NIST releases draft of security framework

Share this article:

The National Institute of Standards and Technology (NIST) has released a preliminary cyber security draft framework (PDF) in support of President Obama's "Improving Critical Infrastructure Cybersecurity" executive order issued in February.

"The focus of the framework is to support the improvement of cyber security for the nation's critical infrastructure using industry-known standards and best practices," according to the draft. "The framework, developed in collaboration with industry, provides guidance to an organization on managing cyber security risk, in a manner similar to financial, safety, and operational risk."

The voluntary framework is comprised of three main components: core, tiers and profiler, which provide a "strategic" view of an organization's management of risk and offers assessments and goals.

The framework is designed to complement an organization's existing security management program and not replace it.

Discussions are scheduled for September, with NIST planning to release a full draft in October and a final version by February.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

VBA malware on rise, templates make it easier to write code

VBA malware on rise, templates make it easier ...

Researchers at SophosLabs found an uptick in VBA samples in July.

Analysts spot 'Critolock,' ransomware claims to be CryptoLocker

Trend Micro noted several differences between Critolock and CryptoLocker, however.

Citadel used in APT attacks against petrochemical firms

Citadel used in APT attacks against petrochemical firms

In an interesting twist, financial malware Citadel was used to infect firms outside of the finance sector via APT attacks, Trusteer found.