The National Institute of Standards and Technology has finalized changes to its catalog of security and privacy controls to help improve the security of software updates and patches.
NIST said Wednesday the revised Special Publication 800-53, Security and Privacy Controls for Information Systems and Organizations, was issued in response to an executive order aimed at strengthening U.S. cybersecurity.
“The changes are intended to emphasize secure software development practices, and to help organizations understand their role in ensuring the security of the software on their systems,” said Victoria Pillitteri, a computer scientist at NIST who led the project. “Ultimately, we want to help them achieve their goals while minimizing the risk of a patch creating unintended consequences.”
NIST’s Revised Security & Privacy Control Catalog
The modifications to NIST’s SP 800-53 address developer testing; software and system resiliency by design; software integrity and validation; and deployment and management of updates.
The updated version of NIST’s catalog of security and privacy safeguards, SP 800-53 Rev. 5.2.0, features three new controls: logging syntax, root cause analysis and design for cyber resiliency.
The catalog’s Logging Syntax (SA-15), for instance, defines an electronic format for recording security-related events to improve incident response.
“The updated controls emphasize the importance of monitoring the particular component being updated as well as the component’s relationship to the overall system,” Pillitteri said.
NIST has implemented a new public engagement process and started offering updates to the control catalog through the Cybersecurity and Privacy Reference Tool.
