ConvoCourses

Cyber Security Compliance and IT Jobs

DIARMF

Job position for DIACAP Compliance Engineer at Tarrytown, NY

by Leave a Comment

Role: DIACAP Compliance Engineer
Location: Tarrytown, NY
Duration: 6+ months

Keywords: – STIG, TFS, DevOps, Windows Imaging WIX, MSI, PowerShell, Anti-Virus, Whitelisting

Job Description:
Background
Source code management (SCM) & DEVOPS team (Infrastructure Team) manages the entire continuous integration, continues development chain process of a global Engineering conglomerate.
Application is developed using Microsoft technology C#, C++, WPF, MVVM and custom control on Windows-7 platform. The backbone of the entire SCM is Microsoft TFS while the packaging strategy is utilizing MSI and WIX. The current build management is driven by customized XMAL with PowerShell usage. Now the plans are to move to VNEXT that provides flexibility as an orchestrator and allows better reporting, triggering and logging facility.
The Goal of this team is to make the entire infrastructure to be in compliant with DIACAP (DoD Information Assurance Certification and Accreditation) process

Expectations – The team is looking out for Engineers who can augment the current team and support on following tasks
This means the identified engineer needs experience in DIACAP process (not knowledge) on how the system could be transformed to be DIACAP compliant system.
• Experienced in the Security Technical Implementation Guide (STIG) that provides security guidance for .NET deployments in workstations or servers and focuses on the secure configuration of the .NET Common Language Runtime (CLR).
• Identify loopholes and open items as part of IIS 7.0 Web Server to ensure that the IIS 7.0 becomes STIG compliant and thus related request handling and filtering are done in control manner and encryption is applied for protocols or data exchange for HTTP, FTP or telnet and more of such tasks etc.
• Ensuring the basic need of McAfee VirusScan 8.8 Managed Client STIG that highly suggests to have antivirus to be monitoring 24*7 along with no possibility of stoppage of such services and availability of antivirus signed files almost every day
• Ensure security enablement in Microsoft Internet Explorer 11 client used on Windows-7 workstations like script execution, popup restrictions as needed and stoppage of unsigned ACTIVEX controls
• Experience in interpreting STIG scans that reflect results on periodic basis.
• Experience in working on adding check and controls in build management system that automates scans ensure STIG compliance.

Soft Skills
• Good Team Player
• Good Written and verbal communication skills
• Customer facing experience would be added advantage

www.enterprisesolutioninc.com Pradyut Bhattacharya
Enterprise Solution Inc.
500 E. Diehl Road, Suite 130, Naperville, IL 60563
Office: # 630-214-9485

Information Security Framework aka System Compliance

by Leave a Comment

What are Cyber Security Standards?
These are rules that put in place to protect every aspect of an information system.

Also know as information system security standards, information security framework, security system compliance, information system compliance, risk management framework. There are also many types that specialize on different functions of a given industry. For example the medical industry has a standard for protecting patient information called HIPAA which is an acronym for the Health Insurance Portability and Accountability Act that was passed by Congress in 1996. And there is a standard for protecting point of sale and merchant systems called PCI. There are many others.. but the mission is the same… to protect the confidentiality, availability and integrity of important data.

Risk Management Framework (RMF) for DoD Information Technology (IT)

by Leave a Comment

The Risk Management Framework (RMF) Knowledge Service is DoD CIO’s authoritative source for implementing the RMF and DIACAP: https://rmfks.osd.mil/ *not a public site*

DoD RMF Documentation:

The DoD RMF is based on DoDI 8500.01, Cybersecurity and DoDI 8500.01, Risk Management Framework (http://iase.disa.mil/rmf/Pages/guidance.aspx).

DoDI 8500.01 – Cybersecurity
This DoD Instruction replaces the previous Information Assurance (IA) guidance under DoDD 8500.01, November 21, 2003.

DoDI 8510.01 – Risk Management Framework (RMF) for DoD Information Technology (IT)
This DoD Instruction replaces the previous DIACAP guidance under DoDI 8510.01, November 28, 2007.

 

Cybersecurity and RMF
Cybersecurity and RMF

These policies refer to the NIST 800 series.  Specifically, NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems and NIST SP 800-53 rev 4, Security and Privacy Controls for Federal.

CNSS RMF Guidance:
CNSSI No. 1253 for CNSS Home page and select “Instructions” from Library drop down.
Security Categorization and Control Selection for National Security Systems – This document replaces previous version dated 3 March 2012. Overlays are now Appendix F vice K.

RMF Knowledge Service (RMFKS)

by Leave a Comment

The DoD CIO gave an overview of the Risk Management Framework (RMF) transition.  The Risk Management Framework Knowledge Service (RMFKS) is a central repository for RMF DoD for IT.  This site is up for access as long as you have a Common Access Card (CAC) or ECA cert.  The link is below but some of the links on the site are still under construction.

Information Assurance
Information Assurance

The former site was for certification & accreditation / risk management was the DIACAP Knowledge Service (https://diacap.iaportal.navy.mil/).

 

DIARMF or RMF

by Leave a Comment

You keep hearing the term DIARMF, but the name of the new DoD 8510.01 document is simple RMF.

DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT), March 14, has been released.

So why do people keep calling it DIARMF?  The draft version of DoDI 8510.01 floated around for almost 3 years and it was called DIARMF.  Basically, when officials first started talking about using NIST SP 800-37 Risk Management Framework as the new DIACAP, the name DIARMF stuck.

The official name is RMF.

 

Risk Management Framework For DoD IT

by Leave a Comment

Risk Management For DoD IT

DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT), March 14, has been released.

The Risk Management Framework For DoD IT, establishes DoDD 8500, Cybersecurity policy, and assigning responsibilities for executing and maintaining the RMF.  The Risk Management Framework For DoD IT replaces the DoD Information Assurance Certification and Accreditation Process (DIACAP) and manages the life-cycle cybersecurity risk to DoD IT.

The RMF renames the DIACAP Technical Advisory Group to the RMF TAG.

A couple of big changes are that it moves away from the term “Information Assurance” as much as possible.  It also address some of the biggest issues of DIACAP right away:

“[RMF] Provides procedural guidance for the reciprocal acceptance of authorization decisions and artifacts within DoD, and between DoD and other federal agencies, for the authorization and connection of information systems (ISs).”

One of the biggest issues with DIACAP is that different organization would have a different DIACAP process and so if, for example, Unit Sample Army wanted to connect to Flight A Airforce system, someone (or both) would have to redo their process.

How much does Risk Management Framework For DoD IT take from NIST?

See for yourself:

RMF GOVERNANCE. The DoD RMF governance structure implements the three-tiered

approach to cybersecurity risk management described in NIST SP 800-39 (Reference (i)),

synchronizes and integrates RMF activities across all phases of the IT life cycle, and spans
logical and organizational entities