MeriTalk - Where America Talks Government
LOGIN:
Sue Allen


Share
Delicious Digg StumbleUpon
View All Entries
Archive
Categories
Popular Tags
Posted: 4/29/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]
Tags: Security

The final public draft of NIST Special Publication 800-53A contains some important changes to improve the efficiency and effectiveness of the document in supporting individuals and organizations conducting assessments of security controls in federal information systems. These changes have been driven by the extensive comments from the public and private sectors during the last public comment period. There were significant differences of opinion from the public respondents regarding preferences for the greater specificity in assessment procedures offered in the second public draft or the greater flexibility in assessment procedures offered in the third public draft. There were compelling arguments made for both approaches.

Posted: 4/29/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]
Tags: Security

The objective of system security planning is to improve protection of information system resources. All federal systems have some level of sensitivity and require protection as part of good management practice. The protection of a system must be documented in a system security plan. The completion of system security plans is a requirement of the Office of Management and Budget (OMB) Circular A-130, “Management of Federal Information Resources,” Appendix III, “Security of Federal Automated Information Resources,” and” Title III of the E-Government Act, entitled the Federal Information Security Management Act (FISMA).The purpose of the system security plan is to provide an overview of the security requirements of the system and describe the controls in place or planned for meeting those requirements. The system security plan also delineates responsibilities and expected behavior of all individuals who access the system. The system security plan should be viewed as documentation of the structured process of planning adequate, cost-effective security protection for a system. It should reflect input from various managers with responsibilities concerning the system, including information owners, the system owner, and the senior agency information security officer (SAISO). Additional information may be included in the basic plan and the structure and format organized according to agency needs, so long as the major sections described in this document are adequately covered and readily identifiable.In order for the plans to adequately reflect the protection of the resources, a senior management official must authorize a system to operate. The authorization of a system to process information, granted by a management official, provides an important quality control. By authorizing processing in a system, the manager accepts its associated risk.Management authorization should be based on an assessment of management, operational, and technical controls. Since the system security plan establishes and documents the security controls, it should form the basis for the authorization, supplemented by the assessment report and the plan of actions and milestones. In addition, a periodic review of controls should also contribute to future authorizations. Re-authorization should occur whenever there is a significant change in processing, but at least every three years.

Posted: 4/29/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]
Tags: Security

The draft revision to Volume I contains the basic guidelines for mapping types of information and information systems to security categories.

Posted: 4/29/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]
Tags: Security

The purpose of this publication is to provide guidelines for the security certification and accreditation of information systems supporting the executive agencies of the federal government.

Posted: 4/29/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]
Tags: Security

The purpose of this publication is to provide guidelines for selecting and specifying security controls for information systems supporting the executive agencies of the federal government. The guidelines apply to all components of an information system that process, store, or transmit federal information.

Posted: 4/29/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]
Tags: Security

FIPS Publication 199 addresses the task to develop standards for categorizing information and information systems. Security categorization standards for information and information systems provide a common framework and understanding for expressing security that, for the federal government, promotes the effective management and oversight of information security programs, including the coordination of information security efforts throughout the civilian, national security, emergency preparedness, homeland security, and law enforcement communities.

Posted: 4/29/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]
Tags: Security

Federal Information Processing Standards 200: Announcing the Standard for Minimum Security Requirements for Federal Information and Information Systems

Posted: 4/29/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]
Tags: Security

The selective application of technological and related procedural safeguards is an important responsibility of every federal organization in providing adequate security in its computer and telecommunication systems. This publication provides a standard that will be used by Federal organizations when these organizations specify that cryptographic-based security systems are to be used to provide protection for sensitive or valuable data. Protection of a cryptographic module within a security system is necessary to maintain the confidentiality and integrity of the information protected by the module. This standard specifies the security requirements that will be satisfied by a cryptographic module. The standard provides four increasing, qualitative levels of security intended to cover a wide range of potential applications and environments. The security requirements cover areas related to the secure design and implementation of a cryptographic module. These areas include cryptographic module specification; cryptographic module ports and interfaces; roles, services, and authentication; finite state model; physical security; operational environment; cryptographic key management; electromagnetic interference/electromagnetic compatibility (EMI/EMC); self-tests; design assurance; and mitigation of other attacks.

Posted: 4/29/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]
Tags: Security

This standard specifies the architecture and technical requirements for a common identification standard for Federal employees and contractors. The overall goal is to achieve appropriate security assurance for multiple applications by efficiently verifying the claimed identity of individuals seeking physical access to Federally controlled government facilities and electronic access to government information systems.The standard contains two major sections. Part one describes the minimum requirements for a Federal personal identity verification system that meets the control and security objectives of Homeland Security Presidential Directive 12, including personal identity proofing, registration, and issuance. Part two provides detailed specifications that will support technical interoperability among PIV systems of Federal departments and agencies. It describes the card elements, system interfaces, and security controls required to securely store, process, and retrieve identity credentials from the card. The physical card characteristics, storage media, and data elements that make up identity credentials are specified in this standard. The interfaces and card architecture for storing and retrieving identity credentials from a smart card are specified in Special Publication 800-73, Interfaces for Personal Identity Verification. Similarly, the interfaces and data formats of biometric information are specified in Special Publication 800-76, Biometric Data Specification for Personal Identity Verification.This standard does not specify access control policies or requirements for Federal departments and agencies.

Posted: 4/29/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]
Tags: Security

NIST announces the release of Draft Special Publication 800-53A, Guide for Assessing the Security Controls in Federal Information Systems. This final public draft provides comprehensive assessment procedures for all security controls in NIST Special Publication 800-53 (as amended) and important guidance for federal agencies in building effective security assessment plans.

Posted: 4/24/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]
Tags: Security

This report finds that on some measures, significant progress has been made in the nation’s preparedness. There are important areas, however, where continued, concertedaction is needed. From assuring an adequate stockpile of pandemic influenza countermeasures to having a public health workforce large enough and trained enough to respond to an emergency, federal and state policies still fall short of their stated goals.

Posted: 4/24/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]

A Report on the Retiring Workforce and the Role of Knowledge Management.

Posted: 4/24/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]

Who and What is Driving SOA Adoption in the Federal Government?

Posted: 4/24/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]
Tags: Health IT

A disaster occurs every week in the U.S., and the numbers are increasing. Yet despite increased federal and state funding since 2001 and lessons learned following 9/11 and natural disasters like large-scale hurricanes and floods, disaster planning in the healthcare arena remains sporadic, disconnected and under-funded. PricewaterhouseCoopers Health Research Institute's (HRI's) Closing the seams analyzes preparedness throughout every key element of our healthcare system, identifies gaps and highlights emerging solutions and innovative best practices that can be leveraged to make the most of our resources and help those in the emergency response and healthcare communities deliver the best healthcare possible in the face of unknown disasters.

Posted: 4/24/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]

Incident Management Software Program Provides a Common Operating PictureEL SEGUNDO, Calif. – November 27, 2007 – NC4, Inc., a leader in situational awareness, incident monitoring, crisis management, and secure collaboration, today announced that Dallas County’s Office of Security and Emergency Management, in conjunction with the Dallas Urban Area Security Initiative (UASI) has deployed E Team to enhance emergency preparedness throughout the region. This deployment allows counties and jurisdictions within the UASI to extend their crisis management capabilities and ensures information-sharing among Emergency Operation Centers (EOCs) throughout North Central Texas.“During a disaster, it is imperative that we move from response to recovery as quickly and seamlessly as possible,” said Robie Robinson, director of security and emergency management, Dallas County, Texas. “To expedite the response/recovery times, we decided to implement a common incident management software program that enables vital information sharing across the region – thus increasing the efficiency and accuracy of threat, incident, and recovery information.”Funded via a Department of Homeland Security grant, Dallas County implemented six locally-hosted systems which work together with a series of Application Service Provider (ASP) implementations to allow the UASI to share critical information in real time. E Team provides users in North Central Texas with a common operational picture through standardized summaries, reports, requests, notifications, directives, and annotated maps, as well as a resource tracking utility.E Team also provides the region with a complete set of Web-based incident management tools such as geographic information system capabilities, instantaneous sorting and prioritizing of critical data, as well as a common framework for information sharing.“E Team empowers cooperation, coordination, and collaboration,” Robinson said. “It has the right functionality, usability, and robust design, all rolled into one easy-to-use platform. It is the right solution for Dallas County and the surrounding areas. E Team allows us to deliver on our mission – to protect citizens from all hazards by providing and coordinating resources, expertise, leadership, and advocacy through a comprehensive, risk-based security and emergency management program of prevention, mitigation, preparedness, response, and recovery.”E Team ConnectConsidering the requirements of smaller organizations that have little to no IT support, NC4 offers the E Team Connect incident management solution – an entry-level version of E Team delivered through the ASP. Affordably priced, E Team Connect provides the necessary modules for incident management and is ideal for agencies with little to no internal information technology support. The solution empowers agencies to share information with surrounding jurisdictions during an area-wide crisis.E Team DemonstrationNC4 will demonstrate E Team and E Team Connect December 3-7 in San Antonio, Texas at the Texas Homeland Security Conference. Sponsored by the Governor’s Division of Emergency Management, the conference is one of the premier training events for emergency management and homeland security professionals in the United States. The Texas Homeland Security Conference provides over 100 workshops and classes on topics such as border operations, technical training, and emergency management. NC4 representatives will be available at booth #407 for demonstrations and interviews.About NC4NC4, through its incident monitoring centers, improves the Situational Awareness to both business and government clients by providing real-time, global, 24x7 proactive incident information and alerts. NC4 issues timely, relevant, and personalized alerts covering incidents near an organization’s key locations that may impact life and safety, physical assets, and continuity of operations. This includes incidents such as transportation, severe weather, hazmat, law enforcement, fire, terrorism, and other incidents that have the potential to cause disruption.Additionally, NC4 provides Situational Response through its E Team offering, which provides sophisticated software and planning tools to enable emergency managers to effectively process the massive amounts of information generated during a major event, crisis, or disaster. E Team’s Windows-based, browser-accessible software has been used for project management during events ranging from 9/11, multiple Olympics, and political conventions to hurricanes and other natural disasters.NC4 also provides Secure Communications and Collaboration through its ESP offerings. ESP is an application service provider that provides government agencies and corporations with a common platform for secure communication and collaboration. ESP provides a thorough security solution for diverse organizations to share Sensitive but Unclassified (SBU) information through highly secure, compartmented, Web-accessible portals. For more information, see www.nc4.us.
Posted: 4/23/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]

Chris Nicolaes Named Senior Vice President for Europe, the Middle East, and AfricaDublin, Ireland. – April 9, 2008 – Cúram Software, the leading provider of Social Enterprise Management (SEM) software solutions, today announced a significant expansion of its worldwide operations with the appointment of Chris Nicolaes as the new senior vice president for Europe, the Middle East, and Africa (EMEA). His appointment underscores Cúram Software’s commitment to expanding its presence in the region to meet the growing demand for commercial-off-the-shelf (COTS) SEM solutions and continued focus on addressing the growing challenges facing social security and social service organizations that provide for the long term welfare of children, people of working age, pensioners, and disabled people and their caregivers. “Cúram Software is focused on continued global growth and delivering leading-edge SEM solutions to customers worldwide,” said John Hearne, chief executive officer, Cúram Software. “Nicolaes’ proven track record of success in the European market combined with his extensive sales and management experience make him the ideal candidate to expand our footprint in EMEA.” As senior vice president of EMEA, Nicolaes will lead Cúram Software’s European operations and the creation of country-based sales and support organizations. Nicolaes will also further expand and manage the sales and partner activities in Cúram Software’s target markets. He will manage the EMEA operation from Cúram Software’s Munich, Germany office. With more than 20 years of experience in the European market, Nicolaes has been instrumental in the growth of multiple international organizations, including Marcam and Gentia Central Europe. He joins Cúram Software from Dassault Systèmes where he was responsible for sales and support as a director for the Central and Eastern European markets. In this role, Nicolaes exceeded profitability targets and established key partnerships throughout the region. Prior to his work with Dassault Systèmes, he was director of business development for EBM Solutions. In this capacity, Nicolaes built and developed the sales and marketing operations as well as assisted the company with its expansion into other countries. Cúram Software’s growth in the EMEA market follows a number of contract awards and growth patterns worldwide. Notable customer implementations include the U.S. state governments of Indiana, New York, and Utah, ACCESS NYC for New York City, as well as the Worker’s Compensation Board of British Columbia, Canada; the Department of Veterans’ Affairs of Australia; and the Ministry of Social Development of New Zealand. SEM is an outcomes-focused category of enterprise software that leverages COTS applications to transform as well as modernize social security and social services agencies, which provide long term care for children, adults, pensioners, and disabled people and their caregivers. SEM provides comprehensive enterprise eligibility IT solutions – crossing agency boundaries, simplifying policies, and integrating with existing technology. SEM fosters holistic, convenient services for citizens as well as provides screening for needs and referrals to state- and community-based resources. About Cúram Software: Cúram Software is the leading provider of Social Enterprise Management (SEM) software solutions, delivering best-in-class applications for social enterprises globally including, health and human services, workforce services, and social security organizations. Using the Cúram Business Application Suite™ agencies can immediately reap the benefits of client-centric business processes and an outcomes-driven integrated service delivery model. The Cúram Business Application Suite, underpinned by the Cúram Enterprise Framework™, combines the advantages of commercial-off-the-shelf (COTS) software, an enterprise platform and service oriented architecture with the business and technical flexibility required to allow agencies to implement solutions to meet their strategic objectives. Cúram Software is headquartered in Dublin, Ireland with additional offices located in New York, Washington, D.C., Germany, United Kingdom, Australia and Bangalore, India. For more information, visit www.curamsoftware.com.
Posted: 4/23/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]

New Releases for Budget Year 2010 Enhance Reporting, Evaluation, and Data Management for CPIC Budgeting and EVM Crystal City, Va., April 21, 2008 – Primavera Systems, Inc., today announced the release of its ProSight Fast Track for Capital Planning and Investment Control (CPIC) Budgeting and Fast Track for Earned Value Investment Analysis (EVIA) solutions for budget year 2010. These Commercial-Off-The-Shelf (COTS) software packages allow agencies to streamline and manage all aspects of the Office of Management and Budget (OMB) Exhibit 300 and 53 development and submission for budget year 2010. The Fast Tracks equip agencies with a collaborative and consistent process for collecting and reporting government-mandated project data as well as evaluating the strength of each program or project – identifying “keepers” vs. weaker business cases.“Influenced by changes in government leadership, priorities, and tactics, Federal reporting requirements seldom remain static,” said Margo Visitacion, industry marketing manager, Primavera. “Primavera develops its Fast Track solutions for specific fiscal years, such as this newest release for budget year 2010, to empower agencies in the prioritization of goals and funding and to streamline the reporting process.” Primavera Fast Track for CPIC Budgeting allows agencies to leverage budget formulation data in the capital planning process. The software is already configured for OMB Exhibit 300 and 53 forms so agencies can begin completing them immediately upon installation. Additionally, the solution provides updates to Exhibit 300 and 53 forms as OMB releases them, enabling agency program managers to achieve OMB compliance throughout the fiscal year. With a built-in submission utility and customizable configuration, the solution virtually eliminates custom report writing and also provides critical insight into business case strengths and weaknesses.Available independently or as an extension to the ProSight Fast Track for CPIC Budgeting solution, the Primavera ProSight Fast Track for EVIA solution automates the collection and reporting of Earned Value Management (EVM) data, allowing agencies to leverage one consistent and centrally-managed process for EVM data collection. When used with the ProSight Fast Track for CPIC Budgeting solution, Fast Track for EVIA also automatically populates the Cost and Schedule section of the OMB Exhibit 300 and consolidates required EVM data in spreadsheet format for submission to OMB. “With Web-based interfaces and customizable scorecards, these solutions provide Federal managers with the information they need, when they need it– ensuring agencies spend less time reporting and more time focusing on areas critical to program success,” said Visitacion.About Primavera ProSightPrimavera ProSight offers world-class enterprise investment management solutions for business and government. These solutions drive planning and control for all types of business or technology investments, deploying objective, auditable processes and metrics, while facilitating collaboration among all stakeholders. ProSight-powered organizations achieve rapid results, including rationalization of current spending, optimization of support for the business, and active governance to obtain the highest possible return on investment. Primavera ProSight solutions are widely used by the U.S. Government for IT Investment Management (ITIM) including CPIC processes and FISMA compliance. Other solutions include large asset portfolio management, research investment management, and capability management within the Department of Defense. About Primavera Primavera is a software company who provides business solutions for a project-driven world. The company helps organizations identify which projects are most important, and makes it easy for people to work collaboratively on those projects and deliver them successfully. Primavera solutions are industry specific and highly scalable, with the power to support global enterprises. Primavera solutions have ensured the success of projects collectively worth more than $6 trillion, including the management of IT projects that span the globe, the complex manufacturing of high tech products, construction of the world’s tallest buildings, ongoing multi-billion dollar oil discovery projects, and space exploration. For more information, visit www.primavera.com or call +1.800.423.0245.
Posted: 4/23/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]

Incident Management Software Program to Serve as a Regional Information-Sharing ToolEL SEGUNDO, Calif. – January 22, 2008 – NC4, Inc., a leader in situational awareness, incident monitoring, crisis management, and secure collaboration, today announced that Hillsborough and Pinellas Counties plan to deploy E Team to enhance emergency preparedness throughout the Tampa Urban Area Security Initiative (UASI). An information-sharing tool, E Team empowers emergency managers in the region to work together in preparation for, and response to, critical incidents, as well as planned and unplanned events. “As the heart of this region, it is important for the City of Tampa to be able to coordinate with our neighboring jurisdictions, as well as prepare for, and respond to, any incident,” said Chauncia Willis, emergency management coordinator, City of Tampa, Fla. “Tampa selected E Team because we required an out-of-the-box emergency management solution that did not need to be assembled or significantly customized, and could be up and running quickly without intensive training. E Team provides efficient communication and collaboration throughout the region, and offers intuitive, Web-based, Incident Command System forms for easy information exchange.”Tampa chose E Team based on its proven history of performance, and ease of implementation, requiring minimal training or IT support. Funded via a Department of Homeland Security grant, Tampa’s self-hosted E Team implementation arms the emergency management team with a complete set of Web-based incident management tools, geographic information system capabilities, and a resource tracking utility. E Team’s common framework ensures Tampa can receive and share information, as well as manage incidents in real time. Recognizing the value of regional information sharing, Hillsborough County, home to Tampa, and its neighbor to the west, Pinellas County, also moved to adopt E Team via the UASI umbrella. “We value E Team’s open architecture – it allows our team to work with the application on a daily basis while keeping the most current data on the system, ready for use during any emergency,” said Sally Bishop, director, Pinellas County Emergency Management. “Pinellas County needed a powerful, user-friendly emergency management system that could also facilitate collaboration within our region. E Team came highly recommended from Tampa and other Emergency Operation Centers (EOCs) in the area, confirming our decision to use the system.”By linking E Team systems, EOCs in Hillsborough and Pinellas Counties can benefit from instant information exchange. Additionally, cities and counties connected through E Team can manage mutual aid agreements, transmit requests for resources, and share meaningful reports with the click of a button. This information is available to all users, allowing them to track incidents and resources every day, as well as in the event of a disaster.“Hillsborough County’s legacy emergency management system lacked the capability to share information with our neighboring jurisdictions, making collaborative response and recovery arduous and time intensive,” said Larry Gispert, director of emergency management, Hillsborough County. “E Team allows us to capture events as they unfold and, importantly, gives us the capability to share, document, and report data. The software makes information sharing among Hillsborough County, the City of Tampa, and Pinellas County effortless  we now have the ability to view and post updated status instantly throughout the region.”E Team DemonstrationNC4 will demonstrate E Team January 29-31 in St. Pete Beach, Fla. at the 2008 Florida Emergency Preparedness Association (FEPA) Conference. The FEPA annual conference provides Florida’s Emergency Management professionals a training opportunity for the purpose of advancing the Emergency Management programs of the State of Florida and its 67 counties in an effort to preserve and protect the quality of life for 16 million Florida residents. NC4 representatives will be available at booth #2 for demonstrations.About NC4NC4, through its incident monitoring centers, improves the Situational Awareness to both business and government clients by providing real-time, global, 24x7 proactive incident information and alerts. NC4 issues timely, relevant, and personalized alerts covering incidents near an organization’s key locations that may impact life and safety, physical assets, and continuity of operations. This includes incidents such as transportation, severe weather, hazmat, law enforcement, fire, terrorism, and other incidents that have the potential to cause disruption.Additionally, NC4 provides Situational Response through its E Team offering, which provides sophisticated software and planning tools to enable emergency managers to effectively process the massive amounts of information generated during a major event, crisis, or disaster. E Team’s Windows-based, browser-accessible software has been used for project management during events ranging from 9/11, multiple Olympics, and political conventions to hurricanes and other natural disasters.NC4 also provides Secure Communications and Collaboration through its ESP offerings. ESP is an application service provider that provides government agencies and corporations with a common platform for secure communication and collaboration. ESP provides a thorough security solution for diverse organizations to share Sensitive but Unclassified (SBU) information through highly secure, compartmented, Web-accessible portals. For more information, see www.nc4.us.
Posted: 4/23/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]
Tags: Security

James Ramskill, Director of IT Strategy & Planning, Office of the Director of National Intelligence provides insight from the top on how to effectively communicate with this “community within a community.”

Posted: 4/23/2008 - 0 comment(s) [ Comment ] - 0 trackback(s) [ Trackback ]

Vern Bettencourt, Deputy Chief Information Officer/G-6, U.S. Army, provides an overview of roles and responsibilities, as well as current and future IT priorities.


« Last Page  |  viewing results 1-20 of 24  |  Next Page »