The National Security Agency and the Cybersecurity and Infrastructure Security Agency have issued an Enduring Security Framework seeking to strengthen U.S. leadership in crafting international standards that the agencies foresee will impact the technology sector’s security in the future. 

The ESF report, which pursues the agencies’ respective cybersecurity missions, recommends four action steps, including establishing the U.S. as a choice venue for standards development conferences and prompt engagement in critical emerging technology standards.    

The 22-page report also suggests the development of a more standards-savvy labor force and tapping academia to raise the next generation of standards development professionals. 

The ESF Industry Specifications Group’s working panel, a public-private sector team led by NSA and CISA personnel, developed the report.  

Atiya Yearwood, the NSA Cybersecurity Collaboration Center’s deputy chief, noted that such technologies as quantum computing and artificial intelligence are rapidly evolving, which requires careful and secure development. 

“So we need U.S. industry to continue the tradition of strong leadership from the beginning phase of standards development,” she said.

The National Institute of Standards and Technology has issued the final version of its Cloud Computing Forensic Reference Architecture designed to enable the rapid data collection of evidence in cloud computing environments at minimal investigation costs.

The 31-page document, filed as NIST Special Publication 800-201, pinpoints and addresses the challenges of cloud forensics, including information integrity and privacy issues in the data collection process. 

The publication builds upon the 62 cloud-related forensic challenges enumerated in a NIST report issued in August 2020.         

To help users understand the cloud computing forensic process, the guidebook provides a reference architecture identifying the challenges that require mitigation strategies and recommending ways to apply the approaches.    

The reference guide works as a methodology and an initial implementation step useful for cloud system professionals, forensic investigators and cloud consumers to check the forensic readiness of their cloud computing architectures.

NIST encourages users to customize the guidebook’s implementation based on their specific conditions and requirements. 

The NIST Cloud Computing Forensic Science Working Group performed the research for the cloud computing forensic reference. 

The Federal Risk and Authorization Management Program has started seeking public comments on a proposed set of key performance metrics designed to measure the end-to-end FedRAMP authorization experience and align with its mission of being a security-first program.

FedRAMP said Tuesday it is asking cloud service providers, third-party assessment organizations and other stakeholders to state the most important metrics for assessing the effectiveness and efficiency of the program’s process.

The program also wants to know the types of information that would help manage expectations and improve the customer experience during the FedRAMP authorization process and what role FedRAMP could play in helping define success regarding timeliness and cost effectiveness of the authorization process where the program is not involved in every phase of the process.

With the program’s evolving landscape, FedRAMP intends to reassess metrics each year to facilitate updates and use the Government Risk and Compliance platform buildout to inform future metrics.

Comments on the proposed metrics are due Aug. 29.

In late March, FedRAMP launched a new roadmap outlining its four strategic goals, including orienting around the customer experience and positioning the program as a leader in cybersecurity and risk management.