The chapter had the opportunity to feature Dave Hall from Nova Management as the February luncheon speaker. Hall is a 30-year veteran of the U.S. Air Force and has experience with NASA, the Department of Commerce, the Missile Defense Agency, as well as numerous state and local agencies. An expert in risk management, Hall also holds the International Information System Security Certification Consortium Inc., (ISC)² sought after Certified Information Security Systems Professional (CISSP) certification. Hall discussed the Risk Management Framework (RMF) and its impending impact on the Department of Defense (DoD). In particular, how Industrial Control Systems (ICS) and Platform IT (PIT) will be affected. Industrial Control Systems are computer systems that control something in the physical world. A wastewater management plant is one example of an ICS. ICSs in the plant control the physical opening and closing of valves based upon sensor input and system programming. It isn't hard to imagine what could happen if one were compromised by a hacker. An example of Platform IT would be a missile system bolted to an assault vehicle. Hall explained that purveyors of these systems have not been as exposed to the administrative overhead and compliance tasks many IT professionals are familiar with in other areas of information technology, often due to the inability of previous accreditation methods to address them. RMF does not possess that shortcoming. Hall also expressed that the DoD recommends a professional partner with experience, an integrator, to assist PIT/ICS owners with the transition to Risk Management Framework. Hall pointed out that DoD 8500.01 (DoD Cybersecurity Instruction) references 132 policy documents as evidence that the DoD still has steps to take before a cohesive cybersecurity standard is reached within the DoD. However, the reciprocal nature of RMF is a good start. In this era of DoD coalition force expectations and ever limited funding, reciprocation between branches is of paramount importance if not a requirement for maintaining global operations. |
