Who makes security standards? What organizations are involved in security incidents, reporting, and training?

Standards creation

• NIST, the National Institute of Standards and Technology (part of the Dept. of Commerce).
  • NIST organized the "new" (1997) Common Criteria. (Note: "TOE" is Target of Evaluation). Here are some images extracted, which provide good general overviews of the security evaluation process:
    • Security Concepts and Relationships
    • Evaluation Concepts and Relationships
    • Derivation of Requirements and Specifications
  • The older Orange Book came from the Department of Defense.
• Internationally, there are similar national organizations. The International Standards Organization ratifies many international standards.

Incident monitoring, reporting, training

• CERT, formed after the Morris worm, is now semi-privatized. They still receive a lot of information, but don't share it all.
• National Infrastructure Protection Center has a broad purview that includes networks and cybersecurity.
• CERT (members only to report): http://www.cert.org
• CIAC (DoD only to report): www.ciac.org/ciac
• FIRST (consortium): http://www.first.org
• SANS, home of several security certification programs. Also see their reading room for online documents of many types.
• CERIAS, at Purdue (COAST is now part of CERIAS). The FTP Archive contains lots of security software.
• US Davis SecLab: http://seclab.cs.ucdavis.edu.