Stepping out. A consortium of security companies joined Amazon last month to announce the formation of the Open Cybersecurity Schema Framework (OCSF), an open-source approach to dealing with cybersecurity issues they hope to model as a framework for the industry going forward.

The project includes “an open specification for the normalization of security telemetry across a wide range of security products and services, as well as open-source tools that support and accelerate the use of the OCSF schema,” Amazon Web Service VP of Security Jon Ramsey and Chief Information Security Officer Director Mark Ryland said in a statement announcing the initiative.

Analysts and CEOs at cybersecurity firms both inside and outside the consortium polled by Protocol called the initiative “a great direction” and a “stepping stone” to greater resistance to cyberthreats down the line. Respondents were asked what they thought success would look like, and most cited operability and adoption as the main drivers of what the OCSF should look like in a year.

“The interexchange of data enables better security outcomes,” said Dr. Robert Blumofe, EVP and chief technology officer at Akamai, which was not a member of the OCSF launch consortium. “We are hopeful that OCSF will facilitate this interexchange.”

Adaptation. But not everyone is as bullish on the new open-source cybersecurity framework’s future. Steve Benton, VP of threat research at cybersecurity company Anomali, told SDXCentral late last month that he had doubts OCSF could transition the “hype” around the project to reality. The OCSF, as a project of AWS, will present a framework that other companies will need to adapt to, given the position of AWS in running the web.

Read the rest here.—EH

Do you work in IT or have information about your IT department you want to share? Email [email protected] or DM @EoinHiggins_ on Twitter.

A government agency can’t just use any ol’ cloud service.

The Department of Defense or Veterans Affairs, or NASA, has highly sensitive data after all, and cloud providers wanting government clients must prove the security of their services.

That’s where FedRAMP comes in.

Real quick, What’s FedRAMP? Since its inception in 2011, the Federal Risk and Authorization Management Program, or FedRAMP, provides standards and requirements for cloud-based tools used by the government—a framework that is slowly evolving to address large-scale, thorny threats like supply-chain attacks.

FedRAMP leverages National Institute of Standards and Technology (NIST) standards and guidelines. Before FedRAMP, each agency had its own approval process when it came to adopting certain security frameworks. Once certified, a FedRAMP-ified cloud service can be used across multiple agencies.

FedRAMP’s guiding principle is reuse: “Do once, use many times,” said Brian Conrad, acting director of FedRAMP, in an email to IT Brew. “This is to promote and enable the federal government to accelerate the adoption of cloud computing by creating transparent standards and processes for security authorizations to allow agencies to leverage security authorizations on a government-wide scale.”

Level up: Certification levels—low, moderate, and high—vary based on the critical nature of the information being held.

Join the club: There are 280 commercial cloud services that have a FedRAMP authorization, and over 4,500 instances of reuse of those authorized services, according to Conrad.

Dark clouds: Cloud services can introduce additional risks if software supply-chain components are compromised. (Just look at a September 2021 report from Palo Alto Networks that found a lot of insecure configurations in the third-party code templates of cloud infrastructures.)

Read more here.—BH

Do you work in IT or have information about your IT department you want to share? Email [email protected] or DM @BillyHurls on Twitter.

Today’s top IT reads.

Stat: 99%. That’s the reduction in energy consumption expected from Ethereum’s “merge,” which eliminates the need to mine cryptocurrency. (the New York Times)

Quote: “We want to create a new tier of computational storage, where it supports massive data sizes but is also very much searchable and computable.”—Catalog CEO Hyunjun Park, whose DNA-based storage company is collaborating with data storage company Seagate (Ars Technica)

Read: The Apple Watch Series 8 is here, but doesn’t seem to offer much reason to upgrade from its previous version. (The Verge)

AWS expert webinar: Learn how to establish Everything-as-a-Service patterns with API-first domain-specific platforms that leverage Apache Kafka® for real-time data streaming. Register now.*

^{*This is sponsored advertising content.}