CISA Releases Cloud Security Technical Reference Architecture

Published on: | by

The Cybersecurity and Infrastructure Security Agency (“CISA”) released the second version of its cloud security Technical Reference Architecture (“TRA”) several months ago. CISA is the country’s cyber defense agency that works with other interagency partners to improve cybersecurity. The purpose of the TRA is to outline the suggested approaches to data protection or cloud migration. The federal government is slowly transitioning to the cloud and the reference architecture is designed to provide guidance. The TRA also explains the considerations for shared services, cloud security posture management, and cloud migration.

It’s important to know how to securely migrate information to the cloud. There are important considerations when transferring information from one database to another one. Data migration can be a multi-faceted process that requires information evaluation. In other words, the information that is being transferred should be categorized based on its sensitivity – e.g., non-confidential, confidential, highly confidential. In that way, the data migration team can implement the necessary safeguards.

President Joseph Biden recently issued Executive Order 14028 called “Improving the Nation’s Cybersecurity” in an effort to support cybersecurity and safeguard critical infrastructures. The key points of the executive order are as follows:

  1. Remove Barriers to Threat Information Sharing Between Government and the Private Sector
    • The Executive Order ensures that Information Technology Service Providers are able to share information with the government and requires them to share certain breach information.
  2. Modernize and Implement Stronger Cybersecurity Standards in the Federal Government
    • The Executive Order helps move the Federal Government to secure cloud services and a zero-trust architecture, and mandates deployment of multifactor authentication and encryption within a specific time period.
  3.  Improve Software Supply Chain Security
    • The Executive Order will improve the security of software by establishing baseline security standards for development of software sold to the government, including requiring developers to maintain greater visibility into their software and making security data publicly available.
    • It also creates a pilot program to create an “energy star” type of label so the government – and the public at large – can quickly determine whether software was developed securely.
  4. Establish a Cyber Safety Review Board
    • The Executive Order establishes a Cyber Safety Review Board, co-chaired by government and private sector leads, with the authority to convene following a significant cyber incident to analyze what happened and make concrete recommendations for improving cybersecurity. This board is modeled after the National Transportation Safety Board, which is used after airplane accidents and other incidents.
  5. Create Standardized Playbook for Responding to Cybersecurity Vulnerabilities and Incidents
    • The Executive Order creates a standardized playbook and set of definitions for cyber vulnerability incident response by federal departments and agencies. The playbook will ensure all federal agencies meet a certain threshold and are prepared to take uniform steps to identify and mitigate a threat and serve as a template for the private sector to use in coordinating response efforts.
    • Improve Detection of Cybersecurity Incidents on Federal Government Networks.
    • The Executive Order improves the ability to detect malicious cyber activity on federal networks by enabling a government-wide endpoint detection and response system and improved information sharing within the Federal Government.
  6.  Improve Investigative and Remediation Capabilities
    • The Executive Order creates cybersecurity event log requirements for federal departments and agencies to improve an organization’s ability to detect intrusions, mitigate those in progress, and determine the extent of an incident after the fact.

You may find more information by visiting https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity. Our law firm manages legal actions related to cybersecurity in state and federal courts. We are ready to assist our clients in matters related to internet, technology, and cybersecurity rules and regulations. Please contact our law firm to speak with an internet attorney at your earliest convenience.