open security controls
play

Open Security Controls Assessment Language (OSCAL) Lunch with the - PowerPoint PPT Presentation

Mar 31, 2024 •28 likes •118 views

Open Security Controls Assessment Language (OSCAL) Lunch with the OSCAL Developers David Waltermire National Institute of Standards and Technology Teleconference Overview 2 Ground Rules OSCAL Status Summary (5 minutes) Review

  1. Open Security Controls Assessment Language (OSCAL) Lunch with the OSCAL Developers David Waltermire National Institute of Standards and Technology

  2. Teleconference Overview 2  Ground Rules  OSCAL Status Summary (5 minutes)  Review Assessment, Assessment Result, and Plan of Action and Milestones Models  Question and Answer / Discussion  Submitted questions will be discussed  The floor will be open for new questions and live discussion

  3. OSCAL Lunch with the Developers 3 Purpose:  Facilitate an open, ongoing dialog with the OSCAL developer and user communities to promote increased use of the OSCAL models Goals:  Provide up-to-date status of the OSCAL project development activities  Answer questions about implementing and using the OSCAL models, and around development of OSCAL model-based content  Review development priorities and adjust priorities based on community input  Help the OSCAL community identify development needs

  4. Ground Rules 4  Keep the discussion respectful  Using welcoming and inclusive language  Being respectful of differing viewpoints and experiences  Gracefully accepting constructive criticism  Focusing on what is best for the community  Wait for one speaker to finish before speaking - one speaker at a time  Speak from your own experience instead of generalizing ("I" instead of "they," "we," and "you").  Do not be afraid to respectfully challenge one another by asking questions -- focus on ideas.  The goal is not to always to agree -- it is to gain a deeper understanding.

  5. OSCAL Version 1 Milestones 5 Milestone Focus Sprints Status Date Milestone 1 Catalog and Profile Models 1 to 21 Completed 6/15/2019 Milestone 2 System Security Plan (SSP) Model 6 to 23 Completed 10/1/2019 Milestone 3 Component Definition Model 6 to ~30 Completed May 2020 Release Provide a web-based specification 24 to ~33 In Progress ~ August 2020 Candidates / Model Improvements Full Release Based on Community Feedback 34 to 36 Planned By end of 2020 Ongoing Minor and bugfix releases as Additional Planned Ongoing Maintenance needed Sprints Current Sprint: 32 (https://github.com/usnistgov/OSCAL/projects/31)

  6. Review of Current/Completed Work 7 On Github: https://github.com/usnistgov/OSCAL

  7. Open Floor 10 What would you like to discuss? What questions do you have? Should we be covering anything differently?

  8. Thank you 11 OSCAL Repository: https://github.com/usnistgov/OSCAL Next Lunch with Devs: Project Website: July 16 th , 2020 https://www.nist.gov/oscal 12:00 Noon EDT (4:00 PM UTC) How to Contribute: https://pages.nist.gov/OSCAL/contribute/ Contact Us: oscal@nist.gov On Gitter: https://gitter.im/usnistgov- OSCAL/Lobby

  9. Three New OSCAL Models 12 POA&M  Based on FedRAMP POA&M Assessment Results  Based on FedRAMP Security Assessment Report (SAR) Assessment Plan  Based on FedRAMP Security Assessment Plan (SAP)

Recommend

IT Security Controls By: Jay Chen What are IT Security Controls? Safeguards or

IT Security Controls By: Jay Chen What are IT Security Controls? Safeguards or

IT Security Controls By: Jay Chen What are IT Security Controls? Safeguards or countermeasures to avoid, detect, counteract, or minimize security risk Types of Controls Preventive Controls (E.g. Password lockout after 5 failed

483 views • 31 slides
IT Security Controls Spring 2020 By: Jay Chen What are Security Controls? A safeguard or

IT Security Controls Spring 2020 By: Jay Chen What are Security Controls? A safeguard or

IT Security Controls Spring 2020 By: Jay Chen What are Security Controls? A safeguard or countermeasure for an information system or an organization designed to protect confidentiality, integrity, and availability of its information and to

605 views • 34 slides
Open Security Controls Assessment Language (OSCAL) Lunch with the OSCAL Developers David

Open Security Controls Assessment Language (OSCAL) Lunch with the OSCAL Developers David

Open Security Controls Assessment Language (OSCAL) Lunch with the OSCAL Developers David Waltermire National Institute of Standards and Technology Teleconference Overview 2 Ground Rules OSCAL Status Summary (5 minutes) Issues

427 views • 14 slides
Open Security Controls Assessment Language (OSCAL) Lunch with the OSCAL Developers David

Open Security Controls Assessment Language (OSCAL) Lunch with the OSCAL Developers David

Open Security Controls Assessment Language (OSCAL) Lunch with the OSCAL Developers David Waltermire National Institute of Standards and Technology Teleconference Overview 2 Ground Rules OSCAL Status Summary (5 minutes) Issues

298 views • 10 slides
Open Security Controls Assessment Language (OSCAL) Lunch with the OSCAL Developers David

Open Security Controls Assessment Language (OSCAL) Lunch with the OSCAL Developers David

Open Security Controls Assessment Language (OSCAL) Lunch with the OSCAL Developers David Waltermire National Institute of Standards and Technology Teleconference Overview 2 Ground Rules OSCAL Status Summary (5 minutes) Issues

434 views • 16 slides
Open Security Controls Assessment Language (OSCAL) Lunch with the OSCAL Developers David

Open Security Controls Assessment Language (OSCAL) Lunch with the OSCAL Developers David

Open Security Controls Assessment Language (OSCAL) Lunch with the OSCAL Developers David Waltermire National Institute of Standards and Technology Teleconference Overview 2 Ground Rules OSCAL Status Summary (5 minutes) Issues

404 views • 11 slides
Who Controls the Past Controls the Future Who Controls the Present Controls the Past Nothing

Who Controls the Past Controls the Future Who Controls the Present Controls the Past Nothing

Who Controls the Past Controls the Future Who Controls the Present Controls the Past Nothing gives rest but the sincere search for truth. -Pascal Greetz from Room 101 Kenneth Geers 1984 # Nineteen Eighty-Four (Orwell) # Govt IW vs own

1.03k views • 77 slides
Injecting Security Controls into Software Applications Katy Anton Principal Application Security

Injecting Security Controls into Software Applications Katy Anton Principal Application Security

Injecting Security Controls into Software Applications Katy Anton Principal Application Security Consultant About me Katy Anton Software development background Project co-leader for OWASP Top 10 Proactive Controls (@OWASPControls)

599 views • 37 slides
Security Controls for Industrial Control Systems EEI/AGA Security Committee Fall Meetings

Security Controls for Industrial Control Systems EEI/AGA Security Committee Fall Meetings

Security Controls for Industrial Control Systems EEI/AGA Security Committee Fall Meetings September 13, 2006 Boston, MA Stuart Katzke and Keith Stouffer, National Institute of Standards & Technology, Gaithersburg, MD Marshall Abrams, The

460 views • 23 slides
Cyber Security and Export Controls: You Need to Know More Than You Already Do AnnaLisa

Cyber Security and Export Controls: You Need to Know More Than You Already Do AnnaLisa

Cyber Security and Export Controls: You Need to Know More Than You Already Do AnnaLisa Nash Export Control Officer, NDSU Why Should You Care About Export Controls? so you can avoid HERE. When Should You Care? NOW. U.S. export

758 views • 65 slides
Overview Database Security Semantic Integrity Controls Access Control Rules Multilevel

Overview Database Security Semantic Integrity Controls Access Control Rules Multilevel

Overview Database Security Semantic Integrity Controls Access Control Rules Multilevel Secure Databases RBAC in Commercial DBMS Statistical Database Security Simone Fischer-Hbner Applied Security, DAVC17 Relational Database

194 views • 6 slides
Measuring the Performance and Effectiveness of Critical security controls William Makatiani

Measuring the Performance and Effectiveness of Critical security controls William Makatiani

Measuring the Performance and Effectiveness of Critical security controls William Makatiani Name Here About Serianu Limited Serianu is a Pan Africa based Cyber Security and business consulting firm. We are an award winning company in the

759 views • 46 slides
Todays Keys What are IT Controls Basic IT Controls Where to Find Resources What are IT

Todays Keys What are IT Controls Basic IT Controls Where to Find Resources What are IT

Todays Keys What are IT Controls Basic IT Controls Where to Find Resources What are IT Controls Objectives of IT Controls are Interrelated Prevent & Detect Fraud Automate Ensure controls Prevent integrity & accidental

308 views • 16 slides
This audit looked at whether the fraud and corruptjon controls over personnel security are

This audit looked at whether the fraud and corruptjon controls over personnel security are

This audit looked at whether the fraud and corruptjon controls over personnel security are well-designed and operatjng as intended. We examined recruitment practjces for employees, contractors and consultants in the Victorian Public Service, or

255 views • 3 slides
ASCEM Conference Lighting Controls Roundtable Discussion Why do we want lighting controls?

ASCEM Conference Lighting Controls Roundtable Discussion Why do we want lighting controls?

ASCEM Conference Lighting Controls Roundtable Discussion Why do we want lighting controls? Behavior Modification versus lighting controls Implementation and outcomes Typical Controls Keyed Switches Dual switching

973 views • 15 slides
Simulation-based optimization of information security controls: An adversary-centric approach

Simulation-based optimization of information security controls: An adversary-centric approach

Simulation-based optimization of information security controls: An adversary-centric approach Elmar Kiesling, Andreas Ekelhart, Bernhard Grill, Christine Strau, Christian Stummer December 9, 2013; Washington, DC Funded by the Austrian

1.01k views • 88 slides
Controls: Benefits of Honeypots to Companies Srgio Nunes & Miguel Correia Lisboa, December

Controls: Benefits of Honeypots to Companies Srgio Nunes & Miguel Correia Lisboa, December

IBWAS 2010 From Risk Awareness to Security Controls: Benefits of Honeypots to Companies Srgio Nunes & Miguel Correia Lisboa, December 2010 About me Senior Information Security Consultant / Auditor University Professor: Security,

447 views • 23 slides
API security in a microservice architecture Matt McLarty VP, API Academy, CA Technologies Feb.

API security in a microservice architecture Matt McLarty VP, API Academy, CA Technologies Feb.

API security in a microservice architecture Matt McLarty VP, API Academy, CA Technologies Feb. 28, 2018 Agenda Purpose and Goals Background Current Approaches - Network-level Controls - Application-level Controls - Emerging

785 views • 43 slides
Implementation of Resilience via Operational Controls Art Conklin, University of Houston Funded

Implementation of Resilience via Operational Controls Art Conklin, University of Houston Funded

Implementation of Resilience via Operational Controls Art Conklin, University of Houston Funded by the U.S. Department of Energy and the U.S. Department of Homeland Security | cred-c.org Security in IT vs. OT IT security CIA associated

348 views • 14 slides
Cryptech The Open Hardware Security Module Platform Joachim Strmbergson ::1 Assured AB

Cryptech The Open Hardware Security Module Platform Joachim Strmbergson ::1 Assured AB

Cryptech The Open Hardware Security Module Platform Joachim Strmbergson ::1 Assured AB https://github.com/secworks IT security Embedded systems ASIC, FPGA Biometrics Open Crypto Hardware CPU design Assembly hacking Hardware Security

896 views • 50 slides
Collaborative Security Reflections about Security and the Open Internet NLUUG Najaarsconferentie

Collaborative Security Reflections about Security and the Open Internet NLUUG Najaarsconferentie

Collaborative Security Reflections about Security and the Open Internet NLUUG Najaarsconferentie 2015 19 November 2015 www.internetsociety.org Mission: To promote the open development, evolution, f o e c and use of the Internet r u t

547 views • 27 slides
States, borders, and security: export controls in physical space and cyberspace Samuel A. Evans

States, borders, and security: export controls in physical space and cyberspace Samuel A. Evans

States, borders, and security: export controls in physical space and cyberspace Samuel A. Evans 10 January 2011 Stanford University Presentation to the Stanford STS Program in conjunction with CISAC 1 Export Control Primer National

625 views • 25 slides
Open Science Grid Security Activities D. Olson, LBNL OSG Deputy Security Officer For the OSG

Open Science Grid Security Activities D. Olson, LBNL OSG Deputy Security Officer For the OSG

Open Science Grid Security Activities D. Olson, LBNL OSG Deputy Security Officer For the OSG Security Team: M. Altunay, FNAL, OSG Security Officer, D.O., R. Cowles SLAC (past member), J. Basney NCSA (new member), Ron Cudzwicz FNAL, Rob Quick

340 views • 19 slides
DoD Export-Controlled Personal Property and Trade Security Controls IND 105 LESSON 13 DoD

DoD Export-Controlled Personal Property and Trade Security Controls IND 105 LESSON 13 DoD

DoD Export-Controlled Personal Property and Trade Security Controls IND 105 LESSON 13 DoD Export-Controlled Personal Property and Trade Security Controls TLO 13- Given the need to transfer DoD export-controlled personal property to parties

662 views • 29 slides

More recommend