dojosec fisma presentation
Post on 16-Apr-2017
2.799 Views
Preview:
TRANSCRIPT
Dan Philpott
OnPoint Consulting - ConsultantFISMApedia.org – Founderguerilla-ciso.com – Guest BloggerPotomac Forum – FISMA InstructorCISSP, CAP, MCSE, ITIL
ProType – Beta Tester, 1983
Once upon a time ...
© Nic's events - Creative Commons Attribution-ShareAlike
The Suck
© thebadastronomer - Creative Commons Attribution-ShareAlike
Barren Wasteland
© Denis Defreyne - Creative Commons Attribution
Toothless Security
© Oscar Alexander - Creative Commons Attribution
“Each federal agency shall develop, document, and implement an agency-wide information security program to provide information security for the
information and information systems that support the operations and
assets of the agency, including those provided or managed by another
agency, contractor, or other source…”
"...information security protections commensurate with the risk and
magnitude of the harm resulting from unauthorized access, use, disclosure,
disruption, modification, or destruction..."
Testing and Evaluation
© humeid - Creative Commons Attribution-NonCommercial-ShareAlike
Reporting
© icadrews - Creative Commons Attribution-NonCommercial
NO WAIVERS!
© Mel B. - Creative Commons Attribution
Network SecurityHost Security
Web App SecuritySecure Development
Physical SecuritySecurity Training
Cryptography+ Compliance= Security
NIST Special Publication 800-37: Guide for the Security Certification and Accreditation of
Federal Information Systems
Phases Overview
Phase 1 •Initiation
Phase 2 •Security Certification
Phase 3 •Security Accreditation
Phase 4 •Continuous Monitoring
NIST Special Publication 800-60: Guide for Mapping Types of Information and Information
Systems to Security Categories
NIST Special Publication 800-18: Guide for Developing Security Plans for Federal
Information Systems
NIST Special Publication 800-53A: Guide for Assessing the Security Controls in Federal
Information Systems
Security Accreditation Package
• System Security Plan• Security Assessment Report• Plan of Action and Milestones• Appendix: Final Risk Assessment
Security Accreditation Decision
• Authorization To Operate (ATO)• Denial of Authorization To Operate (DATO)• Interim Authority To Operate (IATO) - Retired
NIST Special Publication 800-53A: Guide for Assessing the Security Controls in
Federal Information Systems
NIST Special Publication 800-37 Revision 1: Guide for Security Authorization of Federal Information Systems: A Security Lifecycle
Approach
NIST Special Publication 800-39: Managing Risk from Information Systems: An
Organizational Perspective
Risk Management Framework
Security Life Cycle
Determine security control effectiveness(i.e., controls implemented correctly,
operating as intended, meeting security requirements for information system).
ASSESSSecurity Controls
Define criticality/sensitivity of information system according to
potential worst-case, adverse impact to mission/business.
CATEGORIZE Information System
Starting Point
Continuously track changes to the information system that may affect
security controls and reassess control effectiveness.
MONITORSecurity Controls
AUTHORIZE Information System
Determine risk to organizational operations and assets, individuals,
other organizations, and the Nation;if acceptable, authorize operation.
Implement security controls within enterprise architecture using sound
systems engineering practices; apply security configuration settings.
IMPLEMENT Security Controls
SELECT Security Controls
Select baseline security controls; apply tailoring guidance and
supplement controls as needed based on risk assessment.
Joint Task Force Transformation Initiative
Office of the Director of National IntelligenceDepartment of DefenseCommittee on National Security SystemsNational Institute of Standards and Technology
Publications
NIST Special Publication 800-37 Revision 1: Guide for Security Authorization of Federal Information Systems: A Security Lifecycle Approach
NIST Special Publication 800-53 Revision 3: Recommended Security Controls for Federal Information Systems and Organizations
NIST Special Publication 800-39: Managing Risk from Information Systems: An Organizational Perspective
Separate National Security System Documents
Security Categorization:NIST FIPS 199 → CNSS Instruction 1199
Security Controls:NIST SP 800-53 → CNSS Instruction 1253
Security Control Assessment:NIST SP 800-53A → CNSS Instruction 1253A
Security Authorization:NIST SP 800-37 = NIST SP 800-37
Continuous Monitoring:NIST SP 800-37 = NIST SP 800-37NIST SP 800-53A → CNSS Instruction 1253A
Three Phases1. Preparing For The Authorization2. Conducting The Authorization3. Maintaining The Authorization
Continuous Monitoring
Security Content Automation Protocol
Phase II: Organizational Credentialing Program
Credentialing organizations to provide security assessmentsTraining Initiative:
Quick Start Guides, FAQs, and training class materialProduct and Services Assurance Assessment Initiative
Product specific guidance on 800-53 controlsSupport Tools Initiative:
Checklists, programs, protocols, referencesHarmonization Initiative:
ISO 27000, ISO 9000, ISO 17000
Senate Bill S. 3474 (110th Congress)
Federal Information Security Management Act of 2008Sponsored by:
Tom Carper (D-DE)Joseph Lieberman (I-CT)
Creates CISO RoleCreates CISO CouncilRequires audits, not evaluationsDHS - Annual operational evaluations
Senate Bill S. 921
United States Information and Communications Enhancement Act of 2009
Sponsored by Tom Carper (D-DE)No AuditsNo CISO Council
Senate Bills S. 773 & S. 778
Cybersecurity Act of 2009 and Sponsored by:
John (Jay) Rockefeller (D-WV)Olympia J. Snowe (R-Maine)
Cyber-Katrina
S. 778: Establish Office of the National Cybersecurity Advisor
What Else?• Bluetooth Security• Border Gateway Protocol (BGP) Security• Cell Phone Forensics• Cell Phone and PDA Security• Computer Security Log Management• Contingency Planning• DNSSEC• Electronic Mail Security• Engineering Principles for Security• Enterprise Password Management• Firewalls and Firewall Policy• General Server Security• IPsec VPNs
What Else?• Implementing Cryptography• Industrial Control Systems Security (SCADA)• Information Security Handbook• Information Security Training• Integrating Forensic Techniques into Incident Response• Introduction to Computer Security• Intrusion Detection and Prevention Systems (IDPS)• Malware Incident Prevention and Handling• Managing Risk• Media Sanitization• Mobile Agent Security• Network Security Testing• PBX Vulnerability Analysis
What Else?• PDA Forensics• PKI Specifications• Patch and Vulnerability Management• Performance Measurement for Information Security• Protecting the Confidentiality of Personally Identifiable Information (PII)• Radio Frequency Identification (RFID) Systems• Risk Management• SSL VPNs• Secure Web Services• Securing Public Web Servers• Security Awareness and Training• Security Configuration Checklists• Security for VOIP Systems
What Else?• Security Content Automation Protocol (SCAP)• Security Controls• Security Incident Handling• Security Metrics• Security for Telecommuting and Broadband Communications• Selecting IT Security Products• Storage Encryption Technologies• System Development Life Cycle• Technical Information Security Testing and Assessment• Technical Models for IT Security• Telecommunications Security• Telework and Remote Access• Wireless Robust Security Networks
Links:NIST Special Publications:
http://csrc.nist.gov/publications/PubsSPs.htmlNIST FIPS Publications:
http://csrc.nist.gov/publications/PubsFIPS.htmlNIST Draft Publications:
http://csrc.nist.gov/publications/PubsDrafts.htmlNIST Interagency Reports:
http://csrc.nist.gov/publications/PubsNISTIRs.htmlNIST ITL Security Bulletins:
http://csrc.nist.gov/publications/PubsITLSB.htmlOMB Memoranda:
http://www.whitehouse.gov/omb/memoranda_default/
Links:Security Content Automation Protocol:
http://nvd.nist.gov/scap.cfmFederal Desktop Core Configuration:
http://nvd.nist.gov/fdcc/index.cfmNational Checklist Program (SP 800-70):
http://checklists.nist.gov/Security Technical Implementation Guides (STIGS):
http://iase.disa.mil/stigs/index.htmlNSA Security Configuration Guides:
http://www.nsa.gov/ia/guidance/security_configuration_guides/index.shtmlThe Center for Internet Security (CIS):
http://www.cisecurity.org/benchmarks.html
Links:Assessment Cases for SP 800-53A:
http://csrc.nist.gov/groups/SMA/fisma/assessment-cases-overview.html
Federal Computer Security Program Managers' Forum:http://csrc.nist.gov/groups/SMA/forum/index.html
Validated FIPS 140-1 and FIPS 140-2 Cryptographic Modules:
http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm
Federal Information Systems Security Educators' Association (FISSEA):http://csrc.nist.gov/groups/SMA/fissea/index.html
National Vulnerability Database:http://nvd.nist.gov/
Links:
FISMApedia.org:http://fismapedia.org/index.php?title=Main_Page
Guerilla-CISO.comhttp://www.guerilla-ciso.com/
How Is That Assurance Evidence?http://howisthatassuranceevidence.blogspot.com/
top related