http://www.gcn.com/online/vol1_no1/40127-1.html By William Jackson GCN Staff 03/15/06 The National Institute of Standards and Technology has released the final standard for securing agency computer systems under the Federal Information Security Management Act. Federal Information Processing Standard 200 [1] sets minimum security requirements for federal systems in 17 security areas. It is the third of three publications required from NIST under FISMA, which requires executive branch agencies to establish consistent, manageable IT security programs for non-national security systems. The intent of FISMA is to implement risk-based processes for selecting and implementing security controls. FIPS 199 [2], released two years ago, establishes standards for categorizing IT systems as low, moderate or high-impact, depending on the effect of a breach of confidentiality, integrity or availability of the system. Special Publication 800-53 [3] - "Recommended Security Controls for Federal Information Systems", lays out the tools to be used under FIPS 200 to secure IT systems. Agencies must be in compliance with FIPS 200 by March 2007. Requirements are spelled out for: * Access control * Awareness and training * Audit and accountability * Certification, accreditation and security assessments * Configuration management * Contingency planning * Identification and authentication * Incident response * Maintenance * Media protection * Physical and environmental protection planning * Personnel security * Risk assessment * System and services acquisition * System and communications protection * System and information integrity. Agencies must employ on each system the proper security controls in each of these areas depending on whether it is a low, moderate or high-impact system. NIST also is updating its standards for digital signatures. A draft of FIPS 186-3 [4], which would replace the current FIPS 186-2, has been released for comment. The original digital signature standard was released in 1994 and has been updated twice, in 1998 and 1999. The current version authorizes the use of key sizes of 512 and 1024 bits with approved algorithms. Key sizes of 1024 now are considered the minimum acceptable level for security of digital signatures. "With advances in technology, it is prudent to consider larger key sizes," NIST said. "Draft FIPS 186-3 allows the use of 1024, 2048 and 3072-bit keys." Comments on the proposed standard should be made by June 12 to elaine.barker@private, or mailed to the Chief, Computer Security Division, Information Technology Laboratory, Attention: Comments on Draft FIPS 186-3, 100 Bureau Drive, Stop 8930, National Institute of Standards and Technology, Gaithersburg, MD 20899-8930. [1] http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf [2] http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf [3] http://csrc.nist.gov/publications/nistpubs/800-53/SP800-53.pdf [4] http://csrc.nist.gov/publications/drafts/fips_186-3/Draft-FIPS-186-3%20_March2006.pdf _________________________________ InfoSec News v2.0 - Coming Soon! http://www.infosecnews.org
This archive was generated by hypermail 2.1.3 : Thu Mar 16 2006 - 02:11:39 PST