7 ways government is working to improve FedRAMP

  Five new tiger teams of representatives from across government are working to improve the Federal Risk Authorization and Management Program (FedRAMP) based on feedback submitted during the public comment process, the General Services Administration’s David McClure told attendees today at a symposium on high-performance cloud computing in Washington, D.C.

McClure provided a short list of concerns that GSA and government partners are working on to improve FedRAMP and sought to dispel myths about the security accreditation and authorization program designed to vet cloud providers and services.

There are still some misunderstandings surrounding FedRAMP, said McClure, associate administrator with GSA’s Office of Citizen Services and Innovative Technologies.

A big myth is that with FedRAMP the government is “blowing up [the Federal Information Security Management Act] and completely redesigning the security approach to the federal government,” McClure said during the symposium sponsored by AFCEA's Bethesda chapter at the Willard InterContinental Hotel.

Instead, FedRAMP’s “focus is to improve the security accreditation process by using an approach that can be vetted and reused across the government,” McClure said. The goal is to implement it once, use it many times and bring some consistency to how this is being done. Hopefully, this also will lower the cost for the security process, he said.

Related Coverage:

GSA fast tracks requirements for FedRAMP

GSA released a draft version of FedRAMP security controls in October 2010 with the intention of issuing the first version by the end of December. However, after reviewing public comments, federal CIO Vivek Kundra, GSA and other officials decided to step back and make sure that critical issues were properly addressed. In fact, GSA extended public comments to January 2011.

“We could have issued FedRAMP Version 1," McClure said. "It would have been OK but would not have resolved critical issues in the security process."

FedRAMP is now slated for release by the end of the summer.

Cloud computing, an on-demand model that allows access to shared computing resources, does introduce some unique security requirements. So the government is looking at FISMA and the National Institute of Standards and Technology security series 800 guidelines to determine what applies in the cloud and the different cloud delivery models, which include infrastructure as a service, software as a service and platform as a service.

“So we have assembled five new tiger teams comprised of representatives from all around government” to address industry and others concerns about FedRAMP, McClure said, noting another myth-buster: that FedRAMP is not a GSA process. It is governmentwide and community-driven, he said. Agencies contributing to the process include the Defense and Homeland Security departments, the Federal CIO Council, NIST, the National Security Agency and, at times, the intelligence community. Industry has regularly been brought in as well.

Thousands of comments were submitted, but here is a short list of areas the government is working on to improve FedRAMP:

1. Too many controls and controls for different risk levels.

The government is working to reduce the number of security controls that will be tested. GSA and others cannot eliminate all controls because many are stringent and necessary to secure government computers. However, the government is trying to differentiate between controls at the low-, medium- and high-risk levels – all of the objectives of FISMA but right now these are blurred. Right now, the focus is on all security on or all security off. That has to change, McClure said.

2. More guidance on third-party assessors’ independence.

Who assesses the cloud provider? Some service providers pick the organizations that assess them and then provide reports to the government. This is equivalent to someone picking his or her own home improvement inspector whentrying to sell a house, McClure said. There are options such as having government entities do the assessment. The government is exploring a NIST suggestion to come up with a model similar to consumer product testing or the standards health area where there is an accreditation board. This world-class board would have the independence to approve a set of accredited assessors, McClure said.

3. Continuous monitoring raises data concerns.

FedRAMP is moving toward a continuous monitoring approach, which focuses on the availability of real-time data about a system’s security posture. For a cloud provider the question is, “Do you want to give up that data for continuous monitoring?” McClure said. Often that data contains very sensitive information.

4. What is the role of the Joint Authorization Board?

The Joint Authorization Board consists of the Defense and Homeland Security departments, GSA and a sponsoring agency looking for accreditation for the cloud provider coming together to certify an Authorization to Operate. How does that work? Does the JAB have or want the authority governmentwide? Does it have the ability legally to grant authority for another agency? “We are working that out [now] and there are ways to solve” these issues, McClure said.

5. What will be the role of government security operation centers?

A big question is about where the monitoring data goes on a regular basis. “Do we create a new bureaucracy, a security operating center in one place where everything is fed into?” McClure asked, or should the government use existing security operation centers? This is another area that the government is working on, he said, adding that the government is not trying to create bureaucracy or another chokepoint for everything being used.

6. How does the government ensure that FedRAMP is complaint with the Trusted Internet Connection?

TIC is an Office of Management and Budget initiative to reduce the number external communication and Internet points of connections within agencies. This is another sensitive issue, McClure said.

7. What are the different security controls for the different cloud delivery models – IaaS, PaaS and SaaS?

“Aren’t there differences in these cloud services that warrant different types of controls and assessment?"
McClure said. These are things that have been worked out better in the second round.

"These are just minor things, right?" McClure joked.

The bottom line: FedRAMP is trying to produce a security baseline in a transparent fashion, McClure said. “If we do not have transparency and trust in this environment, it will not work."