Lawmakers dig into FedRAMP security
Security weaknesses in the FedRAMP program were raised at a meeting between federal officials and lawmakers ahead of a vote to codify the General Services Administration’s Federal Risk and Authorization Management Program into law.
Security weaknesses in the FedRAMP program were raised at a meeting between federal officials and lawmakers ahead of a vote to codify the General Services Administration’s Federal Risk and Authorization Management Program into law.
Sen. Gary Peters (D-Mich.), cosponsor of a bipartisan bill called the Federal Secure Cloud Improvement and Jobs Act of 2021 and chairman of the Senate Homeland Security and Governmental Affairs Committee, convened the meeting to hear from officials and vendors for possible tweaks to the legislation.
Sen. Rob Portman (R-Ohio), the ranking member on the committee, said the current program “has weaknesses in it” that “have left it vulnerable to foreign-backed hackers targeting cloud systems,” including countries like Russia and China.
“Right now, we do not have sufficient safeguards in place to identify and prevent foreign interference in our cloud systems,” Portman said, adding: “I believe that must change before we codify this program.”
Recent reports have warned the program is "no longer optimized for modern security solutions." It has been considered ill-equipped to work well in environments with internet-of-things devices and other emerging technologies
Portman expressed specific concerns about potential conflicts of interest around the third-party assessment organizations (3PAOs) that report on whether cloud providers are meeting security standards to FedRAMP officials -- a key step in the government's approach to make risk-based decisions to authorizing certain cloud services. Portman said that he felt a security determination was categorically different from other kinds of third-party audits.
“This is about security, it’s not about auditing your book. It’s about ensuring that we don’t have the terrible situation that could occur where you have a lack of security in the cloud services that the federal government and we taxpayers all rely on,” he said. “It’s a different sort of assessment than what Deloitte might do in terms of ... an audit.”
David Shive, the GSA's CIO and a FedRAMP board member, urged lawmakers to include language which allows the program to grow amid increased cyber threats and unforeseen circumstances.
While Shive said FedRAMP has "done a good job" evolving with the cybersecurity threat, he noted how the needs of cloud service providers and their customers have changed over time, adding that there must be "agility built into any legislation" to address those concerns.
This article was first posted to FCW.