✏️ RFC NIST :: Draft Cybersecurity Practice Guide SP 1800-14, Protecting the Integrity of Internet Routing: Border Gateway Protocol (BGP) Route Origin Validation, is Available for Comment

"It is difficult to overstate the importance of the internet to modern business and society in general. The internet is not a single network, but rather a complex grid of independent interconnected networks that relies on a protocol known as Border Gateway Protocol (BGP) to route traffic to its intended destination.

Unfortunately, BGP was not designed with security in mind and a route hijack attack can deny access to internet services, misdeliver traffic to malicious endpoints, and cause routing instability. A technique known as BPG route origin validation (ROV) is designed to protect against route hijacking.

"NIST’s National Cybersecurity Center of Excellence (NCCoE), together with several technology vendors, has developed proof-of-concept demonstrations of BGP ROV implementation designed to improve the security of the internet's routing infrastructure. 

"Comments for this draft are due by October 15, 2018. To review Draft Special Publication (SP) 1800-14, and for information on submitting comments, please visit the links below.

CSRC Update: https://csrc.nist.gov/news/2018/nist-requests-comments-on-draft-sp-1800-14  
Publication details: https://csrc.nist.gov/publications/detail/sp/1800-14/draft  
Project Homepage: https://www.nccoe.nist.gov/projects/building-blocks/secure-inter-domain-routing 

📽 NIST Cybersecurity Framework and the FTC

📽 Mirai Inside of an IoT Botnet :: NANOG 69

📽 The Internet of Broken Things: the Future Challenges of Global Cybersecurity

:: RFC Guide to Cyber Threat Information Sharing

DRAFT Guide to Cyber Threat Information Sharing (Second Draft)

NIST requests comments on the second draft of Special Publication (SP) 800-150, Guide to Cyber Threat Information Sharing. This draft provides guidelines for establishing, participating in, and maintaining cyber threat information sharing relationships. The publication describes the benefits and challenges of sharing, the importance of building trust, the handling of sensitive information, and the automated exchange of cyber threat information. The goal of the publication is to provide guidelines that help improve cybersecurity operations and risk management activities through safe and effective information sharing practices. The guide is intended for computer security incident response teams (CSIRTs), system and network administrators, security staff, privacy officers, technical support staff, chief information security officers (CISOs), chief information officers (CIOs), computer security program managers, and other stakeholders in cyber threat information sharing activities. 

The public comment period for the publication closes on May 24rd, 2016.
Email comments to sp800-150comments@nist.gov .

Second Draft SP 800-150 (762 KB)
Comment Template Form - Second Draft SP 800-150
Apr. 21, 2016 SP 800-150

:: Influence the Future of Cybersecurity Education—Join the NICE Working Group

"Addressing the nation’s rapidly increasing need for cybersecurity employees, the National Initiative for Cybersecurity Education (NICE) is seeking members from the public and private sectors and academia to join its new working group and encourages interested individuals to participate in a kickoff teleconference the afternoon of January 27, 2016.

"NICE, which is led by the National Institute of Standards and Technology (NIST), is a public-private partnership that promotes a robust network of cybersecurity education, training and workforce development to meet the nation’s demand for skilled cybersecurity employees to protect information systems. The number of job openings in the field greatly exceeds the number of trained workers. The NICE Working Group will collaborate to develop concepts, design strategies and pursue actions to advance cybersecurity education, including sharing existing education initiatives and identifying new ones.
The working group has chairs representing academia, private industry and government, and will have six subgroups:

• Collegiate,
• Competitions,
• Workforce Framework,
• Training and Certifications,
• Career Development and Workforce Planning, and
• Kindergarten through 12th Grade.

The kickoff teleconference is Wednesday, January 27, from 3:30 to 5 p.m. ET. NICE program leaders will discuss group goals, member roles and responsibilities, meeting schedules and deadlines. The meetings are planned for the fourth Wednesday of each month.

For more information on the public working group, visit the working group page. For call-in numbers for the teleconference, email nice.nist@nist.gov. http://www.nist.gov/itl/acd/influence-the-future-of-cybersecurity-education-join-nice-working-group.cfm

:: FCC and CU Boulder Public Safety Cybersecurity Summit

FCC and University of Colorado, Boulder Interdisciplinary Telecommunications Program to co-sponsor summit exploring cybersecurity issues for communications and public safety sectors

On December 7, 2015, the Federal Communications Commission and the Regents of the University of Colorado, a body corporate, contracting on behalf of the CU Boulder Interdisciplinary Telecommunications Program will co-host a summit to explore cybersecurity issues facing the telecommunications sector and the public safety community.  The summit will seek to promote ways to develop, implement and measure best practices, enhance c-suite and agency senior level awareness, and evolve policy planning related to cybersecurity recommendations for the telecommunications sector, public safety sector, research and development, and workforce planning/talent management.  This day-long public forum would allow exchange of ideas, as well as allow extended interaction with critical industry, academic and government personnel involved in securing our commercial networks, evolving the next generation of public safety networks, and planning for the future of these critical communications assets. 

WHAT:            FCC-CU Boulder ITP Public Safety Cybersecurity Summit

The event will feature industry, public safety, academic and government thought leaders in the field of cybersecurity in a series of moderated panels, considering technical, practical, and policy issues related to the cybersecurity threats facing our commercial and public safety networks.

A summit agenda, providing additional details about the event will be released at a later date.     

WHEN:            Monday, December 7, 2015, 9:00 AM, DLC Bechtel Collaboratory, College of Engineering and Applied Science, University of Colorado, Boulder, Colorado

WHO:              Security researchers, policymakers, industry leaders, cybersecurity organizations, investors, public safety organizations, state, local and Tribal government officials, academic institutions and others interested in understanding the current and evolving cybersecurity landscape in these sectors.  Space is limited for this event.  Please e-mail cybersummit@fcc.gov with “Registration” in the subject line and provide your name, organization affiliation and contact information.

Released:  10/27/2015.  FCC AND CU BOULDER TO HOLD PUBLIC SAFETY CYBERSECURITY SUMMIT. (DA No.  15-1224).  PSHSB . Contact:  Erika Olsen at (202) 418-2868, email: Erika.Olsen@fcc.govor ITP Corporate Outreach:Terese Manley at (303) 492-3824, email: Terese.Manley@colorado.edu. News Media Contact: Rochelle Cohen at (202) 418-1162, email: Rochelle.Cohen@fcc.govhttps://apps.fcc.gov/edocs_public/attachmatch/DA-15-1224A1.docx
https://apps.fcc.gov/edocs_public/attachmatch/DA-15-1224A1.pdf

:: NTIA Multistakeholder Process: Cybersecurity Vulnerabilities

Multistakeholder Process: Cybersecurity Vulnerabilities

Date: August 28, 2015

"This web page provides details on the NTIA-convened multistakeholder process concerning collaboration between security researchers and software and system developers and owners to address security vulnerability disclosure.

"The first meeting will be on September 29, 2015 at the University of California, Berkeley, School of Law.  This meeting will be open to all interested parties. The meeting will be webcast, and NTIA will provide a dial-in conference bridge.  Pleasepre-register here to help NTIA plan logistics. Pre-registration is not required, but will assist NTIA in planning, and in determining space and webcast technology requirements.

Background:

"On March 19, 2015, the National Telecommunications and Information Administration, working with the Department of Commerce’s Internet Policy Task Force (IPTF), issued a Request for Comment to “identify substantive cybersecurity issues that affect the digital ecosystem and digital economic growth where broad consensus, coordinated action, and the development of best practices could substantially improve security for organizations and consumers.” Individuals and entities from across the commercial, academic, and civil society sectors filed comments. After reviewing these comments, NTIA announced that the first topic to be addressed would be collaboration on vulnerability research disclosure.

"The goal of this process will be to develop a broad, shared understanding of the overlapping interests between security researchers and the vendors and owners of products discovered to be vulnerable, and to establish a consensus about voluntary principles to promote better collaboration.  The question of how vulnerabilities can and should be disclosed will be a critical part of the discussion, as will how vendors receive and respond to this information. However, disclosure is only one aspect of successful collaboration.

Upcoming meetings:

September 29, 2015

Booth Auditorium at the University of California, Berkeley, School of Law, Boalt Hall, Bancroft Way and Piedmont Avenue, Berkeley, CA.
9am-3pm PDT
Dial-in information: to be announced.

:: NIST Cyber Supply Chain Risk Management Workshop, October 1-2, 2015

NIST Invites Industry to Cyber Supply Chain Risk Management Workshop, October 1-2, 2015

From NIST Tech Beat: September 1, 2015Contact: Evelyn Brown 

301-975-5661

"The National Institute of Standards and Technology (NIST) will host a workshop on industry best practices in cyber supply chain risk management at its Gaithersburg, Md., campus, October 1-2, 2015.

Credit: ©freshidea-Fotolia_com View hi-resolution image

"The two-day event will feature panels of industry professionals. Topics will include how cyber supply chain risk can affect organizations, proven strategies for managing those risks, existing standards and best practices, and practical guidance for enterprise risk governance.

"The Cyber Supply Chain Risk Management workshop is designed for a broad audience, including senior executives and those involved in enterprise risk management, supply chain management, acquisition or cybersecurity.

The goals of the workshop are to:

• share current research findings,
• validate the current findings and receive additional input from stakeholders, and
• gather input to inform future versions of the Framework for Improving Critical Infrastructure Cybersecurity and other cybersecurity and supply chain risk management initiatives.

NIST developed the framework, commonly referred to as the Cybersecurity Framework, as directed in Executive Order 13636 to assist critical infrastructure organizations to better manage and reduce their cybersecurity risks. NIST also released a companion document, Roadmap for Improving Critical Infrastructure Cybersecurity, which identifies supply chain risk management as a key focus area.

NIST has a Supply Chain Risk Management Program focused on securing the information and communications technology supply chain.

Registration information and the agenda are available here.

NIST Hosts 2015 Cybersecurity Innovation Forum, Sept. 9-11 in D.C.

From NIST Tech Beat: August 17, 2015

Contact: Evelyn Brown 
301-975-5661

"The National Institute of Standards and Technology (NIST) will host the 2015 Cybersecurity Innovation Forum on Sept. 9 to 11, 2015, at the Walter E. Washington Convention Center in Washington, D.C.

Credit: © ra2 studio/Fotolia.com

"At this annual meeting, government, industry and university representatives come together to focus on current, emerging and future challenges in areas such as trusted computing, security automation and information sharing. Leading cybersecurity researchers and executives from the cybersecurity industry will participate in the event.

"The forum’s four tracks—security automation, trusted computing, information sharing and cybersecurity research—will be interspersed with general sessions. Session topics include federal research and privacy, risk management and liability. The event will conclude with a review of the challenges and gaps discussed during the forum and next steps in collaborative efforts to resolve them.

"Presentations will cover Windows 10 security, cryptography, derived PIV credentials proof of concept, public safety cybersecurity, security and the Internet of Things, the NIST Privacy Risk Management Framework and augmenting Federal Information Security Management Act (FISMA) practices with the Cybersecurity Framework.

"The forum also will feature demonstrations and an industry expo on Sept. 9 and 10.

"The agenda is available online. Register for the 2015 Cybersecurity Innovation Forum at: https://www.fbcinc.com/e/cif/attendeereg.aspx.

RFC :: Interagency Report Advocates Support for International Cybersecurity Standardization

"NIST seeks public comments on Draft NIST Interagency Report (NISTIR) 8074, which comprises two volumes, "Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objectives for Cybersecurity" (Vol. 1) and "Supplemental Information" (Vol. 2).

"Please send comments to nistir8074@nist.gov (Subject: “Comments on Draft NISTIR 8074”). The public comment period closes September 24, 2015. Those responding are encouraged to use the Comments Templates provided below.

Volume 1: Report
Comment Template for Volume 1
Volume 2: Supplemental Information for the Report
Comment Template for Volume 2


Interagency Report Advocates Support for International Cybersecurity Standardization From NIST Tech Beat: August 11, 2015

"A new draft report by an interagency working group lays out objectives and recommendations for enhancing the U.S. government's coordination and participation in the development and use of international standards for cybersecurity. The report recommends the government make greater effort to coordinate the participation of its employees in international cybersecurity standards development to promote the cybersecurity and resiliency of U.S. information and communications systems and supporting infrastructures. These efforts should include increased training, collaborating with private industry and working to minimize risks to privacy.

Credit: Norebbo/Shutterstock

"The Cybersecurity Enhancement Act of 2014 directed the National Institute of Standards and Technology (NIST) to work with relevant federal agencies to ensure interagency coordination in "the development of international technical standards related to information system security" and to "ensure consultation with appropriate private sector stakeholders." It also called for NIST to within one year submit a plan to Congress for ensuring that coordination. The International Cybersecurity Standards Working Group, led by the Department of Commerce and NIST, was set up by the National Security Council's Cyber Interagency Policy Committee to draft this report, which will also serve as the basis of the required report to Congress. Public comments on the draft report are due by September 24, 2015.
The draft report outlines four U.S. government strategic objectives for the development and use of international standards for cybersecurity:

• Enhancing national and economic security and public safety
• Ensuring standards and assessment tools for the U.S. government are technically sound
• Facilitating international trade
• Promoting innovation and competitiveness

The draft report then lays out eight recommendations for how the federal government can achieve those objectives, including by ensuring coordination across the government and collaboration with the private sector and internationally, and promoting federal agency participation in international standards development and federal use of international standards and assessment schemes.
The U.S. standards system differs significantly from the government-driven, centrally coordinated systems common in many other countries. Under the U.S. system, hundreds of standards development organizations (SDOs) provide the infrastructure for the preparation of standards documents. While these organizations are overwhelmingly private sector, government personnel participate in standards development activities along with representatives from industry, academia, and other organizations and consumers.
A supplement to the draft report provides a summary of ongoing activities in critical international cybersecurity standardization and an inventory of U.S. government and private-sector engagement. It also provides guidance for agencies to plan and coordinate more effective participation in these activities.
The working group's draft report supports the 2010 United States Standards Strategy, which was developed through a public-private partnership and outlines the contribution of private-sector led standards development to overall competition and innovation in the U.S. economy and the imperative of public and private-sector participation and collaboration.
The full Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objectives for Cybersecurity [NISTIR 8074 Volume 1 (Draft)] and supplement [NISTIR 8074 Volume 2 (Draft)] can be found on the NIST website.

RFC :: NIST :: Draft Outline of Cybersecurity Framework for Critical Infrastructure :: Commets Due July 10th

NIST has released a draft outline of the Cybersecurity Framework in preparation for the upcoming July 10th Cybersecurity Framework Workshop in San Diego.  Comments are requested on or before the workshop.

NIST Tech Beat July 2, 2013: As part of its efforts to develop a voluntary framework to improve cybersecurity in the nation's critical infrastructure, the National Institute of Standards and Technology (NIST) has posted a draft outline of the document to invite public review and gather comments.

The Executive Order calling for NIST to develop the framework directs the agency to collaborate with the public and private sectors. The draft outline reflects input received in response to a February 2013 Request for Information, discussions at two workshops and other forms of stakeholder engagement.

The outline proposes a core structure for the framework and includes a user's guide and an executive overview that describes the purpose, need and application of the framework in business. Reflecting received comments that emphasized the importance of executive involvement in managing cyber risks, the framework is designed to help business leaders evaluate how prepared their organizations are to deal with cyber threats and their impacts.

"We are pleased that many private-sector organizations have put significant time and resources into the framework development process," said Adam Sedgewick, senior information technology policy advisor at NIST. "We believe that both large and small organizations will be able use the final framework to reduce cyber risks to critical infrastructure by aligning and integrating cybersecurity-related policies and plans, functions and investments into their overall risk management."

NIST also released a draft compendium of informative references composed of existing standards, practices and guidelines to reduce cyber risks to critical infrastructure industries. This material was released to foster discussion at upcoming workshops and to further encourage private-sector input before NIST publishes the official draft Cybersecurity Framework for public comment in October 2013.

Interested parties are invited to review the draft framework outline and offer comments before and during the next workshop, July 10-12, 2013, in San Diego. Direct comments should be forwarded to cyberframework@nist.gov. The draft outline and other documents related to the Cybersecurity Framework are available at http://www.nist.gov/itl/cyberframework.cfm.

[RFC] FCC Commences Inquiry On Survivability Of America’s Broadband Infrastructure

News Release: "The Federal Communications Commission (FCC) today launched an inquiry on the ability of existing broadband networks to withstand significant damage or severe overloads as a result of natural disasters, terrorist attacks, pandemics or other major public emergencies, as recommended in the National Broadband Plan.

"As Americans increasingly rely on broadband services for so many aspects of their lives, including public safety and national security, it is critical for the FCC to gain a better understanding of the survivability of existing networks and explore potential measures to reduce network vulnerability to failures in network equipment or severe overload conditions in emergencies.

"Although core broadband networks are generally presumed to be quite resilient, there may be weaknesses closer to the network edge. Accordingly, today’s Notice of Inquiry (NOI) seeks comment, analysis and information on the present state of the resiliency and redundancy of broadband networks to withstand physical damage and severe network overload. This is a vitally important first step in ensuring that the FCC can take all necessary actions to ensure ongoing broadband communications in times of disaster or crisis.

"The NOI includes the following questions related to the resiliency of broadband networks:

• What are the major single points of failure in broadband architectures?
• What measures do communications providers already take to minimize the potential for single points of failure?
• What provisions are made by communications providers to ensure the survivability of cell sites relied on by first responders?
• What are the most effective and widely deployed physical security best practices?
• Should traffic to and from critical emergency response agencies and for critical services be prioritized on the networks during emergencies?
• What steps have been taken to ensure redundancy and diversity of physical network links to hardware?
• Is the capacity of residential access networks sufficient to handle sudden surges or overloads in traffic during, for example, a pandemic emergency?
• What network management practices are in place to handle overloads during emergencies?

"The FCC looks forward to reviewing the record and exploring how best to further improve and secure America’s broadband infrastructure into the future. The deadline for comments on the issues presented by the NOI will be 45 days and reply comments 75 days after publication in the Federal Register.

Action by the Commission, April 21, 2010, by Notice of Inquiry (FCC 10-62). Chairman Genachowski, and Commissioners Copps, McDowell, Clyburn and Baker. Separate Statements issued by Chairman Genachowski, and Commissioners Copps, McDowell, Clyburn and Baker. PS Docket No. 10-92.

Public Safety and Homeland Security Bureau (PSHSB) contact is Jeff Goldthorp, Chief of the Communications Systems Analysis Division, at (202) 418-1096.

4/21/10 FCC Commences Inquiry on Survivability of America's Broadband Infrastructure. News Release: NOI:

[RFC] FCC Launches Inquiry On Proposed Cyber Security Certification Program For Communications Service Providers

Press Release: "The Federal Communications Commission (FCC) today adopted a Notice of Inquiry (NOI) that seeks public comment on the proposed creation of a new voluntary cyber security certification program that would encourage communications service providers to implement a full range of cyber security best practices. This National broadband Plan recommendation serves as a first step to implementing a comprehensive roadmap to help counter cyber attacks and better protect America’s communications infrastructure.

"Enhancing the cyber security of the nation’s infrastructure is critical to the proper functioning of communications networks serving America’s financial institutions, national energy grid, medical institutions, educational system, and public safety. Yet, broadband communications networks are susceptible to malicious attack. Despite the increasing threat of cyber attacks, many communications end-users do not consider cyber security a priority. In 2008, a Data Breach Investigations report concluded that 87-percent of cyber breaches could have been avoided if reasonable security controls had been in place.

"The goals of a voluntary cyber security certification program would be to:

• Increase the security of the nation’s communications infrastructure;
• Promote a culture of more vigilant cyber security among participants in the market for communications services; and
• Offer consumers (or end-users) more complete information about their communication providers’ cyber security practices and ability to better protect their personal computer hardware and online activity from cyber attacks.

"The NOI seeks comment on a voluntary certification program under which private sector auditors or the FCC would conduct security assessments of participating communications service providers’ networks, including their compliance with stringent cyber security practices developed by a broad-based public-private partnership. Providers whose networks successfully completed this assessment would then be able to market their networks as complying with these FCC network security requirements.

"Further, the NOI includes the following questions regarding the proposal:

• The benefits and costs of such a program.
• Whether such a program will create a significant incentive for providers to increase the security of their systems and improve their cyber security practices.
• Whether public knowledge of providers’ cyber security practices would contribute to broader implementation by industry.
• Whether the scope of the certification program should be open to all communications service providers or should be limited to certain types of providers. If the latter, how should this be limited?
• What the overall framework should be for the certification criteria.
• The composition of a certification authority and whether it should be open to all segments of the potentially affected industries.
• The operating procedures of a certification authority.
• Who should be responsible for establishing the requirements that auditors must meet to be accredited to conduct cyber security assessments under the proposed program?
• What should be the appropriate certification criteria, accreditation procedures, and requirements to maintain certification once obtained?
• Whether the network security criteria should be definitive and objectively measurable or established on a case-by-case basis.
• The development and application of assessment standards.
• The form and duration of the security certificate, the renewal process, and permissible uses by providers of the security certificate.
• How appeals of certification issues should be handled.
• Whether any Commission enforcement process should be implemented for this program.

The NOI seeks comment on other actions, including voluntary incentives the Commission can take to improve cyber security and asks about actions the Commission can take to better educate consumers, businesses and government agencies about cyber security.

Action by the Commission, April 21, 2010, by Notice of Inquiry (FCC 10-63). Chairman Genachowski, and Commissioners Copps, McDowell, Clyburn and Baker. Separate Statements issued by Chairman Genachowski, and Commissioners Copps, McDowell, Clyburn and Baker. PS Docket No. 10-93.

Public Safety and Homeland Security Bureau (PSHSB) contact is Jeff Goldthorp, Chief of the Communications Systems Analysis Division, at (202) 418-1096.

4/21/10 FCC Launches Inquiry on Proposed Cyber Security Certification Program for Communications Service Providers. News Release : NOI

It's Cyber Security Awareness Month!

DHS or the National Cyber Security Alliance or someone has declared October National Cyber Security Awareness Month. So if you aren't already aware of your personal information getting pillaged on Facebook by the "What Star Trek Character Are You" application -- or having your computer infected by the "Your Computer May Already be Infected - Download This Tool Now" pop up add," -- or that there is a deposed leader in Nigeria that wants to share $10 million with you -- NOW it a good time to become aware of such things!

And what better time to point out that the good folks at OnGuard Online (a joint effort of a bunch of federal agencies and NGOs) have just released their latest: NetCetera: Chatting with Kids about Being Online.

In Net Cetera: Chatting With Kids About Being Online, OnGuard Online gives adults practical tips to help kids navigate the online world.

Kids and parents have many ways of socializing and communicating online, but they come with certain risks. This guide encourages parents to reduce the risks by talking to kids about how they communicate – online and off – and helping kids engage in conduct they can be proud of. Net Cetera covers what parents need to know, where to go for more information, and issues to raise with kids about living their lives online.

OnGuard Online encourages you to use this guide with your kids, in your school, at your PTA meeting, or anywhere else parents might gather. Feel free to order as many free copies as you’d like, put your own sticker on it, reprint sections in a newsletter or on a website, download a button or link to it, or even reprint it with your own logo. These materials are in the public domain.

To order free copies of Net Cetera, visit bulkorder.ftc.gov. To find out more about reprinting the guide, contact OnGuardOnline@ftc.gov.

OnGuard Online is seeking to partner with school districts on a pilot program using this guide. If your school district might be interested, please contact us at OnGuardOnline@ftc.gov.

There are lots of worms, viruses and other beasties out there on the Internet. You can do a lot to protect yourself and decrease your risks. But ya gotta be smart. I am always amazed by my friends who get lots of telemarketing calls and then complain about them. I ask, "well, at the check out stand when they ask for your phone number, do you give it to them??" They pause with a dumb look on their faces. "Well sure, but..." I shake my head. Dont give no personal information to no one. Dont use your correct birthday. Dont list your actual height. In fact, pretty much make up an entirely fictional character and then live vicariously through it! (okay, joking). Be smart out there; it a dangerous marvelous Internet.