NIST issues draft update to cyber framework

The eagerly awaited update to the NIST Cybersecurity Framework is out in draft form — and it includes metrics and measurements.

Federal scientists at the government’s technology laboratory have issued a draft update to their widely adopted Cybersecurity Framework, adding for the first time a way of quantifying risk and security outcomes.

Other changes proposed Tuesday by the National Institutes of Standards and Technology include the addition of more detailed use cases and an agreed vocabulary on supply chain risk management; and the addition of identity management.

At the direction of an executive order from President Obama, NIST published version 1.0 of the framework back in February 2014 following consultations with industry, academia and government agencies.

They’ve been collecting feedback and suggestions for changes and enhancements almost ever since.

“We wrote this update to refine and enhance the original document and to make it easier to use,” said Matt Barrett, NIST’s program manager for the Cybersecurity Framework. “This update is fully compatible with the original framework,” and those currently using 1.0 should be able to implement the new version seamlessly.

Version 1.1 incorporates feedback including comments in response to NIST’s December 2015 Request for Information; questions frequently asked of NIST staff; and comments from 800 attendees at the April 2016 Cybersecurity Framework Workshop at the NIST campus in Gaithersburg, Maryland.

One area where businesses have asked for more detail is in regard to third-party or supply chain risk management. In a web post, NIST officials said the authors had developed a defined vocabulary so all parties to a supply chain or a business deal “can clearly understand cybersecurity needs.”

The framework, a high-level technical document, breaks cybersecurity down into five functions: identify, protect, detect, respond and recover. Each of those is further broken down into three to six categories — 23 in all — including things like “Risk Assessment,” “Awareness and Training” and “Response Planning.”

The draft adds “Supply Chain Risk Management” as a new category under the identify function; and renames “Access Control” as “Identity Management and Access Control,” to better reflect the real nature of the task.

The draft also clarifies and expands the definitions of some terms used in that category like “authentication” and “authorization.”

But it is the addition of a system for quantifying risk and security outcomes that is likely to prove most controversial — although officials stress it is a draft.

“In the update we introduce the notion of cybersecurity measurement to get the conversation started,” Barrett said. “Measurements will be critical to ensure that cybersecurity receives proper consideration in a larger enterprise risk management discussion.”

The draft is open for public comment until April 10.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure