Security guidelines need a makeover

Say what you mean! If my experience can be extrapolated to the larger community of security professionals, then I would say the connotations of words and lack of clear thinking are large impediments to attacking security issues.

What is risk? What is risk management? Is it different from secure systems management? What are the elements of risk? What is security? What is assurance?

These are a few questions that arise from a comparative reading of the Defense Information Technology Security Certification and Accreditation Process, Defense Information Assurance Certification and Accreditation Process, Director of Central Intelligence Directive 6/3 and National Institute of Standards and Technology Special Publication 800-37.

It seems likely that the first three of those documents would be as useful as the NIST document if the authors were clearer thinkers and better writers. Fundamental policy and procedure documents need careful, thoughtful and skilled authors so that the users of those documents have clear directions.

Anonymous
SAIC

Featured

  • Workforce
    Avril Haines testifies SSCI Jan. 19, 2021

    Haines looks to restore IC workforce morale

    If confirmed, Avril Haines says that one of her top priorities as the Director of National Intelligence will be "institutional" issues, like renewing public trust in the intelligence community and improving workforce morale.

  • Defense
    laptop cloud concept (Andrey Suslov/Shutterstock.com)

    Telework, BYOD and DEOS

    Telework made the idea of bringing your own device a top priority as the Defense Information Systems Agency begins transitioning to a permanent version of the commercial virtual remote environment.

Stay Connected