford) and I’m sure you could too.\u00a0 We as an industry need to put them forward — and politicians need to listen to them.<\/p>\n","protected":false},"excerpt":{"rendered":"

So this morning, I came across this article.\u00a0It describes a call to action, given by\u00a0Sen. Sheldon Whitehouse (D-R.I) at the FCW (Federal Computing Week) “Big Issues Conference”, about the NIST Cybersecurity Framework (CSF).\u00a0 In general, it makes me feel better about the world that the sentiments in it are being expressed – and that this […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[4],"tags":[29,84],"class_list":["post-651","post","type-post","status-publish","format-standard","hentry","category-security","tag-csf","tag-nist"],"_links":{"self":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/posts\/651","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=651"}],"version-history":[{"count":0,"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/posts\/651\/revisions"}],"wp:attachment":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=651"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=651"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=651"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}