Dr. Ron Ross at ISSA about 800-53 Rev 4

I went to the ISSA meeting today and the guest speaker was Dr. Ron Ross.  Liz was there too.  He was quite awesome.  I tried to write down as much as I could and as much as made sense.  He did have a PowerPoint which I will write him and ask for.

Here are some points:

80% of Android devices have a malware on it

95% of Android devices have been tampered with

Quote from Einstein:

Everything should be made as simple as possible - but not any simpler.

Dumbing down...IT is way to complex and crowded; it needs to be simplified.

Strength of mechanism - Build it right.

NASA uses the Integrated Project Team which means all stake holders are available and no project moves forward until all stake holders are satisfied.

How to break down barriers:

-As an example when American car manufacturers wanted to compete with the Japanese, they built rooms and put people on it to do quality control.  It didn't work and made matters worse.  We must face the issues and answer hard questions, and solve using simple and elegant methods.

Strength of IT Infrastructure:

-Simplify

• Reduce and manage the complexity of IT infrastructure
• Use Enterprise Architecture to streamline the IT infrastructure
• Standardize, optimize, consolidate IT assets

-Specialize

• Use guidance in SP 800-53 Rev 4 to customize security plans to support specific mission functions

-Integrate

• Enterprise Architecture
• System Engineering
• System Development Life Cycle
• Acquisition

He also mentioned the 800-160 which I will look into.