Government Information Security Podcast

FISMA Reporting Moves to 21st Century.

Please listen to this overview, and check out all of the week's news and views on GovInfoSecurity.com.

Add the term FedRAMP to the federal government lexicon; it's a program under development that could ease the adoption by agencies of new information technologies and services , including cloud computing, provided by vendors, service providers and other agencies.

The governmentwide initiative - officially the Federal Risk and Authorization Management Program - would provide joint authorizations and continuous security monitoring of shared IT services for federal departments and agencies that enter contracts with outside providers, including those offering cloud computing solutions.

Peter Mell, vice chairman of the federal Cloud Computing Advisory Council vice chairman and a force behind the creation of FedRAMP, explains in an interview with GovInfoSecurity.com how FedRAMP:

"We want to reduce duplication of effort, reduce costs, increase security and we believe we can do that through this unified, risk management program," says Mull, who also is a senior computer scientists at the National Institute of Standards and Technology and had led NIST's cloud computing research efforts. "Agencies, by leveraging FedRAMP authorization, will save a lot of money and enable rapid acquisition but they're still in control. They get to choose whether or not they leverage it. They can chose if they want to do additional work to assure systems meet the security needs of their agency."

GovInfoSecurity.com's Eric Chabrow interviewed Mell.

How vulnerable are organizations to cyber attack? It depends on your definition of "vulnerable," says Robert Richardson, Director of the Computer Security Institute (CSI). "There's vulnerable," he says, "and then there's likely to be attacked."

Social media aren't just coming - they're here. And senior leaders need to understand how to maximize Facebook, LinkedIn, Twitter and other popular sites, as well as how to protect their organizations from very real security risks.

In an exclusive interview, Prof. Sree Sreenivasan, Dean of Student Affairs at the Columbia Graduate School of Journalism, discusses:

Sreenivasan is a technology expert and dean of student affairs at the Journalism School, where he teaches in the digital journalism program. He specializes in explaining technology to consumers/readers/viewers/users. For more than eight years, he served as technology reporter for WABC-TV and WNBC-TV in NYC and now occasionally appears on various TV shows to talk tech. For more than six years, he wrote a Web Tips column for Poynter.org. He has written articles for The New York Times, BusinessWeek, Rolling Stone, National Journal, Bloomberg, Forbes, and Popular Science. In March 2004, Newsweek magazine named him one of the nation's 20 most influential South Asians; and in 2009, AdAge named him "one of 25 media people to follow on Twitter." You can find him on Twitter and his Twitter Guide for Newbies and Skeptics.

Organizations have made strides in business continuity/disaster recovery (BC/DR) planning. But BC/DR professionals need to sharpen their business skills to truly protect their organizations.

This is the stance taken by Roberta Witty, research VP at Gartner. In an exclusive interview, Witty offers candid insight on:

Witty is part of the Compliance, Risk and Leadership group within Gartner. Her primary area of focus is business continuity management and disaster recovery. She is the role specialty lead for the Gartner for IT Leaders (GITL) business continuity manager role. She is also a GITL Premier coach for Security and Risk.

Prior to joining Gartner, Witty managed the global technology risk management function for the corporate trust business of The Chase Manhattan Bank. In this role, she was responsible for awareness, advisory and compliance services regarding the business implementation of IT control policies, including information security, business continuity and Y2K business resumption planning. Before joining Chase, she was the information security officer for ING/New York, where her responsibilities included information security program development and implementation, security administration, and business continuity planning.

Everyone is talking about cloud computing these days - but are they having the right conversations?

H. Peet Rapp is an information security auditor who sits on ISACA's Cloud Computing Work Group, and he's co-author of the white paper Cloud Computing: Business Benefits With Security, Governance and Assurance Perspectives.

In an exclusive interview, Rapp discusses:

Rapp entered the IT audit/compliance profession in 2003, after publishing the widely read paper "An IT Executive's Overview of the Sarbanes-Oxley Act of 2002." With his firm, Rapp Consulting, he has audited, provided risk assessments and developed IT control frameworks for more than 70 organizations and developed a reduced IT control set for non-accelerated filers.

The topic has been discussed for years, but now truly is the time for organizations to invest in federated identity management.

So says Tom Smedinghoff, partner at Chicago-based law firm Wildman Harrold. In an exclusive interview, Smedinghoff discusses:

Smedinghoff is a partner at Wildman Harrold, where his practice focuses on the new legal issues relating to the developing field of information law and electronic business activities. He is internationally recognized for his leadership in addressing emerging legal issues regarding electronic transactions, information security, and digital signature authentication issues from both a transactional and public policy perspective. He has been retained to structure and implement e-commerce, identity management and information security legal infrastructures for the federal government, and national and international businesses including banks, insurance companies, investment companies, and certification authorities. He also frequently counsels clients on the law relating to first-of-their-kind electronic transactions, privacy,4 information security legal matters, and e-commerce initiatives. At the same time, he has been actively involved in developing legislation and public policy in the area of electronic business at the state, national, and international levels.