Posts RSS
Subscribe via Email
Clouds of CAG Confusion
Posted February 26th, 2009 by DanPhilpott
Did you know that the US Department of Defense published the Consensus Audit Guidelines? Yes, it’s true! At least according to a ZDNet UK article title, “US Dept of Defense lists top 20 security controls“.
There is a haze of confusion settling around the Consensus Audit Guidelines origins. The text of the CAG press release (pdf) is clear that it is developed by a consortium of federal agencies and private organizations. It further states CAG is part of the Center for Strategic and International Studies work on CSIS Commission report on Cybersecurity for the 44th Presidency. The title of the CAG press release is also equally clear that it is from a “Consortium of US Federal Cybersecurity Experts” which is substantively different than a consortium of federal agencies and private organizations.
The press release relates that CAG was initiated when a team discovered similarities between massive data losses by the US defense industrial base (DIB) and attacks on Federal agencies. The project then grew as more agencies agreed to become involved. Following the current public review of CAG the next steps for development are listed as pilot implementations at government agencies, a CIO Council review and an IG review. The clear inference of this origin story and ennumeration of steps is that the project has official Federal backing.
Let’s test that inference. Click here for a Google search of the entire *.gov hierarchy for “Consensus Audit Guidelines”. As I write this there is exactly one entry. From oregon.gov. A search using usa.gov (which uses live.com) has the same results. Looking around the various organizations listed as contributors doesn’t yield any official announcements.
So why the confusion in the press? Why does it appear from the news articles that this is an Federal project? I wouldn’t speculate.
On a slightly different topic, I’ve been reading through the Consensus Audit Guidelines themselves and enjoying the guidance it provides. I’ll write up a more complete analysis of it once I have finished my read through. My initial impression is that CAG controls provide worthwhile recommendations but the framework for implementation needs development.
All Aboard the Astroturfmobile photo by andydr. Perhaps an explanation is in order….
Similar Posts:
Posted in Technical, What Doesn't Work | 
7 Comments »
Tags: cag • fisma • government • infosec • itsatrap • pwnage • risk • security
February 26th, 2009 at 5:08 pm
Well, my guess is that PR for it was done by true retards as the message was so fuzzy.
Is it by SANS? By US govt? Group of experts? Group of govt agencies?
On the flip side, the kittens worked (http://www.guerilla-ciso.com/archives/783) 🙂
February 26th, 2009 at 5:37 pm
Hi Anton
If you want to buy into a conspiracy theory of mine, the PR was intentionally incompetent so that the press would pick up the guidelines as being legitimate. It was just *that* bad.
I also harbor a suspicion that the agencies listed didn’t actually help out drafting the guidelines but that the people who wrote the guidelines might have at one point worked at those agencies.
For people who want to cut through the BS to deliver something that gets rid of the “misdirection, fraud, waste, and abuse of FISMA”, they sure are going about it the wrong way.
I’ll go put on my tinfoil hat now, k thnx bai. =)
February 26th, 2009 at 7:06 pm
“I also harbor a suspicion that the agencies listed didn’t actually help out drafting the guidelines”
Huh? You can that “suspicion”
Congrats! You win The Understatement of the Year 2009 Award!
February 26th, 2009 at 8:05 pm
I exchanged emails with John Gilligan who heads the CAG project. I asked him whether CAG was an authorized publication by anyone in the Government and whether any of the agencies listed had a position supporting CAG. He reported that the effort was not formally supported by the Government.
The response didn’t come in until after I submitted the post which is why this wasn’t mentioned.
I have an email to him now asking what license the CAG is offered under. I’d like to contribute back some comments on the controls but don’t want to spend too much time doing a close analysis and developing detailed comments to contribute if the consensus is closed source. I’ll post a more general analysis here in a few days.
February 27th, 2009 at 8:55 pm
OMG… so this is kinda “a rogue” or grass-roots project. I see.
Please post your analysis; if this is not consensus, but “secret team effort” than we can just watch it die, despite all its possible merits…
June 9th, 2009 at 6:11 pm
[…] CISO comments in LOLCats format. He also says “My initial impression is that CAG controls provide worthwhile recommendations but the […]
June 6th, 2010 at 7:14 pm
[…] so its redundant if you’re already doing that. Guerilla CISO comments in LOLCats format. He also says “My initial impression is that CAG controls provide worthwhile recommendations but the […]