rmf security controls

Risk assessment table is usually a 2 dimensional matrix used to measure the likelihood of risk by matching vulnerability, assets, threats and/or impacts of threats to vulnerability of assets.

A risk assessment table can be homemade. Homemade might be best because the no one knows better than they organization the landscape within their information systems infrastructure, the threats associated or the importance of the assets should they get compromised.

nist risk management framework 800-37

February 1, 2014 by Bruce Brown Leave a Comment

NIST risk management framework 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems (revision 1) marked a change from the old NIST 800-37 that was based on Certification & Accreditation. The adjustment stems from FISMA 2002 and includes the following changes:

Revised process emphasizes
Building information security capabilities into federal information systems through the application of state-of-the-practice management, operational, and technical security controls
Maintaining awareness of the security state of information systems on an ongoing basis though enhanced monitoring processes
Providing essential information to senior leaders to facilitate decisions regarding the acceptance of risk to organizational operations and assets, individuals, other organizations, and the Nation arising from the operation and use of information systems

The DoD has recently adopted the NIST risk management framework 800-37 steps (called the DIARMF process). There are 6 step: Categorize, Select, Implement, Assess, Authorize and Continuous Monitor.

: risk management framework steps

nist risk management framework 800-37 – Step 1. Categorize

The first risk management framework step is categorization. This step consists of classifying the importance of the information system. This is done by the system owner with FIPS 199 and NIST 800-60.

Categorization is based on how much negative impact the organization will receive if the information system lost is confidentiality, integrity or availability.

nist risk management framework 800-37 – Step 2. Select

With FIPS 200 and NIST SP 800-53, the organization responsible for the systems security will select the security controls required to limit the risk to their organization. The selection of the controls is based on the categorization of your system. A system security plan is created as a guide to what will be installed and/or configured on the system.

nist risk management framework 800-37 – Step 3. Implement

Using the System Security Plan, the organization responsible for the categorized system can begin risk management framework step 3. This step is implementation which is installation and configuration of security patches, hotfixes and security devices where necessary. Guidance for actual implantation has to come from technical manuals, system administrators, system engineers and others technically competent enough to do the work.

nist risk management framework 800-37 – Step 4. Assess

The organization has to make sure that the security controls are implemented properly. This is done in risk management step 4, assess. Using NIST SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations is used to determine which controls have been fully implemented to limit the risks to the organization.

nist risk management framework 800-37 – Step 5. Authorize

Even after implementation and assessment of the security controls that limits the over all risk to the organization, there is some remaining (residual) risk. The organization must have someone who has enough authority of over the system to accept the residual risk. This person is known as the Authorizing Official.

In risk management framework step 5, an Authorizing Official makes a formal, written acceptance of the risks. The AO makes a decision on whether or not to accept the risk based on the authorization package. The authorization package consists of the system security plan, plan of action and milestone, security/risk assessment report and any other supporting documents.

nist risk management framework 800-37 – Step 6. Continuous Monitoring

After acceptance of risk by the organization, they must develop a program that monitors the ongoing changes to the systems security posture. They take a proactive approach to watching for advanced persistent threats, configuration changes and new vulnerabilities. Risk management framework step 6 handles all of this.

More on DIARMF – Continuous Monitoring

DIARMF Select

January 16, 2014 by Bruce Brown 2 Comments

DIARMF Select

DIARMF – FIPS 200, CNSSI-1253 & NIST SP 800-53

The documents for putting DIARMF Categorization and Selection of security controls together are FIPS 200, CNSSI-1253 and NIST SP 800-53. DoD 8510 is based on these documents.

FIPS 200, Minimum Security Requirements for Federal Information and Information Systems is a bridge between the FIPS 199 and the security controls documented in NIST SP 800-53. It sets forth the initial set of baseline security controls for your system based on the system impact level and minimum security requirements FIPS 200 is a very short document that explains the levels of impact that your system has based on your systems security categorization and how the security controls will be selected.

FIPS 200 mentions seventeen security-related areas (more current revisions of SP 800-53 have more security areas) with regard to protecting the confidentiality, integrity, and availability of data processed, transmitted and stored on government systems. The security-related areas include:

access control
awareness and training
audit and accountability
certification, accreditation security assessments
configuration management
contingency planning
identification and authentication
incident response
maintenance
media protection
physical and environmental protection
planning
personnel security
risk assessment
systems and services acquisition
system and communications protection
system and information integrity

Addressing each of the 17 DIARMF areas will give the organization a comprehensive selection of security controls. These controls address technical, operational and management aspects of security and risk management.

The DIARMF Selected security controls come from NIST SP 800-53, Recommended Security Controls for Federal Information Systems and Organizations. Recommended Security controls are prescribe to the security categorization of your system.

Initial Set of Baseline Security Controls

The 17 DIARMF areas are broken out in NIST SP 800-53 Appendix D. Appendix D is the DIARMF Initial Set Baseline Security Controls. CNSSI 1253, Security Categorization and control Selection for National Security Systems is specifically for National Security systems and offers a few alternatives to normal federals systems.

What are National Security Systems?

(OMB Circular A-130, FIPS 200, NIST 137) Any telecommunications or information system operated by the United States Government, the function, operation, or use of which (1) involves intelligence activities; (2) involves cryptologic activities related to national security; (3) involves command and control of military forces; (4) involves equipment that is an integral part of a weapon or weapons system; or (5) is critical to the direct fulfillment of military or intelligence missions, but excluding any system that is to be used for routine administrative and business applications (including payroll, finance, logistics, and personnel management applications).

The differences are based on specific challenges of national security systems (aka mission systems) that set them apart from normal federals systems. The following adjustments are mentioned in CNSSI to deal with NSS systems:

NO “High Water Mark” – normally federal systems are take on impact level of their most important security factor. NSS systems don’t apply HWM. Instead, confidentiality, integrity and availability retain their impact levels.

Confidentiality is treated different – Other factors affect confidentiality: aggregation of information on the system, system environment, and attributes of users. For example, and IP address by itself is not classified, but an IP and a vulnerability and the system description and location is probably classified.

Appendix K, Overlay – NSS have to use security overlays in addition to the initial security baseline. See CNSSI for more details.

Reciprocity – One of the biggest problems with the old C&A was that when one military unit would have a need to connect to a military or intel unit from a different branch, they would end up having to do two or three different C&A processes. This was VERY costly.. and stupid. So the new DIARMF is pushing away from that with Reciprocity. Its something they started during DIACAP with different degrees of success.

http://www.sandia.gov/FSO/PDF/flowdown/Final_CNSSI_1253.pdf

Tailoring Controls

Tailoring means aligning the selected security controls to your system. For example, if you have a bunch of security controls that apply to Internet browsers. And the controls are designed to minimize the possibility of your browser being hacked from the Internet. But your system HAS NO INTERNET CONNECTION and only uses browsers for reading HTML based manuals on your Internal network. If you are tailoring, you could cut all those security controls out because they are not applicable to your network.

You are applying ONLY security baseline controls that fit within the SCOPE of your systems capabilities. And you are applying the MOST critical controls over more expensive security controls that have little or no impact to minimizing the risk. So scoping and tailoring is something that requires a security professional and someone that knows the system well enough to know what controls are really needed and which one are not.

DIARMF-Select Documentation

During the selection process your Information System Security Officer should be working on the System Security Plan. The details of what the SSP looks like is in NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems. The SSP is like your play book on what will be implemented and why.

It should be robust enough to guide the implementation of the security controls but flexible enough so that you can continue to add to it during the implementation process.

After the implementation of the security controls, the SSP will be needed for the Assessment of the security controls.