Elamb Cybersecurity

Category: sissu

  • diacap to diarmf: manage information security risk

    Risk Management Framework is implemented throughout an organization.

    NIST 800-39, Manage Information Security Risk, describes how to implement risk within t three layers (or tiers) of of an organization:

    Tier 1: Organization level
    Tier 2: Mission/Business Process level
    Tier 3: Information System level

    diarmf risk management of information security

    Tier 1: Organization Level risk management
    Tier one addresses security from the organizations perspective. The activities include the implementation of the first component of risk management, risk framing. Risk framing provides context of all the risk activities within an organization, which affects the risk activities of tier 1 & 2. The output of risk framing is Risk Management Strategy. In tier 1 the organization establishes and implements governance structure that are in compliance with laws, regulations and policies. Tier 1 activities include establishment of the Risk Executive Function, establishment of the risk management strategy and determination of the risk tolerance.

    Tier 2: Mission/Business Process Level risk management

    Tier 2 risk management activities include: 1) defining the mission/business processes to support the organization. 2) Prioritize the mission/business process with respect to the long term goals of the organization. 3) Define the type of information needed to successfully execute the mission/business processes, criticality/sensitivity of the information and the information flows both internal and external of the information.

    Having a risk-aware process is an important part of tier 2. To be risk-aware senior leaders/executives need to know: 1) types of threat sources and threat events that could have an adverse affect the ability of the organizations 2) the potential adverse impacts on the organizational operations and assets, individuals, the Nation if confidentiality, integrity, availability is compromised 3) the organization�s resilience to such an attack that can be achieved with a given mission/business process

    Tier 3: Information System risk management

    From the information system perspective, tier 3 addresses the following tasks:
    1) Categorization of the information system
    2) Allocating the organizational security control
    3) Selection, implementation, assessment, authorization, and ongoing

    Chapter 3 focuses on the step to have a comprehensive risk management program. The tasks discussed include:
    Risk Framing
    Risk Assessing
    Risk Response
    Risk Monitoring

     

    For more information go to: http://elamb.org/training-certification800-39-manage-information-security-risks/

     

  • DIACAP Essentials + IA Control Validation Training (part 4): DIACAP/AFCAP Day 4 & 5

    UPDAT: 2014 - Risk Management Framework for DOD IT released.

    Days 4 & 5 bring the DIACAP/AFCAP Essentials Class to a close. The
    biggest things I learned were: CNSSI 4009 is the the official glossary of DOD IA, there is a big difference between theory, policy and practice, Agents of the Certifying Authority (ACA) are official validators and there is a difference between acquisition Mission criticality and IA MAC levels.

    Stuff I learned from people in the class:

    -AFCA is changing its name (to what?)

    DOD is going to put the new IA controls in NCSSI 12-53 (currently in draft)

    -a lot of what I need in there is in NIST 800-53

    Marines use something called Exacta

    Site called securitycritics.org

    33-202 is now completely irrelevant and obsolete (not even mentioned ONCE in the class)

    800-30

    Feds call Certification &Accreditation (C&A) “Security authorization”

    NIST SP 800-37

    Day 4:

    Validator Activities & Issue Accreditation Decision

    Prepare POA&M

    Validate Results/Scorecard

    Scorecard

    Make certification determination

    CA/DAA Package review

    Day 5:

    Validation procedures were discussed. On day five, we looked at how the validators look at a system.

    I thought is was interesting. It should help me get through the EITDR/DIACAP process easier.

    Maintain Situational Awareness

    Maintain IA Posture

    Conduct Review

    R-Accreditation

    Retire system

  • DIACAP Essentials + IA Control Validation Training (part 4): DIACAP/AFCAP Day3

    UPDAT: 2014 - Risk Management Framework for DOD IT released.

    Day 3 heats up a little. We start talking about what it take to actually get validated. The DIACAP Implementers Guide & the DIACAP Validators guide is opened up and reviewed. I think we all learned a little something during this discussion because there have been some challenges with this. Unfortunately, we don’t to far into the validator stuff.

    Day 3:

    DIACAP Structure

    Terminology Review

    Assemble DIACAP Team

    Registered System/System Information Profile

    Assign IA Controls

    Initiate DIACAP Implementation Plan

  • Security, Interoperability, Supportability, Sustainability and Usability (SISSU)

     

    The Security, Interoperability, Supportability, Sustainability and Usability (SISSU) is considered a part of the USAF IT LEAN process.  SISSU is a comprehensive database of security controls (IA Controls) addressed in DoDI 8500.02 needed to complete the DIACAP process. 

     

    The SISSU questions includes everything from documentation of the system to physical security, to network security.  To access the SISSU process in the EITDR one need an account and “stakeholders list” approval via AFCA/EV.

     

    Security, Interoperability, Supportability, Sustainability and Usability are each considered disciplines.  Each discipline is assigned a set of roles: producer, reviewer, validator, and approver.  Once all of these roles have done their part on each of their applicable questions in a given discipline they can move on to the next phase.  The phases are Define Need, Design, Build & Test, and Release.