NIST Updates Flagship SP 800-53 Security and Privacy Controls

guest · Mar 21, 2020

NIST Updates Flagship SP 800-53 Security and Privacy Controls
March 19, 2020
https://www.securityweek.com/nist-updates-flagship-sp-800-53-security-and-privacy-controls

The National Institute for Standards and Technology (NIST) has published the draft version of SP 800-53 (revision 5): Security and Privacy Controls for Information Systems and Organizations. This is the first update to SP 800-53 since revision 4 was published seven years ago, and reflects the major changes to the security landscape over the last few years.

The publication (PDF) provides a catalog of security and privacy controls (also called 'safeguards' by NIST) that will help protect organizational operations and assets.

"Our objective is to make the information systems we depend on more resistant to cyberattacks," explains NIST's Ron Ross, one of the publication's authors. "We want to limit the damage from those attacks when they occur, make the systems cyber-resilient, and at the same time protect the security and privacy of information."
Click to expand...

Post is pleased with the new supply chain controls. "The new control family on Supply Chain Risk Management," he told SecurityWeek, "recognizes how business is really done in the modern age." It is also how cybercrime is done in the modern age.

"Of particular interest with the latest revision is the new set of supply-chain controls," agrees Tom Kellermann, head cybersecurity strategist at VMware's Carbon Black business unit.
Morales is pleased with the new cyber resiliency 'state-of-practice' inclusion. "I'm a big fan of cyber resilience," he told SecurityWeek
Click to expand...

The document as published by NIST is described as the 'final public draft'. NIST is inviting and considering public comment until May 15, 2020.
Click to expand...

NIST Draft Special Publication (SP) 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations (Final Public Draft)

There is an urgent need to strengthen the trustworthiness and resilience of the information systems, component products, and services that we depend on in every critical infrastructure sector and which support the economic and national security interests of the United States.
Click to expand...

guest · Jun 20, 2020

New NIST Standards on IAST and RASP Deliver State-of-the-Art AppSec
Interactive Application Security Testing (IAST)
Runtime Application Self-Protection (RASP)
June 19, 2020
https://www.securitymagazine.com/ar...iast-and-rasp-deliver-state-of-the-art-appsec

The world is changing faster than ever before. Technology is the primary instigator, turning the dial up to hyper speed and catapulting businesses into rapid digital transformation in order to maintain a needed competitive edge.

Traditional application security (AppSec) approaches simply cannot keep pace with the speed of modern Agile and DevOps. Constant security scans slow release cycles and increase developer inefficiencies.
Overwhelming volumes of false positives consume valuable time, while false negatives create a false sense of security and ratchet up risks.
Click to expand...

NIST Standards Bolster Secure Digital Initiatives
In response to these issues, the National Institute of Standards and Technology (NIST) released a revision to Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-53 Revision 5. Those responsible for application security need to capitalize on two new standards that address interactive application security testing (IAST) and runtime application self-protection (RASP).
Click to expand...

Deploying IAST is easy and fast. Developers simply need to add the IAST agent to their application. The IAST solution automates the identification of vulnerabilities, which developers can fix as part of the process of writing code. There are no development disruptions for code scans. In addition, the alert noise—generated by false positives—of traditional security scanning tools is eliminated due to the instrumentation approach of IAST.

Like IAST, RASP also leverages security instrumentation and can even be combined in the same agent as IAST. RASP is also fast and easy to use, as opposed to perimeter defenses (web application firewalls). Security and development teams simply add the RASP agent to applications running in their production runtime environment. RASP then continuously monitors application inputs and confirms exploitability.

When a threat is detected, RASP prevents exploitation and takes other actions such as sending a warning message to the user, terminating a user’s session, terminating the application, or sending an alert to the SecOps team.
Click to expand...

guest · Sep 24, 2020

NIST Unveils Updated Guide to Privacy, Security Controls
September 24, 2020
https://www.bankinfosecurity.com/nist-unveils-updated-guide-to-privacy-security-controls-a-15057

The U.S. National Institute of Standards and Technology this week released a long-awaited guidance update, Special Publication 800-53 Revision 5, describing "next-generation security and privacy controls" and how to use them.
It's the first time since 2013 that NIST has updated the document, which addresses the cybersecurity risks faced by federal government agencies as well as organizations in the private sector and offers guidelines on mitigating risks, protecting data and stopping breaches.

"This publication provides a catalog of security and privacy controls for information systems and organizations to protect organizational operations and assets, individuals, other organizations and the nation from a diverse set of threats and risks, including hostile attacks, human errors, natural disasters, structural failures, foreign intelligence entities and privacy risks," according to the document.
Click to expand...

Critical Changes
By adopting these updated and enhanced controls, organizations can protect themselves from advanced persistent threats posed by hackers, the risks that come with collecting and storing personally identifiable information within IT networks and the vulnerabilities found in software and hardware, NIST says.
"The controls can be implemented within any organization or system that processes, stores or transmits information," according to the document.
Click to expand...

NIST Special Publication (SP) 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations

NIST blog entry: The Next Generation Security and Privacy Controls—Protecting the Nation’s Critical Assets

NIST SP 800-53, Revision 5 is not just a minor update but rather a complete renovation—addressing both structural issues and technical content. The update represents a multi-year effort to develop the first comprehensive catalog of security and privacy controls that can be used to manage risk for organizations of any sector and size, and all types of systems—from super computers to industrial control systems to Internet of Things (IoT) devices.

Exciting times ahead—we encourage you to take a look at the latest update to SP 800-53, use the content to build or improve your security, privacy, and supply chain risk management programs, and share your feedback to help us continuously improve the controls and supplemental materials.
Click to expand...

guest · Oct 31, 2020

NIST Finalizes SP 800-53B With Security Control Baselines
October 30, 2020
https://www.meritalk.com/articles/nist-finalizes-sp-800-53b-with-security-control-baselines/

The National Institute of Standards and Technology (NIST) released the finalized version of NIST Special Publication (SP) 800-53B on October 29, which updates the security baselines under SP 800-53’s Revision 5 process.

While the document is new, the guidance is familiar – NIST opted to break out its security control baselines and privacy baseline in a new document during the updates to SP 800-53. The low-impact, moderate-impact, and high-impact baselines remain the standards for security baselines, with additional guidance around tailoring controls to organizations.

“Whether you’re managing risk for a routine business system or one whose breach would compromise our nation’s critical infrastructure, we’ve got a baseline for you,” he added.
Click to expand...

The new SP 800-53B also includes a new privacy baseline, aimed at “addressing privacy requirements and managing privacy risks that arise from processing PII based on privacy program responsibilities under OMB Circular A-130,” according to a NIST news release.

“The publication of SP 800-53, Rev. 5 and SP 800-53B will have a cascading effect on other NIST publications as well as external programs that depend on the NIST controls and baselines,” tweeted Ross.
Click to expand...

NIST Special Publication (SP) 800-53B, Control Baselines for Information Systems and Organizations

NIST Offers ‘Quick-Start’ Guide for Its Security and Privacy Safeguards Catalog

Their creation, whose full title is Control Baselines for Information Systems and Organizations (NIST Special Publication (SP) 800-53B), is a companion publication to SP 800-53 Revision 5, which NIST updated last month after a multiyear effort. SP 800-53 offers a comprehensive set of security and privacy safeguards — referred to as controls — that address specific weaknesses in an organization or information system. It is used by organizations of all sizes, across public and private sectors.
The new companion guide can help them with selecting the baseline, or group of safeguards, that is appropriate for the risk level and threats the organization faces.
Click to expand...

Log in or Sign up

NIST Updates Flagship SP 800-53 Security and Privacy Controls

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

NIST Updates Flagship SP 800-53 Security and Privacy Controls

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches