OK, whoever named this product should be shot:  Ashampoo Magical Security.

However, as much as I love sprinkling on the Magic FISMA Fairy Dust, “Magical Security” is craziness.

I won’t go into too much detail on hackers, shampoo, washing, and South Pacific.  I have a feeling I’ll get plenty of comments to that effect.

• Stands Alone
• An Open Letter to the Next President of the United States
• Blog Statistics and Search Strings
• A Little Advice From Mike and Lee
• Got Training?

Well, this is a little bit of a departure from my usual random digital scribblings that I call a blog:  I partnered up with Vlad the Impaler and we created a slideshow complete with notes about why you should care about security and the Government and what you can learn from watching the Government succeed or fail.

The .pdf of the presentation is here.  Feel free to share with your friends, coworkers, and co-conspirators.

| View | Upload your own

• Archived for the World to See: SP 800-26
• The Accreditation Decision and the Authorizing Official
• When the Feds Come Calling
• Comments on SCAP 2008
• Massively Scaled Security Solutions for Massively Scaled IT

Rmogull of Securosis and Gunnar Peterson claim that GRC is dead.  In my typical global-brained style, I want to cut to the root cause of why GRC is stillborn.

As a group, we need to come to the concensus that half of the security industry is a bunch of spam-sending FUD-mongering dotcom dropouts with MBAs who see the “perfect storm” of money and opportunity that an uncertain-but-necessary niche market brings.  Furthermore, I say we distance ourselves from them because they make the rest of us look bad.

Failed parking meter by cgansen. 

These are the same people who pitched technical policy compliance solutions for SOX which became continuous compliance which begat risk management which begat GRC.  Do we really need all this cr*p?

Look at the warning signs of this half of the industry, these were so true for the dotcom era:

• New companies qnd products you’ve never heard of
• Staff nobody’s ever heard of
• “Trendy” product class that everybody wants to do this year
• Claim to have product purchased by a “Major Financial Institution”
• Is a rebranding of a previously-failing product
• Company was not security-focused last year
• Company and product life-span of ~2 years
• No alignment with other vendors or industry leaders
• Technology is “hoaky”–SIEM solutions using MS Access as the back-end
• Feels “gimmicky”

If you see any of these in a perspective vendor, run away now!  And if you do buy, don’t say I didn’t warn you.

Now, in a past life, SSG Rybolov would say something witty like how people who are used to preventing and detecting fraud should be able to come up with a model to keep people from invading the industry looking for the filthy lucre.  In fact, I think I just might have.  =)

The other half of you all, the non-snake-oil-selling half, is great, keep up the good work and never, ever go to the dark side.

• How to Not Let FISMA Become a Paperwork Exercise
• Engagement Economics and Security Assessments
• An Open Letter to the Next President of the United States
• When the News Breaks, We Fix it…
• “Machines Don’t Cause Risk, People Do!”

Dear <enter candidate’s name>,

Congratulations on your inauguration as the President of the United States. This is a huge accomplishment in your career.

I am writing this letter to tell you that you are inheriting a phenomenal opportunity to succeed where it comes to IT security in the Government. Your predecessors have buit a very viable framework for IT security in the US Federal Government. Arrayed around you are some of the brightest and the best people who have done extraordinary work in increasing the cyber security of the United States Government. The following people are included in their ranks:

• Ron Ross and Marianne Swanson and the rest of the staff in the NIST FISMA project who have labored long and hard to provide research, standards, and guidance not just to the Federal Government but to the nation and the rest of the world.
• Karen Evans and the rest of the staff at OMB who have set the policy that the executive branch has followed. They are not afraid to make decisions in the face of adversity.
• US-CERT and the Department of Homeland Security have made huge strides towards building a Government-wide monitoring system. Considering that they started “from scratch” 5 years ago, this is a non-trivial accomplishment.
• The people at DISA and NSA who have developed technical guidance before it was popular to do so–before FISMA, before PPD-63.

These and countless other people have “fought the good fight” in bringing IT security to the masses in such a scale that is unprecedented before in history.

But from where I, a humble servant of the public, stand, there are 2 things that you and your administration can do as a whole to increase our Government’s IT security.

#1 Please appoint an executive-branch Chief Information Officer (CIO) and a Chief Information Security Officer (CISO) with both the responsibility and the authority to secure the executive branch’s IT systems. The reason I ask for this is that the Federal Government’s IT infrastructure is a federation of individual business units that are managed separately for risk. At each level of Government, there is an IT manager and a security person to support them–all the way up the chain of command–except for at the top where there is a void wanting to be filled.

As has often been said, the answer to bureaucracy is not to throw more bureaucracy at it, and so creating new positions is not something to do lightly. What our nation needs is a pair of true technology managers at the executive branch level who can adequately manage risk instead of compliance.  This is a tremendous need for the executive branch: OMB is focused on compliance and fiscal responsibility and compliance, NIST is focused on research and developer outreach, US-CERT is focused on highly tactical IT security operations, and no one entity controls the strategic security direction of the nation.

#2 Please learn how to use the economic might of the Federal Government to allow the market to determine winners in the security space. What I mean by this is that the Government has for too long put up with inferior IT products and services because we do not present a unified front to the vendors.

Our Federal IT budget for this year is ~$75B and this is a huge force to bear on the market. This means that the Government is in a prime position to get whatever they ask for from the technology industry, all you have to do is use your fiscal power in a coordinated manner.

Once again, congratulations on the new job.

Cheers

–Rybolov

White House with a Tilt Shift by Michael Baird

• It’s a Problem of Scale!
• No, FISMA Doesn’t Require That, Silly Product Pushers
• William Jackson on FISMA: It Works, Maybe
• GAO’s 5 Steps to “Fix” FISMA
• Some Comments on SP 800-39

Interestingly, Splunk has been going after FISMA dollars here lately.  check out the Forbes article, video on YouTube, and their own articles.  I guess there’s another “pig at the trough” (heh, including myself from time to time).

It’s interesting how companies decide to play in the Government market.  It seems like they fall into 2 categories:  companies that have grown to the point where they can sustain the long-term investment with a chance of payoff in 5 years, and companies that are desparate and want a spot at the trough.

To its credit, Splunk seems to be one of the former and not the latter, unlike the hordes of “Continuous Compliance” tools I’ve seen in the past year.

Which brings up the one big elephant in the room that nobody will talk about:  who is making money on FISMA?

This is my quick rundown on where the money is at:

• Large Security Services Firms:  Definitely.  About a quarter of that is document-munging and other jack*ssery that is wasteful, but a good 3/4 of the services are needed and well-received.  Survival tip:  combining FISMA services with other advisory/assessment services.
• Software and Product Vendors:  Yes and no.  Depends on how well they can make that crucial step of doing traceability from their product to the catalog of controls or have a product that’s so compelling that the Government can’t say no (A-V).  Survival tip:  Partner with the large integrator firms.
• Managed Security Service Providers:  Yes, for the time being,  but look at their market getting eaten from the top as US-CERT gets more systems monitored under Einstein and from the bottom as agencies stand up their own capabilities.  Survival tip: US-Cert affiliation and watch your funding trail, when it starts to dry up, you had better be diversified.
• System Integrators:  It’s split.  One half of them take a loss on FISMA-related issues because they get caught in a Do What I Mean with a “Contractor must comply with FISMA and all NIST Guidance” clause.  The other half know how to either scope FISMA into their proposals or they have enough good program management skills to protest changes in scope/cost.  Survival tip:  Have a Government-specific CSO/CISO who understands shared controls and how to negotiate with their SES counterparts.
• 8(a) and Security Boutique Firms:  Yes, depending on how well they can absorb overhead while they look for work.  Survival tip:  being registered as a disadvantaged/woman-owned/minority-owned/foo-owned business means that the big firms have to hire you because their contracts have to contain a certain percentage of small firms.
• Security Training Providers:  Yes.  These guys always win when there’s a demand.  That’s why SANS, ISC2, and a host of hundreds are all located around the beltway.  Survival tip:  trying to absorb government representation in training events and as speakers.

• NIST’S FISMA Pase II–Who Certifies Those who Certify the Certifiers?
• Security Assessment Economics
• More on Georgia’s FISMA Reporting
• Imagine that, System Integrators Doing Security Jointly with DoD
• Introducing the Government’s Great InfoSec Equities Issue