DIARMF Select

DIARMF – FIPS 200, CNSSI-1253 & NIST SP 800-53

The documents for putting DIARMF Categorization and Selection of security controls together are FIPS 200, CNSSI-1253 and NIST SP 800-53. DoD 8510 is based on these documents.

FIPS 200, Minimum Security Requirements for Federal Information and Information Systems is a bridge between the FIPS 199 and the security controls documented in NIST SP 800-53. It sets forth the initial set of baseline security controls for your system based on the system impact level and minimum security requirements FIPS 200 is a very short document that explains the levels of impact that your system has based on your systems security categorization and how the security controls will be selected.

FIPS 200 mentions seventeen security-related areas (more current revisions of SP 800-53 have more security areas) with regard to protecting the confidentiality, integrity, and availability of data processed, transmitted and stored on government systems. The security-related areas include:

access control
awareness and training
audit and accountability
certification, accreditation security assessments
configuration management
contingency planning
identification and authentication
incident response
maintenance
media protection
physical and environmental protection
planning
personnel security
risk assessment
systems and services acquisition
system and communications protection
system and information integrity

Addressing each of the 17 DIARMF areas will give the organization a comprehensive selection of security controls. These controls address technical, operational and management aspects of security and risk management.

The DIARMF Selected security controls come from NIST SP 800-53, Recommended Security Controls for Federal Information Systems and Organizations. Recommended Security controls are prescribe to the security categorization of your system.

Initial Set of Baseline Security Controls

The 17 DIARMF areas are broken out in NIST SP 800-53 Appendix D. Appendix D is the DIARMF Initial Set Baseline Security Controls. CNSSI 1253, Security Categorization and control Selection for National Security Systems is specifically for National Security systems and offers a few alternatives to normal federals systems.

What are National Security Systems?

(OMB Circular A-130, FIPS 200, NIST 137) Any telecommunications or information system operated by the United States Government, the function, operation, or use of which (1) involves intelligence activities; (2) involves cryptologic activities related to national security; (3) involves command and control of military forces; (4) involves equipment that is an integral part of a weapon or weapons system; or (5) is critical to the direct fulfillment of military or intelligence missions, but excluding any system that is to be used for routine administrative and business applications (including payroll, finance, logistics, and personnel management applications).

The differences are based on specific challenges of national security systems (aka mission systems) that set them apart from normal federals systems. The following adjustments are mentioned in CNSSI to deal with NSS systems:

NO “High Water Mark” – normally federal systems are take on impact level of their most important security factor. NSS systems don’t apply HWM. Instead, confidentiality, integrity and availability retain their impact levels.

Confidentiality is treated different – Other factors affect confidentiality: aggregation of information on the system, system environment, and attributes of users. For example, and IP address by itself is not classified, but an IP and a vulnerability and the system description and location is probably classified.

Appendix K, Overlay – NSS have to use security overlays in addition to the initial security baseline. See CNSSI for more details.

Reciprocity – One of the biggest problems with the old C&A was that when one military unit would have a need to connect to a military or intel unit from a different branch, they would end up having to do two or three different C&A processes. This was VERY costly.. and stupid. So the new DIARMF is pushing away from that with Reciprocity. Its something they started during DIACAP with different degrees of success.

http://www.sandia.gov/FSO/PDF/flowdown/Final_CNSSI_1253.pdf

Tailoring Controls

Tailoring means aligning the selected security controls to your system. For example, if you have a bunch of security controls that apply to Internet browsers. And the controls are designed to minimize the possibility of your browser being hacked from the Internet. But your system HAS NO INTERNET CONNECTION and only uses browsers for reading HTML based manuals on your Internal network. If you are tailoring, you could cut all those security controls out because they are not applicable to your network.

You are applying ONLY security baseline controls that fit within the SCOPE of your systems capabilities. And you are applying the MOST critical controls over more expensive security controls that have little or no impact to minimizing the risk. So scoping and tailoring is something that requires a security professional and someone that knows the system well enough to know what controls are really needed and which one are not.

DIARMF-Select Documentation

During the selection process your Information System Security Officer should be working on the System Security Plan. The details of what the SSP looks like is in NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems. The SSP is like your play book on what will be implemented and why.

It should be robust enough to guide the implementation of the security controls but flexible enough so that you can continue to add to it during the implementation process.

After the implementation of the security controls, the SSP will be needed for the Assessment of the security controls.