NIST Updates Cybersecurity Framework

Major updates to NIST's Cybersecurity Framework (CSF) are underway, with the new CSF 2.0 expected in 2024.

"Based on stakeholder feedback, in order to reflect the ever-evolving cybersecurity landscape and to help organizations more easily and effectively manage cybersecurity risk, NIST is planning a new, more significant update to the framework: CSF 2.0," NIST says. The framework was initially produced in 2014 and updated to CSF 1.1 in 2018.

NIST plans to seek stakeholder feedback throughout the process, and a discussion draft is now available for review (https://www.nist.gov/system/files/documents/2023/04/24/NIST%20Cybersecurity%20Framework%202.0%20Core%20Discussion%20Draft%204-2023%20final.pdf). "The modifications from CSF 1.1 are intended to increase clarity, ensure a consistent level of abstraction, address changes in technologies and risks, and improve alignment with national and international cybersecurity standards and practices," according to the draft document.

Check out NIST's Journey to CSF 2.0 website (https://www.nist.gov/cyberframework/updating-nist-cybersecurity-framework-journey-csf-20) for the proposed timeline and other information.

Poor Cloud Security Practices Put Organizations at Risk

Many organizations are failing to implement basic cloud security practices and address known vulnerabilities in a timely fashion, according to a new report from Palo Alto Networks' Unit 42.

The Unit 42 Cloud Threat Report , Volume 7 (https://unit42.paloaltonetworks.com/cloud-threat-report-expanding-attack-surface/), details issues observed in thousands of multi-cloud environments, noting that these "gaps in security are getting more attention from threat actors."

Findings from the report include:

• Security teams take approximately six days on average to resolve a security alert.
• Sixty percent of organizations take more than four days to resolve security issues.
• Eighty percent of alerts in most cloud environments are triggered by just five percent of security rules.
• Seventy-six percent of organizations don't enforce multi-factor authentication (MFA) for console users, while 58 percent don't enforce MFA for root/admin users.
• Sensitive data was found in more than half of publicly exposed storage buckets.

"For threat actors, each workload in the cloud presents an opportunity, and without proper management, organizations are exposed to risk in countless ways," the report says.

ORNL and NOAA Launch New Supercomputer for Climate Research

Oak Ridge National Laboratory (ORNL) has partnered with the National Oceanic and Atmospheric Administration (NOAA) to launch a new supercomputer dedicated to climate science research, which will be one of three NOAA computers operating at ORNL.

The new system, called C5, is an HPE Cray machine with more than 10 petaflops (or 10 million billion calculations per second) of peak theoretical performance, which is almost double the power of the two previous systems combined, says the announcement (https://cleantechnica.com/2023/04/12/new-supercomputer-for-climate-science/).

The goal of the partnership is to increase NOAA's climate modeling capabilities to advance critical research.