Top NSA Banner

NSA Part of Consortium of Cybersecurity Experts That Establishes Baseline Standard of Due Care for Cybersecurity--The Top Twenty Most Critical Controls

According to a Press Release dated February 23, 2009 and released by a consortium of federal agencies and private organizations, including NSA, Version 1 of the Consensus Audit Guidelines (CAG) is now available for public review. The guidelines "define the most critical security controls to protect federal and contractor information and information systems." The CAG initiative is part of a larger effort housed at the Center for Strategic and International Studies (CSIS) in Washington, D.C., "to advance key recommendations from the CSIS Commission report on Cybersecurity for the 44th Presidency."

"NSA, DHS, Industry Gang Up on Dangerous Software Errors"
Business Week

"Computer security experts have warned for years that the endless cycle of software flaws and exploits will only be broken when we create incentives for software authors and publishers to get it right. On January 12 (2009), the industry took a potentially important step toward that goal when a broad coalition of companies, government agencies, academics, and advocacy groups launched a program to assure that software is free of 25 common errors that lead to the bulk of security problems." The program was developed jointly by the SANS Institute and MITRE, with backing from the National Security Agency's (NSA's) Information Assurance Directorate (IAD) and the Department of Homeland Security (DHS), the article said.

In SANS Institute's press release of January 12, NSA's Tony Sager commented on the program's significance; "The publication of a list of programming errors that enable cyber espionage and cyber crime is an important first step in managing the vulnerability of our networks and technology. There needs to be a move away from reacting to thousands of individual vulnerabilities, and to focus instead on a relatively small number of software flaws that allow vulnerabilities to occur, each with a general root cause. Such a list allows the targeting of improvements in software development practices, tools, and requirements to manage these problems earlier in the life cycle, where they can be solved on a large scale and cost-effectively."

Secure Mobile Environment Portable Electronic Device (SME PED)

The National Security Agency has developed a hand-held communication device that will revolutionize secure, portable access to classified information. Its technical name is "Secure Mobile Environment Portable Electronic Device" (SME PED) and it enables its users to send and receive both classified and unclassified telephone calls and to exchange classified and unclassified email. In addition, the SME-PED (pronounced "SMEE-PED") enables users to web browse on secure networks that are classified SECRET.

Full article