Defining Information Security Metrics: Ron Ross of NIST

A big complaint about the Federal Information Security Management Act (FISMA) is that agencies complying with its provisions merely prove they're following processes aimed at securing information systems, but they don't necessarily prove the systems are indeed secure. In an exclusive interview, Ron Ross, the National Institute of Standards and Technology's FISMA guru, explains: The current challenges agencies face in complying with FISMA. How NIST standards, if adopted, will help secure government IT. Why no metric will fully assure systems will always be safe. Ron Ross is a senior computer scientist at the National Institute of Standards and Technology's Computer Security Division. His areas of specialization include security requirements definition, security testing and evaluation and information assurance. Ross leads the Federal Information Security Management Act Implementation Project for NIST.