Tailoring Security Controls
The NIST Risk Management Framework (RMF) is a six step process as follows: The second step begins with selecting a baseline of controls. This is done automatically, according to the…
Supplementing Controls
After the baseline of security controls have gone through the tailoring process of: scoping guidance, compensating controls and organizationally defined parameters, it is possible that additional controls or enhancements may…
Categorization and Baseline Selection
Categorization is the process of selecting an Impact Level according to FIPS 199, which is a public law and must be adhered to. FIPS 199 sets three impact levels of…
Synthesizing Intelligence & Synthetically Designed Consciousness
Synthesizing Intelligence We are constantly getting better at designing software tools to help us navigate an ever growing ocean of information and negotiate methods of applying it wisely. We ask…
Computer Security Risk Assessment
Risk assessment is the process of analyzing threats to an information system and known vulnerabilities to determine the likelihood and impact of some anticipated loss. This risk analysis can then…
System Development Life Cycle (SDLC) Framework
The SDLC framework is a multi-step outline that describes the life cycle of an information system. The five phases of the SDLC are: Security that is integrated into this life…
Cloud Security Layers
Situational awareness is one of the most difficult things to get right in doing cloud security, and hand in hand with that goes inventory awareness. To understand why, take a…
Security Metrics for Clouds
A previous article here on general Security Metrics outlined some key security controls for measurement: NOTE: each of these security controls may have several or even many metrics that can…
Cloud Security as an Interconnection
Connecting your information system to a cloud is an interconnection. NIST guidance on handling the security of interconnections is documented in 800-47 Rev. 1 “Managing the Security of Information Exchanges”.…
Clouds Will Become APT Targets
Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications and services) that can be…