Yes, another year has passed -- the fifth since SARMA's founding. From the Japanese earthquake, tsunami and ongoing nuclear disaster, to the 10th anniversary of the 9/11 terrorist attacks and our own "quakicane" here on the east coast of the United States, 2011 has been filled with reminders of the myriad risks we face in today's world. 

As I noted at the end of last year, there are important reminders in such events. The first is that the challenges we face are multi-dimensional. It is therefore critical that we continue to view security risk through an all-hazards prism. Likewise, since such risks can never be fully eliminated, addressing them in a manner that is both rational and affordable requires a sound risk management strategy that focuses on enhanced societal resilience as the outcome. Finally, achieving this in a meaningful way requires the alignment of key national policies and programs, as well as the convergence of public- and private-sector homeland security risk management interests (fittingly, December has been declared  Critical Infrastructure Protection Month here in the United States).

Throughout the year, SARMA has worked hard to keep the spotlight on these issues, as well as continue to grow and mature the organization and advance the discipline of security risk management. Some key highlights from our fifth year of operations include:

• Conducting another highly successful Annual Conference;
• Providing comment on the development of Presidential Policy Directive (PPD) 8, the National Preparedness Goal and National Preparedness System;
• Creating and staffing two critical new positions on the SARMA staff -- the Director of Conferences and Events, and Director of Membership and Outreach;
• Expansion of the SARMA Linked-In Group to more than 800 active users and launch of several new subgroups, including SARMA Operations Security, SARMA International and SARMA Training and Education.

In the coming weeks and months, I hope to hear your thoughts on ways that SARMA can expand on these efforts in 2012. Some areas where I believe we can start include:

• Increasing our corporate and individual memberships;
• Establishing a professional certification program;
• Establishing a government advisory panel to support our efforts to provide DHS and other federal agencies with unbiased advice and opinions;
• Developing additional university partnerships;
• Implementing an ongoing calendar of events;
• Reviewing SARMA's IT infrastructure and revising as necessary to more effectively support SARMA's mission and operational needs; and
• Updating and revamping the current web site.

While these represent important steps toward achieving the goals and objectives identified in the Association's Strategic Plan, they cannot be accomplished without the necessary funding and active involvement of our membership. I ask each of you consider ways you can contribute.

Finally, as we close out 2011, I am also pleased to welcome a new member of the SARMA leadership team. At its December meeting, the SARMA Board unanimously elected Michael Chipley to serve as the Association's Executive Vice President. Mike brings a wealth of experience, ideas and energy that I know will be essential in advancing SARMA's mission in 2012. Please join our Board Chair, John Paczkowski, and myself in thanking Mike for taking on this extra assignment!

Wishing you and your families a safe and enjoyable holiday season.

Kerry

Kerry L. Thomas

President

DHS Emphasizes Resilience in New Secure Cyber Blueprint 

Continuing the homeland security enterprise's ongoing emphasis on the need to recover quickly from natural and man-made disasters, a new report on cybersecurity from the Department Of Homeland Security lists increased resilience as one of four goals for protecting critical information infrastructure. The Blueprint for a Secure Cyber Future builds on DHS's 2010 Quadrennial Homeland Security Review Report by laying out a clear path to achieve that report's goals for a "safe, secure, and resilient" cyberspace. Key to this effort, the report explains, is increasing the system fault tolerance of the nation's critical information infrastructure and preparing to maintain critical operations in a degraded environment.

Doing so will require excellence in a number of core capabilities, starting with a "comprehensive understanding of vulnerabilities, critical dependencies, and the potential for cascading disruptions." A clear understanding of the system's weakness will, in turn, make it easier to adopt architectural standards for resilience, such as "the reduction of single points of failure through multiple communications paths, storing a snapshot or 'checkpoint' of an application in a known good state, fault isolation and containment, and reversion modes." The Blueprint also emphasizes conformance to resilience standards such as NIST 800-34 and ISO/IEC 27031:2011, the development of methods to artificially create diversity in software systems, and a continuous audit program of resilience efforts.

Key Reports