Federal Information Security Management Act of 2002

It's the CISO who owns that.

Now, if they don't get exploited, it may come up during a FISMA audit.

As someone who has done FISMA audits in the past, I don't necessarily know if a obscure SharePoint vulnerability is going to bubble to the surface enough to warrant you know the executive report of a fisma audit but but the tldr is if it gets exploited that's when you're running uh you're you're gonna be it's a resume generating event essentially okay so consider that update binding operational directive all right bruising hacks very very strongly stating its binding operational directive get it right jerry is effectively what all caps means to me

details and doubts emerge regarding open ai hack of australian health portal oh gosh This is a follow-up to a story we covered on Friday regarding claims that an OpenAI agent hacked an Australian government Medicare statistics portal in June.

Australian officials, including the Prime Minister Anthony Albanese, said the agent bypassed access controls and reached non-public files, although no personal Medicare information was accessed.

But a more meaningful solution would be to take those skills that you've developed and then apply them in a project that you can disclose publicly.

A very simple one that I always like to say is like, Say you're going to do a risk assessment, like a NIST 853 moderate baseline, full top-down FISMA audit with a risk assessment and a polium afterwards.

You can do that on your home network, right? And I know you're like, oh, that sounds lame.

Dude, you have a wireless network likely in your environment.

So what, uh, like who owns that proof? What are the proofs that you need? So regulatory pressures is one thing that, uh, keeps you on your toes to be compliant.

If I talk about the regulatory pressures like FISMA, GDPR, HIPAA, UAI Act, CMMC, lots of other regulations as well.

Again, regulation is providing the pressure on the organizations, but audit is something that is coming from long time.

We hear about audit every day in organizations.

Like you see, it is not only NIST.

They are talking about COBIT also.

They are talking about ISO 7001, 27002, 3100, FISMA, GDPR, HIPAA, STLC.

In the domain three, they talk about the audit planning penetration testing risk response then again pom pom is is is the heart of of this uh why

Let's make sure that it's still utilized.

We do a system census every year where there's a call and response to every business unit for every FISMA system that we have and all the components that are part of that FISMA system.

So in addition to what the tools are telling us, let's make sure that we have some street level Intel that people can share.

And I think again, that, that having some legislation kind of backing us up saying, yes, this is important.

and then provide you with detailed information on exactly what you need to do to fix it.

And also map that information back to a variety of compliance standards so you can see how am I doing in terms of 853, FISMA? How am I doing in terms of PCI? We use it all as evidence to drive that.

Yeah, I think just from my perspective, right, we've all been doing security for a very long time.

I think that the two main categories of what I would call security events or meaningful security events, you know, in the red, yellow, greens, these are the reds, they fall into exactly two categories.

Is this system in the same state it was yesterday? Yes or no? That's it.

Then it gets more complex than that.

Is it exactly how I expect? And I think that's the intent with the, say, 853 FISMA.

It has a section there, SI, for system integrity, that really says that you must have this baseline, this authoritative baseline, and measure the integrity of your systems.