What Is NIST 800-172 and Advanced Security Structures

The ongoing rise of state-sponsored Advanced Persistent Threats (APTs) has increased scrutiny of federal and state IT systems security systems. The latest version of CMMC includes a high-maturity level specifically designed to address these threats, which relies primarily on advanced security controls listed in NIST Special Publication 800-172.   

CMMC, NIST 800-172, and Advanced Persistent Threats

As organizations move up the CMMC maturity model, they do so for one reason: to prepare themselves better to protect against Advanced Persistent Threats (APTs). These threats are a significant problem in the defense supply chain, and as such, CMMC leans heavily on NIST 800-171 and 800-172 to address them.  This article introduces how these… Read More

What Is the Open Security Controls Assessment Language (OSCAL)?

There’s recently been a push within FedRAMP towards modernizing the framework to meet modern security challenges and better align federal security standards across agencies and technologies.  Part of this push is standardizing how security controls are measured and assessed, and the most recent blog from FedRAMP mentions a new standard–OSCAL.  Here, we will discuss OSCAL,… Read More

What Are Digital Signatures and How Do They Work?

In traditional document management, we have several ways to authenticate the legitimacy of information–a signature, a watermark, etc. In digital spaces, we don’t readily have these tools to use. That fact, along with the reality that any piece of information can be copied ad infinitum, made authentication a challenge that security experts needed to solve. … Read More

Common Criteria and the National Information Assurance Partnership 

In the evolving world of international IT infrastructure and security, it’s critical that organizations and regulatory bodies have a standard to assess technology effectively. A key player in the United States that works to uphold these standards is the National Information Assurance Partnership (NIAP). NIAP manages the Common Criteria Evaluation and Validation Scheme (CCEVS) in… Read More

Common Criteria and NIST Evaluation

The Common Criteria, recognized worldwide, provides a standardized framework for evaluating the security attributes of IT products and systems. From defining security requirements to testing and verifying products against these requirements, the Common Criteria assure that the evaluation process is rigorous, repeatable, and thorough. To ensure the success of the program on a national basis,… Read More

NISTIR 8286 and Best Practices for Enterprise Risk Management

In an increasingly digital world, cybersecurity has never been more critical for organizations of all sizes and industries. As cyber threats become more sophisticated, the potential impact of a security breach on an organization’s operations, reputation, and financial well-being can be devastating. As a result, integrating cybersecurity risk management into more comprehensive Enterprise Risk Management… Read More

What Is NIST Special Publication 800-115 and What Does it Say About Penetration Testing?

As technology advances, the need for effective cybersecurity measures becomes increasingly important. The necessity for regular testing, including penetration testing, has raised awareness of best practices and standards for such assessments. The National Institute of Standards and Technology (NIST) has developed comprehensive guidelines and standards to help organizations safeguard their information systems from cyber threats.… Read More

What Are NIST Principles for Trustworthy Secure Design?

In today’s interconnected world, IT system trustworthiness has become an essential cornerstone for critical infrastructure’s seamless and secure functioning. As governments, enterprises, and industrial organizations rely on complex digital systems, the trustworthiness of these systems must be measured and maintained.  The need for trust in IT systems has been magnified by the rapid adoption of… Read More

What Is the NISTIR 8374 Ransomware Report?

Ransomware is one of the most significant security threats and perhaps one of the most recognizable threats in modern cybersecurity. These attacks cost businesses millions of dollars and can result in the loss of massive volumes of mission-critical information that supports business operations, national infrastructure, or government agencies. As part of the Cybersecurity Framework, the National… Read More

IRS 1075 and NIST | How Do NIST Guidelines Affect IRS 1075 Regulations?

The Internal Revenue Service is one of the largest and most essential federal government agencies… which means that there is a lot of opportunity for third-party contractors and managed service providers to offer products to support its mission. It also means that these contractors will be expected to adhere to security standards, specifically those outlined… Read More

Survival Guidance! FedRAMP and FISMA Resource for Assessing the Security Controls in Federal Information Systems and Organizations

Survival Guidance! MichaelPeters.org and LazarusAlliance.com is making our auditor’s resource for assessing the security controls in federal information systems and organizations free. This is a resource based on the NIST 800-53A framework you may freely use to conduct your organization’s FedRAMP, HIPAA or best practice based security audits. Your results are private and the output… Read More

HORSE WIKI: The Holistic Operational Readiness Security Evaluation wiki

Looking for the HORSE Project? Look no further! Welcome to the Holistic Operational Readiness Security Evaluation (HORSE) project Wiki. We would like to invite the information security community to participate in this open community project. The intention is ultimately to raise the proficiency level of information security auditors, security practitioners, lawyers and legal practitioners, financial… Read More

Risk Management CPM Model

I recently wrote an article about IT risk management and created several illustrations. One in particular stands by itself in terms of depicting a holistic view of the whole risk management life cycle in a critical path method model which I thought would be worth sharing. It would be useful to your ISO 27005 or… Read More

National Office for Cyberspace and H.R. 4900

A funny thing happened along the way while I was busy revising and adding content to the HORSE Wiki. My focus last week was primarily on Federal guidance such as NIST special publications and FISMA guidelines. Well apparently there are more folks tuned into that station it turns out when a very close government colleague… Read More