You do not have Permission to view this Post

You do not have Permission to view this Post

You do not have Permission to view this Post

You do not have Permission to view this Post

PLEASE FIND THE ATTACHED FILE

CLICK HERE TO WATCH VIDEO

You do not have Permission to view this Post

(This measure has not been amended since it was passed by the Senate on December 8, 2014. The summary of that version is repeated here.)

Federal Information Security Modernization Act of 2014 - Amends the Federal Information Security Management Act of 2002 (FISMA) to: (1) reestablish the oversight authority of the Director of the Office of Management and Budget (OMB) with respect to agency information security policies and practices, and (2) set forth authority for the Secretary of Homeland Security (DHS) to administer the implementation of such policies and practices for information systems.

Requires the Secretary to develop and oversee implementation of operational directives requiring agencies to implement the Director's standards and guidelines for safeguarding federal information and systems from a known or reasonably suspected information security threat, vulnerability, or risk. Authorizes the Director to revise or repeal operational directives that are not in accordance with the Director's policies.

Requires the Secretary (currently, the Director) to ensure the operation of the federal information security incident center (FISIC).

CLICK ON LINKS 

WIKIPIDEA ABOUT FISMA

FISMA 2014

Federal Information Security Modernization Act

PII WIKI PIDIA

Personally identifiable information (PII), or sensitive personal information (SPI),^[1][2][3] as used in information security and privacy laws, is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. The abbreviation PII is widely accepted in the US context, but the phrase it abbreviates has four common variants based on personal / personally, and identifiable / identifying. Not all are equivalent, and for legal purposes the effective definitions vary depending on the jurisdiction and the purposes for which the term is being used. (In other countries with privacy protection laws derived from the OECD privacy principles, the term used is more often "personal information", which may be somewhat broader: in Australia's Privacy Act 1988 (Cth) "personal information" also includes information from which the person's identity is "reasonably ascertainable", potentially covering some information not covered by PII.)

SA&A for Federal Agencies

U.S. federal agencies, and contractors operating IT systems on behalf of the federal government, are mandated by the Federal Information Security Management Act (FISMA) to continuously monitor the security risks posed to their infrastructure and to take appropriate actions to mitigate the risks. Security Assessment and Authorization (SA&A) is the process by which federal agencies examine their information technology infrastructure and develop supporting evidence necessary for security assurance accreditation.

DEFENSE IN DEPTH

Defense in depth is the concept of protecting a computer network with a series of defensive mechanisms such that if one mechanism fails, another will already be in place to thwart an attack. Because there are so many potential attackers with such a wide variety of attack methods available, there is no single method for successfully protecting a computer network. Utilizing the strategy of defense in depth will reduce the risk of having a successful and likely very costly attack on a network. This paper will look at three common scenarios for network attacks, likely methods of attack, and countermeasures to protect the network from the attacks. The first scenario is an attack by a script kiddie from the Internet, the second is an attack from a skilled hacker and the final attack is from a trusted user who has access to the network. This paper does not attempt to provide a comprehensive discussion of who attackers are, the methods they use in their attacks, or methods to protect against the attacks. A work of that sort would fill volumes and is obviously far beyond the scope or intention of this essay.