CNSSI 12-53: New Security Control Catalog for National Security Systems
July 2, 2009
New DIACAP Certification & Accreditation IA Controls
The DoD has had the same IA controls since DoD 8510.1-M, controls since DoD 8510.1-M, Department of Defense Information Technology System Certification & Accreditation Process (DITSCAP), July 31, 2000 – it was developed late last century.
The DoD has a total of 157 IA controls spread across 8 subject areas in 4 classes:
DC – Security Design & Configuration
IA – Identification and Authentication
EC – Enclave & Computing
EB – Enclave Boundary Defense
PE – Physical & Environmental
PR – Personnel
CO – Continuity
VI – Vulnerability
There is a huge change coming in certification & accreditation for the DoD coming. The IA controls are being expanded and changed. The last two DIACAP classes I’ve been to mentioned that there is a big change coming. Essentially, all the IA Controls (security controls, safeguards, countermeasures.. whatever your organization is calling them) are getting expanded. All federal organizations will have security controls that look more like what is in the National Institute of Standards and Technology Special Publication 800-53. This is all being placed in the Committee on National Security Systems Instruction (CNSSI) 1253. As of 25 June 2009, the CNSSI 1253 is still in draft.
The draft has 17 families & identifiers in three security control classes.
TABLE 1: SECURITY CONTROL CLASSES, FAMILIES, AND IDENTIFIERS
IDENTIFIER FAMILY CLASS
AC Access Control Technical
AT Awareness and Training Operational
AU Audit and Accountability Technical
CA Certification, Accreditation, and Security Assessments Management
CM Configuration Management Operational
CP Contingency Planning Operational
IA Identification and Authentication Technical
IR Incident Response Operational
MA Maintenance Operational
MP Media Protection Operational
PE Physical and Environmental Protection Operational
PL Planning Management
PS Personnel Security Operational
RA Risk Assessment Management
SA System and Services Acquisition Management
SC System and Communications Protection Technical
The CNSSI has about 500 controls with pretty good granularity.
One of the really cool thing about 1253 was the security control mapping. It’s a table that matches up 800-53, DCID 6/3 and DODI 8500.2.
Popularity: 3% [?]
DIACAP Essentials + IA Control Validation Training (part 4): DIACAP/AFCAP Day 4 & 5
July 2, 2009
Days 4 & 5 bring the DIACAP/AFCAP Essentials Class to a close. The
biggest things I learned were: CNSSI 4009 is the the official glossary of DOD IA, there is a big difference between theory, policy and practice, Agents of the Certifying Authority (ACA) are official validators and there is a difference between acquisition Mission criticality and IA MAC levels.
Stuff I learned from people in the class:
-AFCA is changing its name (to what?)
DOD is going to put the new IA controls in NCSSI 12-53 (currently in draft)
-a lot of what I need in there is in NIST 800-53
Marines use something called Exacta
Site called securitycritics.org
33-202 is now completely irrelevant and obsolete (not even mentioned ONCE in the class)
800-30
Feds call Certification &Accreditation (C&A) “Security authorization”
NIST SP 800-37
Day 4:
Validator Activities & Issue Accreditation Decision
Prepare POA&M
Validate Results/Scorecard
Scorecard
Make certification determination
CA/DAA Package review
Day 5:
Validation procedures were discussed. On day five, we looked at how the validators look at a system.
I thought is was interesting. It should help me get through the EITDR/DIACAP process easier.
Maintain Situational Awareness
Maintain IA Posture
Conduct Review
R-Accreditation
Retire system
Popularity: 3% [?]
DIACAP Essentials + IA Control Validation Training (part 4): DIACAP/AFCAP Day3
July 2, 2009
Day 3 heats up a little. We start talking about what it take to actually get validated. The DIACAP Implementers Guide & the DIACAP Validators guide is opened up and reviewed. I think we all learned a little something during this discussion because there have been some challenges with this. Unfortunately, we don’t to far into the validator stuff.
Day 3:
DIACAP Structure
Terminology Review
Assemble DIACAP Team
Registered System/System Information Profile
Assign IA Controls
Initiate DIACAP Implementation Plan
Popularity: 2% [?]
DIACAP Essentials + IA Control Validation Training (part 3): DIACAP/AFCAP Day2
July 2, 2009
Day 1 & 2 have been all about the very basics of DIACAP. Were introduced to the terminologies, key players of the C&A process and basically given the big picture. Like I said, GREAT for beginners, but just lots of theory and refresher if you’ve been doing C&A since DITSCAP.
Day 1 &2:
Getting the Big Picture
DIACAP/AFCAP Policy & Terminology
Roles and Responsibilities for the C&A process
Accreditation & Approval to Connect
Homework: review terminology
In between longer breaks, during lunch and just before class we sneak in episode of the The IT Crowd. Its the first time I’ve watched it so its a real treat for me. Hilarious show.
Popularity: 2% [?]
