This is another in a series of the blog posts about the
latest DHS-IdeaScale project to open a public dialog about homeland security
topics. This dialog
addresses the DHS Integrated Task Force project to help advance the DHS
implementation of the President’s Cybersecurity Framework outlined in EO 13636.
The earlier posts in this series were:
Just days after I essentially wrote off this IdeaScale
Project another ‘idea’ was posted to site for public comment. This time it was
from Jonathan Tabb, who is apparently associated with the DHS Integrated Task
Force. Jonathan’s
post addresses the recently adopted National Performance Goals supporting
the Preliminary Cybersecurity Framework.
I am going to stretch the Free Use Doctrine here a bit with
the amount of data I am going to quote from Jonathan’s idea, but it appears
that this was lifted intact from an as of yet unpublished DHS ITF document, so
I should be okay with the Copyright infringement folks. Here are the National
Performance Goals as listed by Jonathan:
1. Critical systems and functions
are identified and prioritized and cyber risk is understood as part of a risk
management plan.
2. Risk-informed actions are taken
to protect critical systems and functions.
3. Adverse cyber activities are
detected and situational awareness of threats is maintained.
4. Resources are coordinated and
applied to triage and respond to cyber events and incidents in order to
minimize impacts to critical systems and functions.
5. Following a cyber incident,
impacted critical systems and functions are reconstituted based on prior
planning and informed by situational awareness.
6. Security and resilience are
continually improved based on lessons learned consistent with risk management
planning.
As I commented on the IdeaScale site last night (my comments
have not yet been moderated and made public as of 05:30 CST) these goals are
even more broadly crafted than the PCF. In fact, they are so broadly crafted
that it would be hard to object to anything specific in the goals. Readers that
venture a look at the IdeaScale site will note that I did vote ‘Disagreed’ with
these goals; that was vote was based upon my disagreement with their being
overly broad and without measurable standards.
In the past, I have urged my readers to look at the ideas
posted to the IdeaScale site and encouraged them to vote and comment on the
ideas. I can no longer in good do that with any enthusiasm for the reasons I
outlined in my last post on this topic. Still, if you had hoped that the
Cybersecurity Framework, and by extension the National Performance Goals that
support the implementation of that framework, would have a measurable effect on
the cybersecurity status of the critical infrastructure associated control
systems in this county, please join me in disagreeing with this particular
idea.
Posts
No comments:
Post a Comment