Elamb Cybersecurity

Category: Assurance/DIACAP

  • ia awareness training

    Information Assurance Awareness Training


    NIST Special Publication 800-50, is a regulation dedicated to IA Awareness Training



    NIST SP 800-5, Building an Information Technology Security Awareness & Training Program


    The 800-50 includes guidance on development and sustainment of an awareness & training IT Security (aka information assurance training) program for all users, employees and supervisors within an organization. Having a training program is mandated by the Federal Information Security Act of 2002.

    IA Awareness Training – Roles & Responsibilities

    Agency heads – must ensure that high priority is given to effective security awareness and training for employees. Appoint a CIO
    CIO – Establish overall strategy, funding, tracking and report is in place for the IT security awareness and training program
    IT Security Program Manager – tactical deployment, development and maintenance of the IT security & awareness program.
    Managers – responsible for complying with IT security awareness program. Work with CIO and IT Security Program Managers to share responsibility. Ensure all users are trained to fulfill their security roles before access is giving. Promote professional development and certification of the IT staff.
    Users – largest audience in any organization and are the single most important group of people who can help to reduce unintentional errors.


    800-50 calls learning a “continuum”. The continuum of learning starts awareness and builds into education.
    Awareness – awareness is not training. Awareness focuses on security concerns to ensure users are mindful of basic rules and issues in a given environment.


    Awareness is not training. The purpose of awareness presentations is simply to focus attention on security. Awareness presentations are intended to allow individuals to recognize IT security concerns and respond accordingly. – 800-50

    Training – is a formal focused method to develop a skill for job performance.
    Training strives to produce relevant and needed security skills and competencies – 800-50


    Education – combines multidisciplinary areas into a common body of knowledge.



    Education integrates all of the security skills and competencies of the various functional specialties into a common body of knowledge . . . and strives to produce IT security specialists and professionals capable of vision and pro-active response. –800-50

  • Training & Certification: Risk Management Approach to Security Authorization

    Understand the Risk Management Approach to Security Authorization

    The concept of management of information security risks across an enterprise is discussed in 800-39. An organization takes a multitier approach to the risk management at the organizational, mission, and system levels. Risk management framework is a process that is broken down in NIST 800-37, Risk Management Framework. The CAP addresses the following:

      Distinguish between applying risk management principles and satisfying compliance requirements
      Identify and maintain information systems inventory
      Understand the criticality of securing information
      Understand organizational operations

    Distinguish between applying risk management principles and satisfying compliance
    Risk management includes satisfying compliance. Even though some controls may not be able to be made fully compliant due to limited resources, residual risk to the organization can still be mitigated and managed. – Concepts of NIST SP 800-37, Guide of RMF

    Identifying and maintaining information system (IS) inventory is addressed in NIST 800-37, Risk Management Framework, 800-18, System Security Plan & 800-64, System Development Life Cycle. 800-37 addresses inventory of the IS in RMF Step 1 – Categorization of IS. Of the tasks of categorization includes information system registration which begins with by identifying the information system in the system inventory. This is documented in the security plan. NIST SP 800-18 discusses how the inventory is documents, and logically separates the system authorization boundary. That inventory is maintained and monitored throughout the life cycle of the IS (from imitation to disposal and from categorization to monitoring of the system).

    A CAP candidate can understand the criticality of security information from reading FIPS 199, categorization of federal information systems.

    Understanding the organizational operations of the system is imperative to a CAP candidate for the purpose of scope guidance described in NIST SP 800-53.

  • Risk Management in IT: NSS

    Risk Management of IT: National Security Systems

    Risk Assessments and Risk Management will apply to National Security Systems (NSS).

    What is a Risk Assessment?

    A risk assessment is the results/process to determine the likelihood that a threat will exploit a weakness. Risk assessment is a part of the risk management.

    What is risk management?

    Risk Management is the on-going process of determining assessing, identifying and prioritizing of risks.

    Is My System a National Security System?

    NIST SP 800-59, Guidance for Identifying an information system as an NSS. 800-39 is a 17 page document developed in conjunction with the Department of Defense, including the National Security Agency, for identifying an information system as a national security system. It is basised on the Federal Information Security Management Act of 2002 (FISMA).

    Who determines if you have an NSS?

    The head of each agency is responsible for designating an agency information security official to determine which, if any, agency systems are national security systems.

    Tools to determine if you have a NSS system:

    National Security System Identification Checklist (NIST SP 800-59, Appendix A). The NSS ID Checklist asks (6) questions. Answering yes to any of these questions qualifies your system as an NSS:
    • Does the function, operation, or use of the system involve intelligence activities?
    • Does the function, operation, or use of the system involve cryptologic activities related to national security?
    • Does the function, operation, or use of the system involve command and control of military forces?
    • Does the function, operation, or use of the system involve equipment that is an integral part of a weapon or weapons system?
    • Is the system critical to the direct fulfillment of military or intelligence missions?
    • Does the system store, process, or communicate classified information?

    NSS RMF
    The guidance of CNSSI 1253 is the result of NIST collaborated with the Intelligence Community (IC), Department of Defense (DoD), and the Committee on National Security Systems (CNSS) to ensure NIST SP 800-53 contains security controls to meet the requirements of National Security Systems (NSS).

    KEY DIFFERENCES BETWEEN CNSS INSTRUCTION NO. 1253 AND NIST PUBLICATIONS

    The key differences between CNSSI 1253 and the rest of the NIST publications is that NSS systems do not follow “high-water mark”, NSS maybe tailored through risk-based adjustment, control profiles, and a method that allows organization to practice reciprocity.

    NSS and High Water Mark
    Both FIPS 200 and NIST 800-53 apply the concept of a high-water mark (HWM) when categorizing information systems according to the worst-case potential impact of a loss of confidentiality, integrity, or availability of information or an information system. This Instruction does not adopt this HWM usage. In the National Security Community, the potential impact levels determined for confidentiality, integrity, and availability are retained, meaning there are 27 possible three-value combinations for NSI or NSS, as opposed to the three possible single-value categorizations obtained using the guidelines in FIPS 200. – CNSSI 1253

    Risk-Based Adjustment
    Potential impact-based security categorizations for NSS may be tailored through the use of a risk-based adjustment. This adjustment takes into consideration the physical and personnel security measures already employed throughout the National Security Community and factors such as aggregation of information.

    Control Profile
    Method by which organizations may designate sets of controls for NSS based on their enterprise-wide risk assessment and taking into account business objectives, system risks, and mission needs.

    NSS Reciprocity
    It is the policy of the National Security Community that member organizations practice reciprocity with respect to the certification of systems and system components to the greatest extent practicable. Reciprocity of certification reduces the cost and time to implement systems and system components.

  • DoD Risk Management FrameWork (Part 1): Look Ahead


    The DoD is working on using the National Institute of Standards and Technology (NIST) Certification & Accreditation method of assessing & authorizing systems. The NIST system of C&A is actually known as Risk Management Framework (RMF). This would require the the Assistant Secretary of Defense Networks & Information Integration ASD(NII) office to move the DoDI 8500.2, Information Assurance (IA) controls to be mapped to the NIST SP 800-53, Recommended Security Controls. I am not certain yet whether they will eliminate the 8500.2 or just have all departments move to the NIST SP 800-53. They will also need to switch the DoD Information Assurance Certification & Accreditation Process (DIACAP) to the NIST SP 800-37 rev 1, Risk Management Framework or something similar.

    If the transition is anything like their move to from DoD Information Technology Security Certification & Accreditation Process (DITSCAP) to the DIACAP then they will give about 2 years for the DoD to transition. As of Mar. 2011, there is no policy on this. It is serious because its on the DIACAP KS and the Department of Navy CIO has been releasing information on it since 2009. The DON CIO & the ASD (NII) have been working on the project to transition from DIACAP to some sort of DoD Risk Management Framework. So far, they have mapped the DoDI 8500.2 IA controls to the NIST SP 800-53 Controls: Certification and Accreditation Transformation: Security Control Mapping. Here is a May 2010 update to the NIST to DIACAP mapping. 800-53 to DoD IA contols map also includes the Director of Central Intelligence Directive (DCID) 6/3 controls. This is very telling. The plan seems to be to have one standard for all Federal Information System.

    Since DoD 8510.01, DIACAP & NIST SP 800-37, Risk Management Framework (RMF) cover so much of the same ground, I think the only real benefit is that reciprocity between Federal agency will be easier if all departments have one standard of risk management and one security control set.

    The DON uses the certification and accreditation (C&A) process to assess and understand the residual risk associated with operating information systems (IS) and information technology (IT). The DON is participating with the DoD, the IC, and the rest of the Federal government in C&A transformation. One goal of transformation is to achieve common security controls enabling the DON, the DoD, the IC, and the rest of the Federal government to develop systems to the same protection standards.

    The recently released National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, revision 3 provides recommended consolidated security controls in an effort to achieve common security controls across the Federal government.

    The DON will continue to use the DoDI 8500.2 as the authoritative source for security controls until otherwise specified. However, understanding the changes represented in NIST SP 800-53r3 will be essential as DoD and the DON begin transitioning to this new set of security controls. To support the transition, the DON CIO developed this security control mapping document to demonstrate how existing DoD and IC security controls map to the security controls recommended by the NIST SP 800-53r3 publication.

    —Security Control Mapping Document Aids Transition, DON CIO Site

  • UPDATED IA STUFF + Procrastination

    My greatest skill is procrastination. I really am the best, most skilled procrastinator I know. It takes all of my will power to stay consistent with anything, including this blog, which is why (among other things) I am not banking like Darren Rowse or Steve Pav, two of my favorite bloggers.

    YOU SEE, I am such a good procrastinator that I JUST procrastinated on getting to the REAL subject of this article, security, IA updates.

    A fellow IA Analyst wrote me with questions that got right to the heart of IA… change.

    She asked about AFI 33-202.
    And I said:

    Right as I felt I had mastered the contents of 33-202, the airforce moved to 33-210 (to replace all its C&A stuff). I believe 33-202 is now obsolete and replaced with 33-200 & 33-202 and others.. last time I was with the AF, anyway.

    What about IT LEAN?
    I said:

    As for IT Lean, you can find that on AF Knowledge Now site and I think they have links to it on EITDR. If you are interested in IT Lean you’ll be REALLY interested in 33-210:
    33-210

    But if you are working with the Air Force and want more on the IT LEAN process you should be digging into AFCAP, Air Force Certification & Accreditation Program, an AF version of IT Lean.

    CNSS 1253:
    A lot of people also ask me to send them a copy of the CNSSI 12-53. But it is actually OUT. Its the CNSSI 1253. I, personally, have not had any clear direction (currently NO direction) on how to start moving some of the CNSSI to the systems I work on. I suspect that the Govt. will start this within the next couple of years and start phasing out DIACAP.. but who the hell knows what a bureaucracy of their size will do next!

    Lastly, my fellow IA Analyst asked me about EITDR
    and I said:

    You’ll find the EITDR POCs on the Air Force Portal or Knowledge Now. Log on to the Air Force Portal (if you don’t have an account get one.. you may have to get sponsor by the Govt to get it). Once on the AF Portal search for EITDR and they’ll have tons of stuff on it. Waaaaay more stuff than you want to read. You’ll also find the person you need to start the EITDR process with.

  • SRR Findings to IA Controls

    From Reader:

    I stumbled upon your site and am new to security working for a contractor. I’m attempting to complete a DIACAP POA&M and need to map SRR findings to IA controls – any idea where I might find this information?

    The SRR finding reference the DOD Unix STIG and NIPR STIG. It doesn’t seem to completely match up the the DIACAP IA Controls, but that is where a good system security engineer/ IA analyst comes in.

    Once you’ve got your SRR results, IA Control compliance and mitigation depends on your situation. There are a few that map directly (like Screen Saver) but most of the SRR findings will fall under one or two of the IA Controls.

    Hope this helps.

  • CNSSI 12-53: New Security Control Catalog for National Security Systems

    2014 – Update, DIACAP has been upgraded to Risk Management Framework for DoD IT (aka DIARMF).  Its base on the NIST SP 800-37, Risk Management Framework for Federal IT and takes from CNSSI 1253.

    Risk Management Framework for DoD IT takes all IA Controls (Security Controls) from NIST SP 800-53.

    New DIACAP Certification & Accreditation IA Controls

    The DoD has had the same IA controls since DoD 8510.1-M, controls since DoD 8510.1-M, Department of Defense Information Technology System Certification & Accreditation Process (DITSCAP), July 31, 2000 – it was developed late last century.

    The DoD has a total of 157 IA controls spread across 8 subject areas in 4 classes:

    DC – Security Design & Configuration

    IA – Identification and Authentication

    EC – Enclave & Computing

    EB – Enclave Boundary Defense

    PE – Physical & Environmental

    PR – Personnel

    CO – Continuity

    VI – Vulnerability

    There is a huge change coming in certification & accreditation for the DoD coming. The IA controls are being expanded and changed. The last two DIACAP classes I’ve been to mentioned that there is a big change coming. Essentially, all the IA Controls (security controls, safeguards, countermeasures.. whatever your organization is calling them) are getting expanded. All federal organizations will have security controls that look more like what is in the National Institute of Standards and Technology Special Publication 800-53. This is all being placed in the Committee on National Security Systems Instruction (CNSSI) 1253. As of 25 June 2009, the CNSSI 1253 is still in draft.

    The draft has 17 families & identifiers in three security control classes.

    TABLE 1: SECURITY CONTROL CLASSES, FAMILIES, AND IDENTIFIERS
    IDENTIFIER FAMILY CLASS

    AC Access Control Technical

    AT Awareness and Training Operational

    AU Audit and Accountability Technical

    CA Certification, Accreditation, and Security Assessments Management

    CM Configuration Management Operational

    CP Contingency Planning Operational

    IA Identification and Authentication Technical

    IR Incident Response Operational

    MA Maintenance Operational

    MP Media Protection Operational

    PE Physical and Environmental Protection Operational

    PL Planning Management

    PS Personnel Security Operational

    RA Risk Assessment Management

    SA System and Services Acquisition Management

    SC System and Communications Protection Technical

    The CNSSI has about 500 controls with pretty good granularity.

    One of the really cool thing about 1253 was the security control mapping. It’s a table that matches up 800-53, DCID 6/3 and DODI 8500.2.

  • DIACAP Essentials + IA Control Validation Training (part 4): DIACAP/AFCAP Day 4 & 5

    UPDAT: 2014 - Risk Management Framework for DOD IT released.

    Days 4 & 5 bring the DIACAP/AFCAP Essentials Class to a close. The
    biggest things I learned were: CNSSI 4009 is the the official glossary of DOD IA, there is a big difference between theory, policy and practice, Agents of the Certifying Authority (ACA) are official validators and there is a difference between acquisition Mission criticality and IA MAC levels.

    Stuff I learned from people in the class:

    -AFCA is changing its name (to what?)

    DOD is going to put the new IA controls in NCSSI 12-53 (currently in draft)

    -a lot of what I need in there is in NIST 800-53

    Marines use something called Exacta

    Site called securitycritics.org

    33-202 is now completely irrelevant and obsolete (not even mentioned ONCE in the class)

    800-30

    Feds call Certification &Accreditation (C&A) “Security authorization”

    NIST SP 800-37

    Day 4:

    Validator Activities & Issue Accreditation Decision

    Prepare POA&M

    Validate Results/Scorecard

    Scorecard

    Make certification determination

    CA/DAA Package review

    Day 5:

    Validation procedures were discussed. On day five, we looked at how the validators look at a system.

    I thought is was interesting. It should help me get through the EITDR/DIACAP process easier.

    Maintain Situational Awareness

    Maintain IA Posture

    Conduct Review

    R-Accreditation

    Retire system

  • DIACAP Essentials + IA Control Validation Training (part 4): DIACAP/AFCAP Day3

    UPDAT: 2014 - Risk Management Framework for DOD IT released.

    Day 3 heats up a little. We start talking about what it take to actually get validated. The DIACAP Implementers Guide & the DIACAP Validators guide is opened up and reviewed. I think we all learned a little something during this discussion because there have been some challenges with this. Unfortunately, we don’t to far into the validator stuff.

    Day 3:

    DIACAP Structure

    Terminology Review

    Assemble DIACAP Team

    Registered System/System Information Profile

    Assign IA Controls

    Initiate DIACAP Implementation Plan

  • DIACAP Essentials + IA Control Validation Training (part 3): DIACAP/AFCAP Day2

    UPDAT: 2014 - Risk Management Framework for DOD IT released.

    Day 1 & 2 have been all about the very basics of DIACAP. Were introduced to the terminologies, key players of the C&A process and basically given the big picture. Like I said, GREAT for beginners, but just lots of theory and refresher if you’ve been doing C&A since DITSCAP.

    Day 1 &2:

    Getting the Big Picture

    DIACAP/AFCAP Policy & Terminology

    Roles and Responsibilities for the C&A process

    Accreditation & Approval to Connect

    Homework: review terminology

    In between longer breaks, during lunch and just before class we sneak in episode of the The IT Crowd. Its the first time I’ve watched it so its a real treat for me. Hilarious show.