[ISN] Policy would require agencies to patch cybersecurity holes within 72 hours of discovery

http://www.nextgov.com/cloud-computing/2012/06/policy-would-require-agencies-patch-cybersecurity-holes-within-72-hours-discovery/56271/

By Aliya Sternstein
Nextgov
June 14, 2012

The Homeland Security Department later this month will present to 
federal computer contractors and remote cloud suppliers standards for 
finding and fixing cyber threats within 72 hours, DHS officials 
announced on Thursday.

The new approach aims to resolve what some cybersecurity specialists 
view as a flaw with the principle of automated “continuous monitoring” 
that the White House called for in 2010. Real-time tracking of potential 
network threats is intended to identify weaknesses faster and more 
economically than the old policy of manually reporting on computer 
inventories and incidents once a year. But spotting all the risks to 
personal computers and Internet connections in an organization does not 
make data any safer, critics note. Fixing them quickly does.

Resolving identified weaknesses rapidly is the goal of the new 
procedures and, according to some government advisers, agencies could 
eventually be required to adopt them. “We’re initiating the discussion 
and we are asking for comment,” DHS National Cybersecurity Division 
Director John Streufert told Nextgov on Thursday.

Homeland Security officials will describe the standards in-depth to 
industry officials June 25-26, Streufert said earlier in the day during 
a talk co-hosted by Government Executive Media Group, which includes 
Nextgov. He spearheaded the original continuous monitoring movement as 
the former chief information security officer for the State Department.

[...]


--
Certified Ethical Hacker, ISSMP, ISSAP, CISSP training
with Expanding Security gives the best training and support.
Get a free live class invite weekly. Best programs, best prices.
http://www.ExpandingSecurity.com/PainPill