• Skip to main content
  • Skip to primary sidebar

ConvoCourses

Cyber Security Compliance and IT Jobs

  • Cyber Security Training
  • about me.
  • Information Assurance Jobs

DIARMF

Job position for DIACAP Compliance Engineer at Tarrytown, NY

June 29, 2018 by Leave a Comment

Role: DIACAP Compliance Engineer
Location: Tarrytown, NY
Duration: 6+ months

Keywords: – STIG, TFS, DevOps, Windows Imaging WIX, MSI, PowerShell, Anti-Virus, Whitelisting

Job Description:
Background
Source code management (SCM) & DEVOPS team (Infrastructure Team) manages the entire continuous integration, continues development chain process of a global Engineering conglomerate.
Application is developed using Microsoft technology C#, C++, WPF, MVVM and custom control on Windows-7 platform. The backbone of the entire SCM is Microsoft TFS while the packaging strategy is utilizing MSI and WIX. The current build management is driven by customized XMAL with PowerShell usage. Now the plans are to move to VNEXT that provides flexibility as an orchestrator and allows better reporting, triggering and logging facility.
The Goal of this team is to make the entire infrastructure to be in compliant with DIACAP (DoD Information Assurance Certification and Accreditation) process

Expectations – The team is looking out for Engineers who can augment the current team and support on following tasks
This means the identified engineer needs experience in DIACAP process (not knowledge) on how the system could be transformed to be DIACAP compliant system.
• Experienced in the Security Technical Implementation Guide (STIG) that provides security guidance for .NET deployments in workstations or servers and focuses on the secure configuration of the .NET Common Language Runtime (CLR).
• Identify loopholes and open items as part of IIS 7.0 Web Server to ensure that the IIS 7.0 becomes STIG compliant and thus related request handling and filtering are done in control manner and encryption is applied for protocols or data exchange for HTTP, FTP or telnet and more of such tasks etc.
• Ensuring the basic need of McAfee VirusScan 8.8 Managed Client STIG that highly suggests to have antivirus to be monitoring 24*7 along with no possibility of stoppage of such services and availability of antivirus signed files almost every day
• Ensure security enablement in Microsoft Internet Explorer 11 client used on Windows-7 workstations like script execution, popup restrictions as needed and stoppage of unsigned ACTIVEX controls
• Experience in interpreting STIG scans that reflect results on periodic basis.
• Experience in working on adding check and controls in build management system that automates scans ensure STIG compliance.

Soft Skills
• Good Team Player
• Good Written and verbal communication skills
• Customer facing experience would be added advantage

www.enterprisesolutioninc.com Pradyut Bhattacharya
Enterprise Solution Inc.
500 E. Diehl Road, Suite 130, Naperville, IL 60563
Office: # 630-214-9485

Filed Under: cyberspace workforce, DIACAP, DIARMF Jobs, Information Assurance Jobs, IT Security Jobs, risk jobs, STIGS Tagged With: DIACAP, DIARMF, job, PowerShell, risk management frameworkd, rmf, rmf jobs, Source code management (SCM), STIG, windows, writing

Information Security Framework aka System Compliance

January 15, 2016 by Bruce Brown Leave a Comment

What are Cyber Security Standards?
These are rules that put in place to protect every aspect of an information system.

Also know as information system security standards, information security framework, security system compliance, information system compliance, risk management framework. There are also many types that specialize on different functions of a given industry. For example the medical industry has a standard for protecting patient information called HIPAA which is an acronym for the Health Insurance Portability and Accountability Act that was passed by Congress in 1996. And there is a standard for protecting point of sale and merchant systems called PCI. There are many others.. but the mission is the same… to protect the confidentiality, availability and integrity of important data.

Filed Under: cyberspace workforce, information system compliance Tagged With: CISSP, compliance, cybersecurity framework, DIACAP, DIARMF, DSS, framework, hippa, ISO 27001, PCI, rmf, sarbanes oxley, SOX, system compliance

Risk Management Framework (RMF) for DoD Information Technology (IT)

March 30, 2015 by Bruce Brown Leave a Comment

The Risk Management Framework (RMF) Knowledge Service is DoD CIO’s authoritative source for implementing the RMF and DIACAP: https://rmfks.osd.mil/ *not a public site*

DoD RMF Documentation:

The DoD RMF is based on DoDI 8500.01, Cybersecurity and DoDI 8500.01, Risk Management Framework (http://iase.disa.mil/rmf/Pages/guidance.aspx).

DoDI 8500.01 – Cybersecurity
This DoD Instruction replaces the previous Information Assurance (IA) guidance under DoDD 8500.01, November 21, 2003.

DoDI 8510.01 – Risk Management Framework (RMF) for DoD Information Technology (IT)
This DoD Instruction replaces the previous DIACAP guidance under DoDI 8510.01, November 28, 2007.

 

Cybersecurity and RMF
Cybersecurity and RMF

These policies refer to the NIST 800 series.  Specifically, NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems and NIST SP 800-53 rev 4, Security and Privacy Controls for Federal.

CNSS RMF Guidance:
CNSSI No. 1253 for CNSS Home page and select “Instructions” from Library drop down.
Security Categorization and Control Selection for National Security Systems – This document replaces previous version dated 3 March 2012. Overlays are now Appendix F vice K.

Filed Under: DIARMF, NIST Security Framework, risk management, Risk Management For DoD IT Tagged With: 8500.01, 8500.1, 8510, CNSS, DIARMF, NIST 800-37, NIST 800-53, Risk Management Framework (RMF), Risk Management Framework (RMF) for DoD Information Technology (IT), rmf

RMF Knowledge Service (RMFKS)

May 21, 2014 by Bruce Brown Leave a Comment

The DoD CIO gave an overview of the Risk Management Framework (RMF) transition.  The Risk Management Framework Knowledge Service (RMFKS) is a central repository for RMF DoD for IT.  This site is up for access as long as you have a Common Access Card (CAC) or ECA cert.  The link is below but some of the links on the site are still under construction.

  • rmfks.osd.mil 
Information Assurance
Information Assurance

The former site was for certification & accreditation / risk management was the DIACAP Knowledge Service (https://diacap.iaportal.navy.mil/).

 

Filed Under: certification & accreditation, DIACAP, DIARMF, Information Assurance, NIST Security Framework, RDIT, risk management, Risk Management For DoD IT Tagged With: DIACAP, DIARMF, knowledge service, rmf, RMF Knowledge Service, RMFKS

DIARMF or RMF

May 19, 2014 by Bruce Brown Leave a Comment

You keep hearing the term DIARMF, but the name of the new DoD 8510.01 document is simple RMF.

DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT), March 14, has been released.

So why do people keep calling it DIARMF?  The draft version of DoDI 8510.01 floated around for almost 3 years and it was called DIARMF.  Basically, when officials first started talking about using NIST SP 800-37 Risk Management Framework as the new DIACAP, the name DIARMF stuck.

The official name is RMF.

 

Filed Under: DIARMF, Risk Management For DoD IT Tagged With: DIARMF, rmf

Risk Management Framework For DoD IT

March 13, 2014 by Bruce Brown Leave a Comment

Risk Management For DoD IT

DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT), March 14, has been released.

The Risk Management Framework For DoD IT, establishes DoDD 8500, Cybersecurity policy, and assigning responsibilities for executing and maintaining the RMF.  The Risk Management Framework For DoD IT replaces the DoD Information Assurance Certification and Accreditation Process (DIACAP) and manages the life-cycle cybersecurity risk to DoD IT.

The RMF renames the DIACAP Technical Advisory Group to the RMF TAG.

A couple of big changes are that it moves away from the term “Information Assurance” as much as possible.  It also address some of the biggest issues of DIACAP right away:

“[RMF] Provides procedural guidance for the reciprocal acceptance of authorization decisions and artifacts within DoD, and between DoD and other federal agencies, for the authorization and connection of information systems (ISs).”

One of the biggest issues with DIACAP is that different organization would have a different DIACAP process and so if, for example, Unit Sample Army wanted to connect to Flight A Airforce system, someone (or both) would have to redo their process.

How much does Risk Management Framework For DoD IT take from NIST?

See for yourself:

RMF GOVERNANCE. The DoD RMF governance structure implements the three-tiered

approach to cybersecurity risk management described in NIST SP 800-39 (Reference (i)),

synchronizes and integrates RMF activities across all phases of the IT life cycle, and spans
logical and organizational entities

Filed Under: RDIT, Risk Management For DoD IT Tagged With: cybersecurity, DIARMF, dod risk management, DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT), RDIT, Risk Management For DoD IT, Risk Management Framework For DoD IT, rmf

  • Go to page 1
  • Go to page 2
  • Go to page 3
  • Go to page 4
  • Go to Next Page »

Primary Sidebar

search

Learn to Make 6 Figures in CyberSecurity

Cyber Security How to make up to 6 Figures
6 figures in Cyber Security

This course explains how I have been able to consistently make 6 figures doing cyber security. There is a method that I have used during my development in cyber security. I am presenting that method to you.

View Course

Teleworking - IT Remote Work
Teleworking – IT Remote Work

Teleworking is something I have been doing for the last 5 years. This is how I did it.

Find Teleworking IT Jobs

View Course

RMF ISSO Foundations Training
RMF ISSO Foundations Training

RMF ISSO Foundations

I was an Information System Security Officer (ISSO) doing Risk Management Framework (NIST SP 800-37) for over a decade. I am a Cybersecurity veteran and I can explain (in plain English) what you DO in the Risk Management Framework process as an ISSO.

View Course

NIST SP 800-37 Presentation
NIST SP 800-37 Presentation

View Course

login

  • Register
  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org

Recent Posts

  • Implementation of security controls resources part 1
  • Convocourses Podcast: course update continuous monitoring and other issues
  • Convocourses Podcast: RMF Course Updates New & NIST-53a
  • ConvoCourses Podcast: Get Into IT from other fields
  • convocourses podcast: RMF Course Updates New NIST 800-53

Meta

  • Register
  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org

Recent Comments

  • horloge on SCAP Compliance Checker SCC)
  • 218 Information assurance Success Criteria – ITSECURITYSURVIVAL.COM on Information Assurance Vulnerability Alert
  • Disa Help Desk | VinHomesData.com on STIG Update – DISA has released the Oracle Java Runtime Environment (JRE) 8 STIG Version 1
  • Bruce Brown on DIARMF – Continuous Monitoring
  • dpresbit on DIARMF – Continuous Monitoring

Tags

8140 8570 ArcSight c&a CISSP colorado cyber cybersecurity cyber security denver DIACAP DIARMF diarmf - implement disa DISA STIG dodd 8140 dodd 8140 cyberspace workforce HBSS IA implement implementation info assurance information assurance information security ISSO job jobs Linux mcafee nist nist risk management framework nist risk management framework 800-37 podcast risk risk assessment risk management risk management framework rmf security SIEM STIG stigs unix VMWare windows

Copyright © 2021 · Author Pro on Genesis Framework · WordPress · Log in