FISMA News

Editor’s Note:  The Cyber Intelligence Sharing and Protection Act of 2011 (CISPA), H. R. 3523, is attached below.

From: TPM

by Carl Franzen

The adage “never discuss politics” has never applied much to the Web.

But on Friday, political discussion surrounding a new cybersecurity bill turned into an all out messaging war between the bill’s critics and its backers.

The bill, the Cyber Intelligence Sharing and Protection Act or CISPA, for short, seeks to allow the government and private companies to share more information, including customer information, about perceived national cybersecurity threats.

From: Lab Manager Magazine

LOS ALAMOS, New Mexico, April 12, 2012—Intense pressure creates diamonds from coal, they say, and for Department of Energy (DOE) national laboratory cyber security programs, it’s an apt comparison. Fending off thousands of computer attacks from around the world, controlling vast libraries of sensitive information, yet keeping the scientific flow of knowledge moving, cyber teams such as those at Los Alamos National Laboratory (LANL) and elsewhere in the government complex feel the squeeze.

From: FederalNewsRadio.com 1500AM

By Jared Serbu

As lawmakers prepare to vote on dueling versions of cybersecurity legislation, the White House is making the case for the draft bill it proposed almost a year ago.

Any bill that emerges from Congress should include provisions that ensure the nation’s most critical privately-owned critical infrastructure is as secure as it can be, the Obama administration’s cyber policy chief said Tuesday.

From: The Washington Post

By Lisa Rein

From: ComputerWorld

Like their counterparts in the private sector, information technology managers in the federal government are actively debating whether their agencies should move to a “bring your own device” (BYOD) policy, allowing employee-owned mobile smartphones and tablets devices to be used for work.

WASHINGTON, D.C. — Like their counterparts in the private sector, information technology managers in the federal government are actively debating whether their agencies should move to a “bring your own device” (BYOD) policy, allowing employee-owned mobile smartphones and tablets devices to be used for work.

From: Defense News

Matthew McCormack is unusual among the intelligence community’s information security leadership. Most top managers are homegrown, but McCormack came to the Defense Intelligence Agency in January 2011 from the Internal Revenue Service, where he was chief of cybersecurity operations.

McCormack joined DIA at a time when the intelligence community was beginning to embrace cloud computing and the push toward mobile devices. Despite his outsider credentials, McCormack is hardly a security newbie. He was a Navy cryptology officer before leaving the service in 2002 to pursue a private-sector career in the banking industry. McCormack takes a cautious view about the role of mobile communications in the intelligence community, for example.

From: Reuters

NEW YORK: US law enforcement and counterterrorism officials are trying to figure out the significance of recent occurrences on websites believed to have close links to al Qaeda, including a graphic some fear could be an attack threat directed at New York City.

The graphic contained a picture of the Manhattan skyline superimposed with a Hollywood-style caption that says: “ALQAEDA – coming soon again in New York.”

It was posted on Monday by a site called the Ansar al Mujahiddin Arabic Forum, or AMAF, a militant web forum which allegedly has close connections to the Afghan Taliban and a key militant leader in Jordan.

Editor’s Note:  The complete ENISA Procure Secure report is attached below.

From: European Network and Information Security Agency (ENISA)

Procurement of cloud computing services is an increasingly important task for governments and businesses across the EU – and information security is a key pain-point.

To help solve this problem, the EU’s cyber security agency, ENISA today launched a new, practical guide for IT procurement teams, focusing on continuous security monitoring throughout the life-cycle of a cloud contract.