Events

• October 26-29, 2009:
  5th Annual IT Security Automation Conference
   
  Register online now at: http://scap.nist.gov/events
  Technical contact Kevin Stine, kevin.stine@nist.gov.
  This conference will focus on emerging automated security technologies designed in support of healthcare IT/HIPAA; how security automation tools and technologies can ease the technical burdens of policy compliance and how the rapidly evolving cloud computing sector can integrate security automation to achieve significant benefits. A separate message was sent to the FISMA list on September 15th with more details.
   
• November 12, 2009
  Risk Management: An Organizational Perspective
   
  Pilot Course Announcement Risk Management: An Organizational Perspective to be held at NIST on November 12, 2009. This course is limited to 20 and the POC is Patricia Toth, patricia.toth@nist.gov. For this pilot course, we are looking for people with limited experience in the security field and who are new to the implementation of the Risk Management Framework to audit the course and provide feedback. The goal of this course is to provide an overview of a methodology for managing organizational risk – the Risk Management Framework (RMF). The RMF was developed by NIST to help organizations manage the risks of operating information systems more easily, efficiently and effectively. This course describes at a high level the importance of establishing an organization-wide risk management program, the information security legislation related to organizational risk management, the steps in the RMF, key roles, and the NIST publications related to each step. The course will be offered again. Dates TBD
   
  
• December 7-11, 2009
  25th Annual Computer Security Applications Conference (Honolulu, HI)
   
  NIST will present FISMA training sessions at the 25th Annual Computer Security Applications Conference in Honolulu, HI in December. Track D will focus on FISMA training and the newly-released NIST 800 guidelines. Dr. Ron Ross will present on Cyber Security Controls: NIST SP800-53 Rev 3 and CNSS 1253 and Near Real-Time Risk Management Process: NIST SP800-37. Patricia Toth will present a Risk Management: An Organizational Perspective. The ACSAC 2009 Conference will be held December 7-11, 2009 at the Sheraton Waikiki Hotel. The registration link is http://www.acsac.org/2009/registration/

Many federal and state agencies have their own Computer Security Days using speakers from the NIST Computer Security Division (CSD). The CSD groups include the Security Management & Assurance Group (now including the Cryptographic Module Validation Program & Cryptographic Algorithm Validation Program), Cryptographic Technology Group, and the Systems & Emerging Technologies Security Research Group. Please contact the individual group managers directly for speaker recommendations. However, if you are interested in having a speaker from NIST on the FISMA Implementation Project, please contact sec-cert@nist.gov. The NIST CSD Computer Security Resource Center website, (http://csrc.nist.gov/) includes contact information for CSD group managers under Staff.