Elamb Cybersecurity

Category: DIARMF

  • ia awareness training

    Information Assurance Awareness Training


    NIST Special Publication 800-50, is a regulation dedicated to IA Awareness Training



    NIST SP 800-5, Building an Information Technology Security Awareness & Training Program


    The 800-50 includes guidance on development and sustainment of an awareness & training IT Security (aka information assurance training) program for all users, employees and supervisors within an organization. Having a training program is mandated by the Federal Information Security Act of 2002.

    IA Awareness Training – Roles & Responsibilities

    Agency heads – must ensure that high priority is given to effective security awareness and training for employees. Appoint a CIO
    CIO – Establish overall strategy, funding, tracking and report is in place for the IT security awareness and training program
    IT Security Program Manager – tactical deployment, development and maintenance of the IT security & awareness program.
    Managers – responsible for complying with IT security awareness program. Work with CIO and IT Security Program Managers to share responsibility. Ensure all users are trained to fulfill their security roles before access is giving. Promote professional development and certification of the IT staff.
    Users – largest audience in any organization and are the single most important group of people who can help to reduce unintentional errors.


    800-50 calls learning a “continuum”. The continuum of learning starts awareness and builds into education.
    Awareness – awareness is not training. Awareness focuses on security concerns to ensure users are mindful of basic rules and issues in a given environment.


    Awareness is not training. The purpose of awareness presentations is simply to focus attention on security. Awareness presentations are intended to allow individuals to recognize IT security concerns and respond accordingly. – 800-50

    Training – is a formal focused method to develop a skill for job performance.
    Training strives to produce relevant and needed security skills and competencies – 800-50


    Education – combines multidisciplinary areas into a common body of knowledge.



    Education integrates all of the security skills and competencies of the various functional specialties into a common body of knowledge . . . and strives to produce IT security specialists and professionals capable of vision and pro-active response. –800-50

  • Training & Certification: Risk Management Approach to Security Authorization

    Understand the Risk Management Approach to Security Authorization

    The concept of management of information security risks across an enterprise is discussed in 800-39. An organization takes a multitier approach to the risk management at the organizational, mission, and system levels. Risk management framework is a process that is broken down in NIST 800-37, Risk Management Framework. The CAP addresses the following:

      Distinguish between applying risk management principles and satisfying compliance requirements
      Identify and maintain information systems inventory
      Understand the criticality of securing information
      Understand organizational operations

    Distinguish between applying risk management principles and satisfying compliance
    Risk management includes satisfying compliance. Even though some controls may not be able to be made fully compliant due to limited resources, residual risk to the organization can still be mitigated and managed. – Concepts of NIST SP 800-37, Guide of RMF

    Identifying and maintaining information system (IS) inventory is addressed in NIST 800-37, Risk Management Framework, 800-18, System Security Plan & 800-64, System Development Life Cycle. 800-37 addresses inventory of the IS in RMF Step 1 – Categorization of IS. Of the tasks of categorization includes information system registration which begins with by identifying the information system in the system inventory. This is documented in the security plan. NIST SP 800-18 discusses how the inventory is documents, and logically separates the system authorization boundary. That inventory is maintained and monitored throughout the life cycle of the IS (from imitation to disposal and from categorization to monitoring of the system).

    A CAP candidate can understand the criticality of security information from reading FIPS 199, categorization of federal information systems.

    Understanding the organizational operations of the system is imperative to a CAP candidate for the purpose of scope guidance described in NIST SP 800-53.

  • Risk Management in IT: NSS

    Risk Management of IT: National Security Systems

    Risk Assessments and Risk Management will apply to National Security Systems (NSS).

    What is a Risk Assessment?

    A risk assessment is the results/process to determine the likelihood that a threat will exploit a weakness. Risk assessment is a part of the risk management.

    What is risk management?

    Risk Management is the on-going process of determining assessing, identifying and prioritizing of risks.

    Is My System a National Security System?

    NIST SP 800-59, Guidance for Identifying an information system as an NSS. 800-39 is a 17 page document developed in conjunction with the Department of Defense, including the National Security Agency, for identifying an information system as a national security system. It is basised on the Federal Information Security Management Act of 2002 (FISMA).

    Who determines if you have an NSS?

    The head of each agency is responsible for designating an agency information security official to determine which, if any, agency systems are national security systems.

    Tools to determine if you have a NSS system:

    National Security System Identification Checklist (NIST SP 800-59, Appendix A). The NSS ID Checklist asks (6) questions. Answering yes to any of these questions qualifies your system as an NSS:
    • Does the function, operation, or use of the system involve intelligence activities?
    • Does the function, operation, or use of the system involve cryptologic activities related to national security?
    • Does the function, operation, or use of the system involve command and control of military forces?
    • Does the function, operation, or use of the system involve equipment that is an integral part of a weapon or weapons system?
    • Is the system critical to the direct fulfillment of military or intelligence missions?
    • Does the system store, process, or communicate classified information?

    NSS RMF
    The guidance of CNSSI 1253 is the result of NIST collaborated with the Intelligence Community (IC), Department of Defense (DoD), and the Committee on National Security Systems (CNSS) to ensure NIST SP 800-53 contains security controls to meet the requirements of National Security Systems (NSS).

    KEY DIFFERENCES BETWEEN CNSS INSTRUCTION NO. 1253 AND NIST PUBLICATIONS

    The key differences between CNSSI 1253 and the rest of the NIST publications is that NSS systems do not follow “high-water mark”, NSS maybe tailored through risk-based adjustment, control profiles, and a method that allows organization to practice reciprocity.

    NSS and High Water Mark
    Both FIPS 200 and NIST 800-53 apply the concept of a high-water mark (HWM) when categorizing information systems according to the worst-case potential impact of a loss of confidentiality, integrity, or availability of information or an information system. This Instruction does not adopt this HWM usage. In the National Security Community, the potential impact levels determined for confidentiality, integrity, and availability are retained, meaning there are 27 possible three-value combinations for NSI or NSS, as opposed to the three possible single-value categorizations obtained using the guidelines in FIPS 200. – CNSSI 1253

    Risk-Based Adjustment
    Potential impact-based security categorizations for NSS may be tailored through the use of a risk-based adjustment. This adjustment takes into consideration the physical and personnel security measures already employed throughout the National Security Community and factors such as aggregation of information.

    Control Profile
    Method by which organizations may designate sets of controls for NSS based on their enterprise-wide risk assessment and taking into account business objectives, system risks, and mission needs.

    NSS Reciprocity
    It is the policy of the National Security Community that member organizations practice reciprocity with respect to the certification of systems and system components to the greatest extent practicable. Reciprocity of certification reduces the cost and time to implement systems and system components.

  • Risk Management in IT: Risk Assessment Methodology

  • Risk Management in IT: SDLC

    Risk Management Guide for IT: SDLC

    NIST 800-30, risk management guide for IT discusses how risk management framework matches to the system development life cycle (SDLC) , risk assessment methodology, risk mitigation, and good practice of ongoing risk assessment.

    A system and its information must be protected from cradle to grave. That is why risk management applies to the entire system development life cycle. The level of risk to the system and its data depends on the criticality or importance of the system to the business and/or mission it supports.
    The system development life cycle consists of: Initiation, Development/Acquisition, Implementation, Maintenance/Operations, and Disposal.

    How Risk Management Framework matches to the System Development Life Cycle

    SDLC
    Phases

    Phase
    Characteristics

    Support
    from Risk Management Activities

    Phase
    1—Initiation

    The need
    for an IT system is

    expressed
    and the purpose and

    scope of
    the IT system is

    documented

    Identified
    risks are used to

    support
    the development of the

    system
    requirements, including

    security
    requirements, and a

    security
    concept of operations

    (strategy)

    Phase
    2—Development or

    Acquisition

    The IT
    system is designed,

    purchased,
    programmed,

    developed,
    or otherwise

    constructed

    The risks
    identified during this

    phase can
    be used to support

    the
    security analyses of the IT

    system
    that may lead to

    architecture
    and design tradeoffs

    during
    system

    development

    Phase
    3—Implementation

    The system
    security features

    should be
    configured, enabled,

    tested,
    and verified

    The risk
    management process

    supports
    the assessment of the

    system
    implementation against

    its
    requirements and within its

    modeled
    operational

    environment.
    Decisions

    regarding
    risks identified must

    be made
    prior to system

    operation

    Phase
    4—Operation or

    Maintenance

    The system
    performs its

    functions.
    Typically the system is

    being
    modified on an ongoing

    basis
    through the addition of

    hardware
    and software and by

    changes to
    organizational

    processes,
    policies, and

    procedures

    Risk
    management activities are

    performed
    for periodic system

    reauthorization
    (or

    reaccreditation)
    or whenever

    major
    changes are made to an

    IT system
    in its operational,

    production
    environment (e.g.,

    new system
    interfaces)

    Phase
    5—Disposal

    This phase
    may involve the

    disposition
    of information,

    hardware,
    and software.

    Activities
    may include moving,

    archiving,
    discarding, or

    destroying
    information and

    sanitizing
    the hardware and

    software

    Risk
    management activities

    are
    performed for system

    components
    that will be

    disposed
    of or replaced to

    ensure
    that the hardware and

    software
    are properly disposed

    of, that
    residual data is

    appropriately
    handled, and that

    system
    migration is conducted

    in a
    secure and systematic

    manner

  • Training and Certification: NIST SP 800-39 Manage Information Security Risk

    NIST SP 800-39, Manage Information Security Risk

    NIST 800-39 is a federal document that talks about risk management of information system and their security. It is cited as one of the sources for the ISC2 Certified Authorization Professional (CAP) certification. For study of the document go to Chapters 2 and 3 of 800-39. Chapter 2 talks about the fundamentals of risk management & chapter 3 breaks down the process of applying risk management across and organization.

    The Fundamentals of Risk Management (Chapter 2, 800-39)
    800-39 goes into the philosophy (or “the why”) and the how of managing information security at multiple levels (or multitier risk management approach). The three layers (or tiers) of risk management addressed in the 800-39 are:
    Tier 1: Organization level
    Tier 2: Mission/Business Process level
    Tier 3: Information System level

    Tier 1: Organization Level risk management
    Tier one addresses security from the organizations perspective. The activities include the implementation of the first component of risk management, risk framing. Risk framing provides context of all the risk activities within an organization, which affects the risk activities of tier 1 & 2. The output of risk framing is Risk Management Strategy. In tier 1 the organization establishes and implements governance structure that are in compliance with laws, regulations and policies. Tier 1 activities include establishment of the Risk Executive Function, establishment of the risk management strategy and determination of the risk tolerance.

    Tier 2: Mission/Business Process Level risk management

    Tier 2 risk management activities include: 1) defining the mission/business processes to support the organization. 2) Prioritize the mission/business process with respect to the long term goals of the organization. 3) Define the type of information needed to successfully execute the mission/business processes, criticality/sensitivity of the information and the information flows both internal and external of the information.

    Having a risk-aware process is an important part of tier 2. To be risk-aware senior leaders/executives need to know: 1) types of threat sources and threat events that could have an adverse affect the ability of the organizations 2) the potential adverse impacts on the organizational operations and assets, individuals, the Nation if confidentiality, integrity, availability is compromised 3) the organization’s resilience to such an attack that can be achieved with a given mission/business process

    Tier 3: Information System risk management

    From the information system perspective, tier 3 addresses the following tasks:
    1) Categorization of the information system
    2) Allocating the organizational security control
    3) Selection, implementation, assessment, authorization, and ongoing

    Chapter 3 focuses on the step to have a comprehensive risk management program. The tasks discussed include:
    Risk Framing
    Risk Assessing
    Risk Response
    Risk Monitoring

    Risk Framing
    Risk framing are the assumptions, constraints, risk tolerance and priorities that shape an organization’s managing risk. Risk framing is created based on organizational governance structure, how much money is available, regulations imposed, environment, culture and trust relationships.
    In order to “frame” risk (or get an organizational context of the risk) the organization must determine: Risk assumptions, risk constraints, risk tolerance and priorities/trade-offs

    Risk Assumptions
    Risk assumption has to do determining how to risk will be assessed for an organization. Assumptions are based on identification of threats, vulnerabilities, the impact to the organization if attacks are successful and likelihood of attacks.

    Risk Constraints
    Risk constraints have to do with accepted limits of risk assessments, risk monitoring & risk response. Those limitation might be financial, cultural, the need to rely on legacy systems, or regulations imposed on the organization.

    Risk Tolerance
    Risk tolerance is how much risk the organization is willing to take.
    Priorities/Tradeoffs
    Risk is experienced at different levels, in different forms, and in different time frames. At Tier
    1, organizations make trade-offs among and establish priorities for responding to such risks. Organizations tend to have multiple priorities that at times conflict, which generates potential risk. Approaches employed by organizations for managing portfolios of risks reflect organizational culture, risk tolerance, as well as risk-related assumptions and constraints. These approaches are typically embodied in the strategic plans, policies, and roadmaps of organizations which may indicate preferences for different forms of risk response. For example, organizations may be willing to accept short-term risk of slightly degraded operations to achieve long-term reduction in information security risk.
    However, this trade-off could be unacceptable for one particularly critical mission/business function (e.g., real-time requirements in many industrial/process control systems). For that high-priority area, a different approach to improving security may be required including the application of compensating security controls.

    Risk Assessment
    Risk assessment is threat & vulnerability identification and risk determination. Organizaitonal risk framing is a prerequisite to risk assessments, because methods of risk assessment must be established by the contexts of the organizations risk.

    Risk Response
    Risk response identifies, evaluates, decides on, and implements appropriate courses of action to
    accept, avoid, mitigate, share, or transfer risk to organizational operations and assets, individuals,
    other organizations, and the Nation, resulting from the operation and use of information systems.
    Risk identification is key to risk response. Risk types include:
    Risk accept- is the appropriate risk response when the identified risk is within the organizational risk tolerance. Organizations can accept risk deemed to be low, moderate, or high depending on particular situations or conditions.

    Risk avoidance– Organizations may conduct certain types of activities or employ certain types of information technologies that result in risk that is unacceptable. In such situations, risk avoidance involves taking specific actions to eliminate the activities or technologies that are the basis for the risk or to revise or reposition these activities or technologies in the organizational mission/business processes to avoid the potential for unacceptable risk.

    Risk mitigation-adding management, technical, administrative safeguards to minimize identified risks to the system.
    Risk share & transfer- Risk sharing or risk transfer is the appropriate risk response when organizations desire and have the means to shift risk liability and responsibility to other organizations. Risk transfer shifts the entire risk responsibility or liability from one organization to another organization (e.g., using insurance to transfer risk from particular organizations to insurance
    companies).

    Risk Monitoring – Risk changes with each modification of the system. It’s important to monitor the changes of the risk of a system. Changes to threats can also change risk.

  • Training & Certification: CAP – Security Authorization of Federal Information Systems

    Understanding the Security Authorization of federal information systems

    The ISC2 CAP candidate needs to understand the multitier approach to evaluating strategic & tactical risk across an organization/enterprise. This is discussed thoroughly in NIST SP 800-39, Managing Information Security Risk. 800-39 explains risk management from the organization, mission, and system perspective.

    800-39 explains how and organization does risk framing by making risk assumptions, knowing risk constraints, risk tolerance, priorities & tradeoffs. Implementation of an organization’s risk management strategy is also based it’s governance structure.

    Security Authorization is a risk management process that based on identification of threats, vulnerabilities and countermeasures. 800-39 and 800-37 explains what must be included in a risk assessments that will evaluated residual risks and determine if they are acceptable or unacceptable to the organization as whole. Unacceptable risks can be reduced by implementing security controls.

    Understanding the Security Authorization of federal information systems covers the following key areas:

    Understand the Risk Management Approach to Security Authorization
    Understanding and distinguishing among the Risk Management Framework (RMF) steps
    Define and Understand Roles & Responsibilities
    Understand the Relationship between the RMF and SDLC
    Understand Legal, Regulatory, and Other Requirements for Security Authorization
    Understand Common Controls and Security Control Inheritance
    Understand Ongoing Monitoring Strategies
    Understand How the Security Authorization Process Relates to:

    1. Organization-wide risk management
    2. System Development Life Cycle (SDLC)
    3. Information system boundaries
    4. Authorization decisions

  • Training and Certification: certified authorization professional (1)

    The Certified Authorization Professional (CAP) is a certification that indicates a professional level of knowledge/skill on the subject of federal information system authorization (formerly certification & accreditation). In the US federal government, “Authorization” to operate a federally owned information system is a formal acceptance of risk from an Authorization Officer (AO). An AO is a high ranking official granted the authority to make major risk related decisions for an entire branch/or unit within a federal organization. The AO accepts or rejects the risks that information systems poses to his or her organization based on the recommendations of a security control assessors audit and accompanied Security Authorization Package.

    The CAP is based almost entirely on federal information security/protection laws, National Institute of Standards & Technology (NIST), and Office of Management & Budget regulations.

    There are seven domains the CAP exam focuses on:
    1. Understanding the Security Authorization of Information Systems
    2. Categorize Information Systems
    3. Establish the Security Control Baseline
    4. Apply Security Controls
    5. Assess Security Controls
    6. Authorize Information System
    7. Monitor Security Controls

  • NIST 800: DoD Risk Management Framework

    There are a couple defense policy reflecting the DoD’s move to NIST 800 standards: Defense Acquisition Regulation Supplement (DFARS 2011-D039) & CJCSI 6510.01, Information Assurance and Support to Computer Network Defense

    Defense Acquisition Regulation Supplement (DFARS 2011-D039)
    Defense contractors will have to meet the NIST Special Publication 800-53 security controls. Most large defense contractor have already started meeting defense controls for DIACAP (which are very similar to NIST 800 controls).
    more info @ firegovernment IT

    CJCSI 6510.01, Information Assurance and Support to Computer Network Defense
    The new 6510.01F replaces the old 6510.01E. The document refers to changes in the name of the Information Assurance Manager (IAM) to Information System Security Manager (ISSM) and the Information Assurance Officer (IAO) to Information System Security Officer (ISSO). The name Designated Accreditation Authority (DAA) is changed to Authorizing Official (AO). The former DIACAP term “certification” is changed to 800-37 term “assessment”.

    Updates titles for Designated Accrediting Authority (DAA) to Authorizing Official; Information Assurance Manager (lAM) to Information Systems Security Manager (ISSM); and Information Assurance Officer (IAO) to Information Systems Security Officer (ISSO) to align with CNSSI No. 4009 (reference e) terms. Replaces term certification with assessment and accreditation with authorization (to operate) in alignment with CNSSI No. 4009 (reference e) terminology. The new terms are followed by legacy terms in parentheses throughout instruction.

    The document also refers to the coming changes to DoD 8500 policies. The changes will focus on NIST 800:

    Select security controls lAW DODI 8500.2 (reference g). Note: The next update to DODI 8500.2 (reference g) and DODI 8510.01 (reference i) will direct DOD IS categorization and security control selection lAW CNSSI No. 1253, “Security Categorization and Control Selection for National Security Systems” (reference ill) with additional specific guidance on the DIACAP Knowledge Service. DODI 8500.2 (reference g) and DODI 8510.01 (reference i) will also direct the use of security controls in NIST SP 800-53, “Recommended Security Controls for Federal Information Systems and Organizations” (reference kkk) with supporting validation procedures in NIST SP 800-53A, “Guide for Assessing the Security Controls in Federal Information Systems and Organizations” (reference 111), and additional DOD guidance published in the DIACAP Knowledge Service.

    The ultimate goal will be to move away from “Certification & Accreditation” and to a Risk Management Framework” as in NIST SP 800-37:

    NIST 800-37 SP, “Guide for Applying the Risk Management Framework to Federal Information Systems” (reference mmmmm), provides guidelines for applying the Risk Management Framework to include conducting the activities of security categorization, security control selection and implementation, security control assessment, information system authorization, and security control monitoring.

  • DIARMF

    Department of Defense Information Assurance Risk Management Framework (DIARMF) will replace the DoD’s DIACAP process. As of Mar 2011 it is still being developed. The former DoD Information Assurance Certification & Accreditation Process (DIACAP) will undergo the same change as the NIST SP 800-37, C&A guide did when it changed to the rev 1, Guide for Applying Risk Management Framework. Some of the changes from DIACAP to DIARMF will consist of:

      NIST SP 800-53 controls
      Change focus from C&A to Risk Management
      Definition of how to bridge between DoD systems and NIST defined system (subsystems & Platform IT for example)
      DIARMF will look more like NIST 800-37 rev 1

    It is unknown how DIARMF authorization packages will look. Currently, the DIACAP consist of DIACAP packages (DIP, SIP, scorecard, POA&M with artifacts) and NIST 800-37 rev 1 consists of a Security Authorization Package (System Security Plan, Security Assessment Report & POA&M). Also, the roles between the NIST Risk Management Framework and the DoD 8500 series are different. So far, the DON CIO and ASD (NII) have come up with mapping between the roles and the 800-53 controls.

    The DIARMF will hopefully cover all of the gaps between the DoD C&A process and the new NIST 800-37, Risk Management Framework.