FedRAMP is Broken

The speakers open by asking who has worked on a FedRAMP project, and almost no one in the room thinks the program has met its goals. FedRAMP began in 2011 as a way for federal agencies to vet the security of cloud products, with low, moderate and high baselines meant to match controls to data sensitivity. The program was supposed to be a one-stop shop that other agencies could reuse, but the speakers describe slow, repetitive and expensive authorizations, especially for small companies.

The middle of the talk turns to specific controls that the speakers see as counterproductive. Examples include mandatory password rotation despite NIST guidance against it, account lockout rules that let an attacker lock out administrators, scanner requirements that are not enforced, and no requirement for customer-specific encryption keys. They point to a Microsoft breach involving a leaked key and a CircleCI incident, arguing that compliance checkboxes did not stop either. They also criticise the Tailored baseline, which eased entry but has very few authorized offerings, and the slow move to Revision 5.

The closing portion looks at possible fixes: a mechanism to update outdated controls, less reliance on a single third-party assessor, more automation, and fewer open remediation plans for every disputed control. The speakers encourage attendees to comment on the federal feedback request and to engage with the people who want the program to work. Their takeaway for practitioners is that compliance should be treated as a minimum, not a replacement for real security work.