Certification & Accreditation Re-vitalization
Thanks to the newest SANS NewsBites (link will work shortly), I learned of the Certification & Accreditation Re-vitalization Initiative launched by the Chief Information Officer from the office of the Director of National Intelligence. According to this letter from retired Maj Gen Dale Meyerrose, the C&A process is too costly and slow, due to "widely divergent standards and controls, the lack of a robust set of automated tools and reliance upon manual review." He wants to "move from a posture of risk aversion to one of risk management, from a concept of information secuirty at all costs to one of getting the right information to the right people at the right time with some reasonable assurance of timeliness, accuracy, authenticity, security, and a host of other attributes."
That all sounds well and good, but it misses the key problem with C&A -- it doesn't prevent intrusions. It may be seen as a necessary condition for "securing" a system (which is not really possible anyway), but it is in no way sufficient. The forum set up to foster discussion of this initiative contains an insightful thought: Why do we have C&A at all? It's unfortunately that Gen Meyerrose didn't acknowledge that C&A doesn't provide much in the way of "security" at all, but that would admit that .gov and .mil have spent billions to no end. Woops.
That all sounds well and good, but it misses the key problem with C&A -- it doesn't prevent intrusions. It may be seen as a necessary condition for "securing" a system (which is not really possible anyway), but it is in no way sufficient. The forum set up to foster discussion of this initiative contains an insightful thought: Why do we have C&A at all? It's unfortunately that Gen Meyerrose didn't acknowledge that C&A doesn't provide much in the way of "security" at all, but that would admit that .gov and .mil have spent billions to no end. Woops.
Comments
Conceptually, the idea of certification and accreditation does make for better security. The execution of the C&A process, so far, has not be all the effective. At least with the forum, they are trying to enlist better ways to do it.
I've been on the receiving end of C&As for the past 5-6 years now - and all of our systems/networks are much more secure because of them. Among the myriad of items that are looked at, intrusion prevention is one of them. If someone elses C&A didn't include looking at intrusion prevention, see my first sentence.
The other issue I see with C&As is that a lot of folks on the receiving end associate C&As with a visit from the IRS. They should learn do work with the accreditation folks, and not against them. Yes, I know this is sometimes impossible because of manpower issues, but you know what, securing your systems/networks has to be done.
My two cents.
A completed C&A is an approval to operate, but does not mean that you system is secure enough to never have it's CIA compromised. C&A does not mean "Your entire security program is completed for 3 years".
However, far too much time and effort is spent preparing 5+ pounds of paper that is rarely, if ever, read while far too little time and effort is spent actually doing security.
In other words, they are kind of like many CISSP's, they can talk about security but doing security is a whole n'other matter. ;-)
I bet they don't create reams of docs that no one reads...