Cloud security program’s pilots try to lessen growing pains

From: FederalNewsRadio.com 1500AM

By Jason Miller | @jmillerWFED


Goodrich also said related to the high baseline is a continuous monitoring pilot. He said the PMO is testing a tool to take all scan reports, including those from the Plan of Action and Milestones (POAM), deviation requests and similar security data, and report the data to the JAB about the cloud service providers. The goal is to ensure the CSP is continually meeting the cyber standards.

“We are going through the pilot to see what level of effort is for the PMO to take on for agencies,” he said.


Splunk leads way for SIEM, but significant obstacles hampering full SIEM benefits

From: Channel Life [N.Z.]

Heather Wright

A new report from 451 Research has Splunk leading the way for enterprise security information and event management, with its querying capability and ease of integrating new data feeds winning favour.


“SIEM solutions still retain a reputation for being difficult to set up, difficult to add new feeds to, and difficult to tune,” Kennedy says. “That said, their value to the enterprise security manager is increasingly understood, and while many SIEM implementations may have started out as a compliance check mark, they have transcended those roots.”

Read Complete Article


Audit: DHS makes progress (but not much) in IT security

From: FedScoop

Among the good: High-value assets appear to be locked up. Among the bad: Windows XP is on machines with top secret data.

By Greg Otto

The Department of Homeland Security has made significant progress in meeting the demands of the administration’s cybersecurity priorities but needs to do more, according to the department’s inspector general.

In a report released Thursday, the IG detailed an IT audit that looked at the full scope of the department, measuring various benchmarks attached to the 2014 Federal Information Security Management Act.

Read Complete Article


Federal Cybersecurity Information Sharing Act signed into law

From: Data Protection Report



In the provision that both raised the concerns of privacy advocates and was viewed as essential to enabling the sharing of cyber threat information with the government by businesses, CISA authorizes businesses to monitor their information systems and all information stored on, processed by, or transiting the information system, as long as the monitoring is for the purpose of protecting the information or information systems. The law grants to businesses full immunity from government and private lawsuits and other claims that may arise out of CISA-compliant monitoring in which businesses may engage.