Cyber Security Framework Workshop, April 3, 2013

The April 3 workshop was mobbed, the Department of Commerce auditorium was filled to capicity. I assumed that it would be thinly attended like the meetings of the Federal XML work group; but there must have been something like 500 people there. Clearly people are interested and are planning on following the process very closely. I hope that means that we will build a better standard that gains broad compliance.

This workshop was designed to gain industry's perspective. The first panel had Russell Schrader of VISA, Terry Rice of Merck, Michael Paypay of Northrop Grumman, and Reid Stephan of St. Lukes Health System.

Russell Schrader of VISA described the Executive Order as sensible, and was pleased with the request for private sector feedback. He also expressed the need for international cooperation, and that there is so much more to be done.

Schrader described security as being core to VISA's brand promise. He reminded that audience that VISA as one of the founding members of the Payment Card Industry Council, and suggested that PCI offers a template for cyber security coopoeration. He described the PCI system as scalable from the small merchant to the large.

Schrader described cyber security as a continuing process, that there is no box to be checked. He described VISA's approach as Prevent, Protect, and Respond, saying that, "we try to stop trouble before it begins."

Schrader called on NIST to build on what already exists and aim for global scalability. He was especially concerned that NIST not create contradictory procedures.

He stressed the need for information sharing, and that it was necessary to create a legal framework for law enforcement. (I assume that he meant over and above the work of NEIM.)

Michael Paypay, Chief Information Security Officer for Northrup Grumman, described his work as "where the rubber meets the road". He said that it was extremely important to Northrup protect the information that the government has entrusted to them.

Paypay described the defense industry as having a collaborative approach, going on to describe himself as "representing all my aerospace brothers." He said that cyber security not an area where aerospace competes, but rather they cooperate.

Paypay observed that there is no common lexicon of roles and responsibilities in cyber security. He also said that bench-marking against other people can be a problem. He described government "best practices" as very helpful, in particular NIST 800-53.

He said that it was important to identify what is appropriate for your business, going on to say that you cannot simply protect protect your perimeter; but that it was necessary to build a layered defense, and go through each layer in order to identify risk.

Reid Stephan said that it had been an eye opening experience to join health care industry, we are catching up to other industries. He said that the National Health ISAC looks to existing standards such as the 800-30 guide to risk assessment. He suggested that it was better to integrate existing standards and best practices rather than building something from scratch. Stephan pointed out that cyber security risk management had to be balanced with business risk management, going on to say a risk based approach rather the control based approach would be more practical.

Stephan lamented the lack of robust intra and inter industry collaboration, and that the framework needs to address this sort of collaboration. He went on to observe that the cyber security framework will will never be finished, but become a dynamic standard.

Terry Rice of Merck thanked Commerce and NIST for hosting the workshop. Rice pointed out that life sciences, including pharmaceuticals, has been identified as critical infrastructure. The pharmaceutical industry is already working with DHS to protect their information.

Rice reiterated the point others had made, that cyber security is not binary - as in one is not either secure or insecure. He lamented lack of metrics for risk assessments and said that NIST is in a good position to help with this. Rice said that in 2005 the pharmaceutical industry established a not for profit organization to establish digital standard standard for a bio-pharma digital signature. He said that security required authenticity, that is non-repudiable information. He described the NIST-800-63 guidelines as useful.

He reminded the audience that the DEA has established a standard for doctors' digital signature for controlled substances. Rice also spoke about the need for anonymity for persons searching for information about sensitive medical conditions.

Rice pointed out the need for skilled workers, lamenting that computer security is not a required for computer college students.

Rice echoed others call for an international approach, for example, how would the cyber security framework apply to a foreign owner of critical infrastructure?

He said that we have to include privacy as part of the framework. In this he underscored the Executive Order's inclusion of the federal government existing privacy guidelines.

At this point Patrick Gallagher opened it up for a general discussion asking, "How do we support adoption? How should the framework think about supporting adoption?

Michael Paypay said that everyone in the company has to be trained in security. He said that Northrup Grumman's spear phishes their own employees, providing remedial training for people who get it wrong. 

Both Stephan and Rice pointed out that good compliance does not equal security. It is necessary to make sure that people understand, and you have to tread carefully when dealing with doctors.

Schrader said that you have to make sure people understand the need for security procedures.

Gallagher asked Schrader how VISA persuades its service centers and merchants be compliant. Schrader replied that VISA merchants are looking for something to implement that makes sense for their situation. 

Panelists agreed that we need safe guards around data, whether in storage and transit.

Paypay observed that not all threats are the same. DDoS not affect business like Northrup Grumman as "we don't do business through the website."

Panelists agreed on the need to establish common vulnerabilities and not create new standards where there is an existing one.

Terry Rice talked about the need for metrics to measure and manage risk.

Gallagher asked the panelists how they talked about risk, and their bosses role in risk management, "how do you make cyber secuirty relavent to the C Suite? Schrader replied, "look at the daily paper, you can't run a company without knowing about these incidents, education not necessary at VISA."

Reid Stephan said that one "can't take a fear approach." It is necessary to have a consistent process to measure risk, and establish a relationship and seen as a partner, that gets you a "seat at the table."

Michael Paypay said that at Northrup-Grumman "we are lucky because our executives understand this. Also, our customers are highly educated about cyber security- they don't have a cut and dry practice for security."

Gallagher pointed out that in the US the government does not establish cyber security standards - "how can we exploit the fact that we work together?"

Schrader said that "you don't want to codify standards" because of the continuing changes in IT.

The next Cyber Security Framework Workshop will take place in Pittsburgh from May 29 through 31

Cyber Security Framework website

Grant Gross: US NIST: Industry should lead creation of cybersecurity framework

Brian Browdie: Cybersecurity Framework Demands Input from Industry, Official Says

J. Nicholas Hoover: No Bold Moves On U.S. Cybersecurity Framework

Jason Miller: NIST, industry begin journey to develop cyber framework

Molly Bernhart Walker: NIST sorting comments on cybersecurity framework

We provide solutions for our customers' culinary needs

So what is the business? Is it a pizza delivery service? A Chinese restaurant? Or is it a grocery store? It could be any of the above.

No Pizza place, Chinese restaurant, nor grocery store would describe itself in such a manner; but this is common in technology. Every other industry describes itself in clear terms with an eye to catching the eye of its prospective customers.

I don't know why technology marketers embrace such vague copy. I thought that SEO would change this. After all, if you are a Cloud Computing company, it is in your SEO interest to say so on your homepage. Your company has a better chance of floating to the top of search results if you describe your services in the clearest possible terms. But for whatever reason, technology continues to embrace the sales killing rhetoric of IT market speak.

We offer solutions to help customers achieve business objectives

It is sad how many IT companies, especially government contractors employ such language to describe their business. Look at the website of almost any IT company and you will be hard pressed to work out what they actually do. I cannot work out why marketers are so obtuse about this.

Are you a cloud computing provider? System integrator? Web services consultant? Software tools developer? Web designer and content management company? Just say so.

Do you develop software for the financial services sector? Data visualization to the military? Records management for the legal market? Just say so. 

I have never understood IT's aversion to direct communication.

The power of the free sample

Brite Technologies offers free instructions for virus removal to highly skilled computer users. What a brilliant idea.

New to me local blogs

Security Debrief, Security Debrief is a blog dedicated to homeland security, terrorism and counter-terrorism, intelligence and law enforcement that provides context to the debates, policies and politics that are playing out in Washington, D.C. ...

... Security Debrief is produced by Adfero Group and The George Washington University Homeland Security Policy Institute.

ECC IT Solutions

ThinkTech Blog, the blog of FedSolutions

Cloud Market Views, the blog of Virtustream

Straight Tech, the TMI blog, from Technology Management, Inc.

Turtle Wings blog, a blog about recycling electronic waste.

Managing Technology, the blog of Visular

The Interactive Files: Squash Errors, not Bugs!, From Wellfire Interactive

Whitehorse Technology Solutions

Accelera Solutions

Salient Federal Solutions

AETEA Information Technology

More arrogance from Google/Blogger

I went to make some minor tweaks to my sidebar, hit update, and got a whole new design. That would not be so bad, except, in its infinite wisdom, Blogger decided to erase my entire sidebar of laboriously collected links.

 Jerking your users around really isn't a great way to do business. It is true that Blogger is a free tool, but it only has value because so many of us worked very hard to build up our blogs. To have all that work suddenly snatched from you simply because blogger decided they wanted to make design changes is aggravating beyond words. Shame on Blogger, shame on Google.

When control gets out of control

Having a PR C risis? There's Probably an App for That

Indeed, brands want more control over what appears on franchisees’ Facebook and Twitter pages. Ray Wert, co-founder of automotive marketing agency Tiny Toy Car, said rogue messaging often damages brands in his space. 

"Many crisis communications issues are caused on the sales front," Wert said. "Carmakers are looking for tools to help dealerships be good social media actors." Software providers, take note.

As a PR pro, I am not enthusiastic about centralized control. Time is one of the most important element in crisis management. Letting a situation simmer while senior management decides how to respond gives a minor discussion in social media snow ball into a major PR disaster. Sometimes a swift response from a worker bee is the best way to calm a social storm. I am trying to think of a major PR crisis that was caused by a rogue franchisee or low level employee, and I cannot think of one. However, I can easily name a hundred PR disasters precipitated by the actions of senior management. It is difficult to believe that trying to control the social media of franchisees it going to enhance engagement with one's customers.

Advertising is cheaper than comment spam

Now that I have begun to post more regularly to this blog I have seen a surge of comment spam. Sigh.

Sadly it appears to be coming from humans rather than bots. So someone is paying for humans to do this, or has purchased fancy bots.

You know what would be cheaper and actually effective? Would generate site traffic to your website and generate good will? Paid advertising.

You can buy a week's worth of advertising on low traffic blogs from Blogads for as little as $1000. Or you can purchase a sponsored post on Reddit, which will appear on the top of the sub-Reddit you select, prices begin at $20. Or you can purchase some keywords on Google, Yahoo, or any other search engine.

What a great name for a Communications blog!

Say no to mean, I Say What I Mean, but I Don't Say it Meanly The thoughts and words of Diana M. Rodriguez

 She has some excellent tips for email, my personal favorite:

Don’t #2 Texting acronyms: Many college students will be in for a rude awakening if they believe that acronyms that are used in text messages are acceptable when writing business emails. For example, using the acronym “GTG” for “good to go” will not be accepted or understood. In an office environment is best to stick with clear, concise wording and limit the use of abbreviated acronyms that the receiver may or may not understand.

Readers of this blog know that I try to stay away from acronyms of any kind. Between federal acronyms, military acronyms, and technology acronyms, room for confusion is too great. We should try to set a good example for our clients.

We sell to people, not search engines

The Guardian has a great piece on the confusion about the hype around content marketing:

The danger for brands getting caught up in this is that they are indeed viewing it as a panacea. Rushing in, rather than remaining firmly focused on their customer, their interests, passions, anxieties and hopes, to try and understand what sort of content they're interested in. 

Most importantly, why they'd ever want to hear it from you and why you're bothering producing it in the first place. 

If the answer to that question is "to drive SEO, to get round the Google Panda update, to help social sharing, to reduce our bounce rate on our website", your move into content marketing is only going to benefit the content marketing salesmen.

It is useful to have a library of keywords and a social media calendar to give your social media effort form; but if you don't engage your audience it is just so much more blather on the internet. When you write you should have a specific audience in mind. It makes it easier to write meaningful prose.

NIST asks for help in building cybersecurity framework

NIST to build cybersecurity framework, with your help

The Cybersecurity Framework will be a set of voluntary standards and best practices to guide industry in reducing cyber risks to the networks and computers that support critical infrastructure vital to the nation's economy, security and daily life, according to the NIST announcement published in the Federal Register. ...

...The first meeting will be held April 3 at NIST headquarters in Gaithersburg, Md. Registration information is available here.

If you have concerns about cybersecuirty or privacy, I urge you to participate in these discussions."

All about sequestration

The ugly comes after sequestration, after March 27 we will need a new continuing resolution.

Courtesy of GovLoop:
DoD program managers can talk sequestration with contractors
Sequestration affecting congressional hiring, so at least they are feeling some of the pain on Capitol Hill.

Sequestration treadmill picking up steam across DoD

Are contractors exaggerating sequestration impact?

The entire sequestration process is completely opaque.

Of course congress could simply repeal the Budget Act of 2011, pass a new continuing resolution and be done with it.

Social Media and the Italian election

The Guardian has a tremendous article about How Beppe Grillo's social media politics took Italy by storm. More accurately, it is the story about how Grillo used social media to spread his message of radical populism. Grillo's message resonated with an electorate who feels it has been betrayed by traditional leaders, both political and media. Therefore, social media was the logical tool for spreading Grillo's message.

Head on the internet, and feet on the ground, as Grillo himself puts it.

So what does this mean for the developer of software tools for the federal market? Presumably you have a Facebook page, or a Google Plus page, or at least a Twitter account. Wherever you have established your online presence, you have identified your community. So, when you have an event, invite your followers.

Realistically you can't hold a rally and have thousands of people cheering for your software tools, or web widgets. But you can generate a steady flow of traffic to your booth at the trade show and/or guarantee a full room when you present at a conference or the monthly meeting of a user group. For purposes of building a prosperous company, that is sufficient.

Pre-fab online presence

Have you noticed those manipulative Facebook posts, "like" if you hate cancer and so forth? It seems that the more "likes" your posts receive, the higher your EdgeRank. What is EdgeRank you ask?

EdgeRank is an algorithm developed by Facebook to govern what is displayed—and how high—on the News Feed.

Just because someone has "friended" you, it does not follow that you will get to see their posts. Facebook has a complicated algorithim that decides what goes into your feed. You don't see all the material that has been posted by your friends and the pages you have "liked." Facebook, not you, decides what you really like.

So, if you want to build a page with a very high EdgeRank, you post manipulative posts asking readers to support a cure for cancer.

All about those Facebook "like" scam posts

Businesses worldwide are trying to figure out how to best utilise platforms like Facebook, Twitter and Google Plus (haha, na I’m just kidding about Google Plus). They know that EdgeRank, likes, brand exposure and followers are important, even if they don’t know exactly why or what to do with it.

So a social media consultant manufactures a page with a high edgerank and sells it to some business who wants a page with high EdgeRank, but does not know how to build it. You know what would be cheaper and more effective than buying a pre-fab fan page from a social media consultant? Building a page on Facebook, putting interesting content on that page, and then buying advertising from Facebook to generate traffic, and ultimately EdgeRank. Sometimes paying the Facebook toll is the superior solution.

NIST issues RIF for Cybersecurity Framework

NIST has issued a RIF for Cybersecurity Framework (PDF), which will soon be published in the Federal Register. The Information Technology Laboratory of NIST has created a web site for Cybersecurity Framework.

Interested parties need to study the Request for Information, and make whatever response they deem appropriate. Those with questions and concerns should contact  cyberframework@nist.gov.

Most of us can content ourselves with watching the Cybersecurity Framework website. I am hoping to attend the local events.

The Cybersecurity Framework

I suggest that everyone who is interested read the Executive Order -- Improving Critical Infrastructure Cybersecurity before you read the news coverage. It is not long and is reasonably clear.

Clearly, much depends upon how this is implemented. I would encourage all those who are interested to participate in the process. Now is the time to speak out, before the Executive Order is implemented.

I would draw particular attention to Section 7:

Sec. 7. Baseline Framework to Reduce Cyber Risk to Critical Infrastructure. (a) The Secretary of Commerce shall direct the Director of the National Institute of Standards and Technology (the "Director") to lead the development of a framework to reduce cyber risks to critical infrastructure (the "Cybersecurity Framework"). The Cybersecurity Framework shall include a set of standards, methodologies, procedures, and processes that align policy, business, and technological approaches to address cyber risks. The Cybersecurity Framework shall incorporate voluntary consensus standards and industry best practices to the fullest extent possible. The Cybersecurity Framework shall be consistent with voluntary international standards when such international standards will advance the objectives of this order, and shall meet the requirements of the National Institute of Standards and Technology Act, as amended (15 U.S.C. 271 et seq.), the National Technology Transfer and Advancement Act of 1995 (Public Law 104-113), and OMB Circular A-119, as revised.

What goes into the frame work and what is left out will determine what sort of cyber culture we will live with. And by "we" I don't merely mean Americans, this framework is sure to affect the entire industry.

The Executive Order clearly  requires a consultative process that will include a public comment process. Section 5 sets for the privacy and civil liberties protections that are to be based on the Fair Information Practice Principles. Privacy and civil liberties advocates would be well advised to familiarize themselves with these principles.

I would also note the deadlines the Executive Order establishes (listed in order of the deadlines):

Within 90 days of the publication of the preliminary Framework, these agencies shall submit a report to the President, through the Assistant to the President for Homeland Security and Counterterrorism, the Director of OMB, and the Assistant to the President for Economic Affairs, that states whether or not the agency has clear authority to establish requirements based upon the Cybersecurity Framework to sufficiently address current and projected cyber risks to critical infrastructure, the existing authorities identified, and any additional authority required.

(b) If current regulatory requirements are deemed to be insufficient, within 90 days of publication of the final Framework, agencies identified in subsection (a) of this section shall propose prioritized, risk-based, efficient, and coordinated actions, consistent with Executive Order 12866 of September 30, 1993 (Regulatory Planning and Review), Executive Order 13563 of January 18, 2011 (Improving Regulation and Regulatory Review), and Executive Order 13609 of May 1, 2012 (Promoting International Regulatory Cooperation), to mitigate cyber risk. The Secretary shall coordinate establishment of a set of incentives designed to promote participation in the Program. 

Within 120 days of the date of this order, the Attorney General, the Secretary of Homeland Security (the "Secretary"), and the Director of National Intelligence shall each issue instructions consistent with their authorities and with the requirements of section 12(c) of this order to ensure the timely production of unclassified reports of cyber threats to the U.S. homeland that identify a specific targeted entity.

(c) To assist the owners and operators of critical infrastructure in protecting their systems from unauthorized access, exploitation, or harm, the Secretary, consistent with 6 U.S.C. 143 and in collaboration with the Secretary of Defense, shall, within 120 days of the date of this order, establish procedures to expand the Enhanced Cybersecurity Services program to all critical infrastructure sectors.

Within 120 days of the date of this order, the Secretary and the Secretaries of the Treasury and Commerce each shall make recommendations separately to the President, through the Assistant to the President for Homeland Security and Counterterrorism and the Assistant to the President for Economic Affairs, that shall include analysis of the benefits and relative effectiveness of such incentives, and whether the incentives would require legislation or can be provided under existing law and authorities to participants in the Program.

(e) Within 120 days of the date of this order, the Secretary of Defense and the Administrator of General Services, in consultation with the Secretary and the Federal Acquisition Regulatory Council, shall make recommendations to the President, through the Assistant to the President for Homeland Security and Counterterrorism and the Assistant to the President for Economic Affairs, on the feasibility, security benefits, and relative merits of incorporating security standards into acquisition planning and contract administration. The report shall address what steps can be taken to harmonize and make consistent existing procurement requirements related to cybersecurity.

Sec. 9. Identification of Critical Infrastructure at Greatest Risk. (a) Within 150 days of the date of this order, the Secretary shall use a risk-based approach to identify critical infrastructure where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security. In identifying critical infrastructure for this purpose, the Secretary shall use the consultative process established in section 6 of this order and draw upon the expertise of Sector-Specific Agencies.

(e) Within 240 days of the date of this order, the Director shall publish a preliminary version of the Cybersecurity Framework (the "preliminary Framework"). Within 1 year of the date of this order, and after coordination with the Secretary to ensure suitability under section 8 of this order, the Director shall publish a final version of the Cybersecurity Framework (the "final Framework").

(c) Within 2 years after publication of the final Framework, consistent with Executive Order 13563 and Executive Order 13610 of May 10, 2012 (Identifying and Reducing Regulatory Burdens), agencies identified in subsection (a) of this section shall, in consultation with owners and operators of critical infrastructure, report to OMB on any critical infrastructure subject to ineffective, conflicting, or excessively burdensome cybersecurity requirements.

I trust that those tasked with creating the Framework will follow the excellent example of the Federal XML Work Group by setting up a website where the rest of us can follow their work. It is particularly important that the minutes of their meetings be posted in a timely manner and that their email discussion groups be publicly posted. This will build trust and increase the chances of a smooth adoption and implementation of whatever Framework is established.

Blog around the Potomac

Inside Adams (from the Library of Congress) talks about football and turf grass.

Appian posts a guide to modeling and reporting.

Ted Voss talks about the federal mobile computing summit.

Fit & Finish talks about Achieving Balance and Harmony on Your Next Digital Project - Introducing "The UX Chakra Model"

Celia Kang reports that Mobile Internet use expected to surge

And people will use their mobile devices more than home computers to access the Internet.

This reflects what I have been hearing at local tech events.

New to me local blogs

The Federal Communicators Network has a blog.

 PPC

The Federal Buzz, blog of Riva Solutions

In defense of social media experts

The Onion has a very funny video on social media experts.

So what is the value of social media experts? Why would anyone hire us? The genius of social media experts is understanding online conversations. Our skill is knowing how to present content in such a way that amplifies its impact. Lets take a well known example. Someone, no one knows who, secretly filmed Mitt Romney at a fundraiser where he said that 47% of Americans would not support him because there were dependent upon government handouts. And there the matter would have rested, on an obscure YouTube channel where almost no one would see it. Even the most sensational content needs promotion.

As we all know, a certain James Carter chanced upon it while surfing YouTube. Carter forwarded the video to a reporter at Mother Jones Magazine, and the rest is history. Carter did this as a Democrat, and a loss leader for his political consulting business. So if anyone wants to know the value of what we do, here it is. We take content that would other wise remain obscure and pitch it to someone, traditional media or online community, where people would be interested. It is very similar to traditional media relations, where you take a client's story and pitch it to the news organization that would be interested.

Done properly, there is great value in social media consulting.

PR FAIL

Ryanair's new comms chief to eschew social media

Noting the existence of more than one fake Ryanair account on Facebook and Twitter, which have significant consumer followings, Kiely said: 'A Facebook account would not be helpful to us, as we would have so many people looking for a response.'

He called the social network a 'two-way tool' and said maintaining a dedicated account would probably mean 'hiring two more people just to sit on Facebook all day'.

Presumably, responding to the public is what a company hires a communications chief to do. Or does he suppose that he can just issue statements to the traditional news media, which they would duly print, and take no account of the general public, also known as Ryanair's customers and potential customers?

If responding to the public requires you set up a Facebook account and respond to their concerns all day, then that is what you need to do.