NIST issues new cyber guidelines for contractors

The National Institute of Standards and Technology has issued draft security guidance to help contractors working with high-value assets protect the unclassified (but still sensitive) government data that resides on their networks against advanced persistent threats and other attacks.

A draft version of the guidance lays out 31 new recommendations for contractors, such as implementing dual-authorization access controls for critical or sensitive operations, employing network segmentation where appropriate, deploying deception technologies, establishing or employing threat-hunting teams and a security operations center to continuously monitor system and network activity.

NIST already has basic security guidelines in place for protecting unclassified information on contractor systems, but Ron Ross, a computer scientist at NIST and co-author of the new draft publication, said a series of attacks on the unclassified networks of the defense industrial base in the last 18 months has given China and other nations a windfall of military secrets and technology that has forced Defense Department officials to re-examine contractor cybersecurity requirements to specifically address the threat from foreign governments.

The information stored in nonfederal systems has become "a very valuable target for adversaries, and we absolutely have to be able to stop these cyberattacks on these critical programs or we're going to lose our competitive advantage, we'll lose our military advantage," said Ross.

The recommendations were also crafted under the assumption that such advanced persistent threat hacking groups are resourceful and able to adapt and find alternate pathways into a targeted network no matter what protections are put in place. The guidance was designed to further three interlocking goals: create penetration resistant architecture, facilitate damage limiting operations and create resiliency and survivability in the likely event that such groups are eventually successful.

"We wanted to be able to say what happens when the APT does penetrate our initial defenses," Ross said. "How do we respond to that once they're in the system, how do we limit the damage they can do?"

DOD incorporates the more basic NIST security guidelines in its Defense Federal Acquisition Regulation System supplement, making them mandatory for approximately 65,000 primary and subcontractors who work with DOD. However, the new enhanced guidance is expected to have a narrower impact, as it's designed to be applied on a case-by-case basis to a small fraction of defense contractor systems and programs that have high-value assets or hold critical defense program information.

Fulfilling such requirements can be costly, and low cybersecurity literacy has also contributed to poor compliance rates by industry.

In a 2018 survey of small and mid-sized defense contractors, 45% said they hadn't read NIST's basic guidance on securing controlled unclassified information systems, despite DOD mandating the requirements in 2016. Many of the respondents reported that the NIST document was difficult to understand and had concerns about the costs associated with compliance, sometimes underestimating the price of implementing such protections by as much as a factor of 10.

Implementing all the new enhanced protections against APT threats can be "a heavy lift" financially, but they are still necessary, said Ross.

"The problem is that when you want to stop an adversary throwing their A game at you, you've got to come with you're A-plus game, and that's not easy to do," he said. "It's not cheap, it's not inexpensive to protect these assets, but the downside is losing this critical data, which is priceless in many cases."

The guidance does account for this reality, noting that "nonfederal organizations may not have the necessary organizational structure or resources to satisfy every requirement and may implement alternative, but equally effective security measures to compensate."

The new NIST guidance will go through a public comment and revision period. While a typical NIST publication takes up to a year to finalize and publish, Ross said cybersecurity is such a high priority for DOD and other agencies that they're hoping to cut that timeline in half and publish a final version within the next six months.

This article was first posted to FCW.