@dianesbaker1 @LongAsUCan2 @RickPetree And this requirement of third party assessors, that is new and may spread to other Departments and Agencies. first real cyber for Defense Contractors was DFARS 7000 series. just finished federal rule making for CMMC program to assess. I'll send the NIST courses. Good stuff
@dianesbaker1 @LongAsUCan2 @RickPetree But again... In terms of FISMA OMB has determined that contractors only responsible for the confidentiality of the assets. NIST-SP-800-171 is subset of controls selected from NIST-SP-800-53 catalog. But hard to be compliant without full security and Risk management program
@dianesbaker1 @LongAsUCan2 @RickPetree Well wrote a few books on subject and wrote an approved curriculum for the DoD to to train third party assessors to assess how people engineer trustworthiness in systems with Gov assets Folks are trying https://www.barnesandnoble.com/w/certified-cmmc-assessor-handbook-j-gregory-mcverry/1144947862
@dianesbaker1 And NIST-SP-800-171 only covers confidentiality. The integrity and availability of your system isn't a worry to the Gov unless it compromises their data. If you are interested in how RMF works in Gov I'll send you some NIST-SP-800-53 classes. Free and good
@dianesbaker1 My state of Connecticut has 3,000 contractors for the Department of Defense alone. How many of billions of endpoints would your ERM have to touch to cover every single contractor that stores, transmits, or processes Gov assets? I don't want the Gov with that access.
@dianesbaker1 What I said their risk based budgeting closer to your idea of universal ERM across Government that would fit within current regulatory environment. And we didn't even mention FedRAMP and Cloud yet. Your solution, IMO, as someone working with ERMs in 171 systems is untenable
@skitzotard @yzy_is_who @tmclaughbos @IwriteOK That's also under the assumption Twitter functions on a good day. The OGP themselves deleted tweet saying they had not verified it. It's unauthorized access to a screen cap of authorization and access (that's somehow an Approve List...)
@dianesbaker1 @LongAsUCan2 @RickPetree As someone who assesses the security of ERM systems, both federal and Non-Federal, that hold Gov assets... You don't want one ERM to rule them all. Crowdstrike Falcon was an EDR you could choose to have in scope. Look what that did. SPOF = bad
@dianesbaker1 @LongAsUCan2 @RickPetree Yes. There is someone in every Federal agency trained in Risk Management. Every project that touches federal data has an FSo You should find what Portman and Peters proposed with risk based budgeting. It got closest to what you want in current legal framework.
@skitzotard @yzy_is_who @tmclaughbos @IwriteOK Accounts break all the time. Never know why your reach is throttled today. Now if someone had an instance of Twitter running locally.. Maybe. But why would you query the OKTA API with plain text over http?
@dianesbaker1 @LongAsUCan2 @RickPetree I know what an ERM is and one ERM for the entire Gov sounds like the worst SPOF ever. And the folks who develop data analytics for Gov become their own risk. Shunned developers worse (Thin thread)
One downfall with having your trust algo stepped on. It's kinda hard for folks to see replies when you explain something you post has not been verified. Guess we gotta couch that problem.
@dianesbaker1 @LongAsUCan2 @RickPetree But to change what you want means rewriting the Constitution. There is no ERM law you can write above the Constitution. The Leo-Barr theory of unitary executive now pervasive in Courts further limits "ERM" each branch can put on the other
@tmclaughbos @yzy_is_who @IwriteOK And legal ain't letting you do this in plain text and regex.... Get outta here.... Lawyers gonna CYA...especially on "allow n**ger" from these accounts. The HTTP is sus AF. Even in local Dev environments with a sandboxed connection you ain't connecting to OKTA
@dianesbaker1 @LongAsUCan2 @RickPetree @CISAgov As any President can. I have no idea if Leo ever had a security clearance. By definition that stuff is not advertised but a President can authorize release of anything to any Tom, Dick, and Harry. It doesn't mean other laws or regulations can be ignored.