• Skip to main content
  • Skip to primary sidebar

ConvoCourses

Cyber Security Compliance and IT Jobs

  • Cyber Security Training
  • about me.
  • Information Assurance Jobs

rmf security controls

IT Experience by Asking and Volunteering

November 6, 2021 by Bruce Brown Leave a Comment

Sign up for free at http://convocourses.com for deeper dives.  

Many more videos on https://www.youtube.com/convocourses

short videos at https://www.tiktok.com/@convocourses?lang=en

and https://www.instagram.com/convocourses/

https://www.facebook.com/ConvoCourses-108091850619388

Podcast version of the content:

https://podcasts.apple.com/us/podcast/convocourses/id1500188278

http://www.nist80037rmf.com/google_podcast

Filed Under: convocourses, cyberspace workforce, IT Certifications, IT Security Jobs Tagged With: cybersecurity, IT, IT Experience by Asking and Volunteering, IT volunteering, rmf security controls

How long does it take to get to 6 figures

November 6, 2021 by Bruce Brown Leave a Comment

Sign up for free at http://convocourses.com for deeper dives.  

Many more videos on https://www.youtube.com/convocourses

short videos at https://www.tiktok.com/@convocourses?lang=en

and https://www.instagram.com/convocourses/

https://www.facebook.com/ConvoCourses-108091850619388

Podcast version of the content:

https://podcasts.apple.com/us/podcast/convocourses/id1500188278

http://www.nist80037rmf.com/google_podcast

Filed Under: convocourses, cyberspace workforce, DIARMF Jobs Tagged With: How long does it take to get to 6 figures, it jobs, IT six figures, rmf security controls, six fig, Six Figures

risk assessment table

February 5, 2014 by Bruce Brown Leave a Comment

Risk assessment table is usually a 2 dimensional matrix used to measure the likelihood of risk by matching vulnerability, assets, threats and/or impacts of threats to vulnerability of assets.

A risk assessment table can be homemade.  Homemade might be best because the no one knows better than they organization the landscape within their information systems infrastructure, the threats associated or the importance of the assets should they get compromised.

risk management table1
risk management table1

risk management table

Filed Under: NIST Security Framework, risk management Tagged With: risk assessment, risk assessment table, risk management, rmf, rmf security controls

nist risk management framework 800-37

February 1, 2014 by Bruce Brown Leave a Comment

NIST risk management framework 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems (revision 1) marked a change from the old NIST 800-37 that was based on Certification & Accreditation.   The adjustment stems from FISMA 2002 and includes the following changes:

  1. Revised process emphasizes
  2. Building information security capabilities into federal information systems through the application of state-of-the-practice management, operational, and technical security controls
  3. Maintaining awareness of the security state of information systems on an ongoing basis though enhanced monitoring processes
  4. Providing essential information to senior leaders to facilitate decisions regarding the acceptance of risk to organizational operations and assets, individuals, other organizations, and the Nation arising from the operation and use of information systems

The DoD has recently adopted the NIST risk management framework 800-37 steps (called the DIARMF process).  There are 6 step: Categorize, Select, Implement, Assess, Authorize and Continuous Monitor.

risk management framework steps
risk management framework steps

nist risk management framework 800-37 – Step 1. Categorize

The first risk management framework step is categorization.  This step consists of classifying the importance of the information system.   This is done by the system owner with FIPS 199 and NIST 800-60.

Categorization is based on how much negative impact the organization will receive if the information system lost is confidentiality, integrity or availability.

 

nist risk management framework 800-37 – Step 2. Select

With FIPS 200 and NIST SP 800-53, the organization responsible for the systems security will select the security controls required to limit the risk to their organization.  The selection of the controls is based on the categorization of your system.  A system security plan is created as a guide to what will be installed and/or configured on the system.

More on DIARMF – Select

nist risk management framework 800-37 – Step 3. Implement

Using the System Security Plan, the organization responsible for the categorized system can begin risk management framework step 3.  This step is implementation which is installation and configuration of security patches, hotfixes and security devices where necessary.   Guidance for actual implantation has to come from technical manuals, system administrators, system engineers and others technically competent enough to do the work.

More on DIARMF – Implement

nist risk management framework 800-37 – Step 4. Assess

The organization has to make sure that the security controls are implemented properly.  This is done in risk management step 4, assess.  Using NIST SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations  is used to determine which controls have been fully implemented to limit the risks to the organization.

More on DIARMF – Assess

nist risk management framework 800-37 – Step 5. Authorize

Even after implementation and assessment of the security controls that limits the over all risk to the organization, there is some remaining (residual) risk.  The organization must have someone who has enough authority of over the system to accept the residual risk.  This person is known as the Authorizing Official.

In risk management framework step 5, an Authorizing Official makes a formal, written acceptance of the risks.  The AO makes a decision on whether or not to accept the risk based on the authorization package.  The authorization package consists of the system security plan, plan of action and milestone, security/risk assessment report and any other supporting documents.

 

More on DIARMF – Authorization

nist risk management framework 800-37 – Step 6. Continuous Monitoring

After acceptance of risk by the organization, they must develop a program that monitors the ongoing changes to the systems security posture.   They take a proactive approach to watching for advanced persistent threats, configuration changes and new vulnerabilities. Risk management framework step 6 handles all of this.

More on DIARMF – Continuous Monitoring

 

Filed Under: certification & accreditation, NIST Security Framework, risk management Tagged With: 800-37, c&a, certifcation and accreditation, Certification and Accreditation, DIARMF, History of C&A, nist risk management framework, nist risk management framework 800-37, nist risk management framework 800-37 rev1, risk management framework, rmf, rmf security controls

DIARMF Select

January 16, 2014 by Bruce Brown 2 Comments

DIARMF Select

DIARMF – FIPS 200, CNSSI-1253 & NIST SP 800-53

The documents for putting DIARMF Categorization and Selection of security controls together are FIPS 200, CNSSI-1253 and NIST SP 800-53.  DoD 8510 is based on these documents.

FIPS 200, Minimum Security Requirements for Federal Information and Information Systems is a bridge between the FIPS 199 and the security controls documented in NIST SP 800-53.  It sets forth the initial set of baseline security controls for your system based on the system impact level and minimum security requirements FIPS 200 is a very short document that explains the levels of impact that your system has based on your systems security categorization and how the security controls will be selected.

courtesy of akhbar.alaan.tv
courtesy of akhbar.alaan.tv

 

 

FIPS 200 mentions seventeen security-related areas (more current revisions of SP 800-53 have more security areas) with regard to protecting the confidentiality, integrity, and availability of data processed, transmitted and stored on government systems.  The security-related areas include:

    • access control
    • awareness and training
    • audit and accountability
    • certification, accreditation security assessments
    • configuration management
    • contingency planning
    • identification and authentication
    • incident response
    • maintenance
    • media protection
    • physical and environmental protection
    • planning
    • personnel security
    • risk assessment
    • systems and services acquisition
    • system and communications protection
    • system and information integrity

Addressing each of the 17 DIARMF areas will give the organization a comprehensive selection of security controls.  These controls address technical, operational and management aspects of security and risk management.

The DIARMF Selected security controls come from NIST SP 800-53, Recommended Security Controls for Federal Information Systems and Organizations.  Recommended Security controls are prescribe to the security categorization of your system.  

Initial Set of Baseline Security Controls

The 17 DIARMF areas are broken out in NIST SP 800-53 Appendix D.  Appendix D is the DIARMF Initial Set Baseline Security Controls.  CNSSI 1253, Security Categorization and control Selection for National Security Systems is specifically for National Security systems and offers a few alternatives to normal federals systems.

What are National Security Systems?

(OMB Circular A-130, FIPS 200, NIST 137) Any telecommunications or information system operated by the United States Government, the function, operation, or use of which (1) involves intelligence activities; (2) involves cryptologic activities related to national security; (3) involves command and control of military forces; (4) involves equipment that is an integral part of a weapon or weapons system; or (5) is critical to the direct fulfillment of military or intelligence missions, but excluding any system that is to be used for routine administrative and business applications (including payroll, finance, logistics, and personnel management applications).

The differences are based on specific challenges of national security systems (aka mission systems) that set them apart from normal federals systems.  The following adjustments are mentioned in CNSSI to deal with NSS systems:

NO “High Water Mark” – normally federal systems are take on impact level of their most important security factor.  NSS systems don’t apply HWM.  Instead, confidentiality, integrity and availability retain their impact levels.

Confidentiality is treated different – Other factors affect confidentiality: aggregation of information on the system, system environment, and attributes of users.  For example, and IP address by itself is not classified, but an IP and a vulnerability and the system description and location is probably classified.  

Appendix K, Overlay – NSS have to use security overlays in addition to the initial security baseline.  See CNSSI for more details.

Reciprocity – One of the biggest problems with the old C&A was that when one military unit would have a need to connect to a military or intel unit from a different branch, they would end up having to do two or three different C&A processes.  This was VERY costly.. and stupid.  So the new DIARMF is pushing away from that with Reciprocity.  Its something they started during DIACAP with different degrees of success.

http://www.sandia.gov/FSO/PDF/flowdown/Final_CNSSI_1253.pdf

Tailoring Controls

Tailoring means aligning the selected security controls to your system.  For example, if you have a bunch of security controls that apply to Internet browsers.  And the controls are designed to minimize the possibility of your browser being hacked from the Internet.  But your system HAS NO INTERNET CONNECTION and only uses browsers for reading HTML based manuals on your Internal network.  If you are tailoring, you could cut all those security controls out because they are not applicable to your network.

You are applying ONLY security baseline controls that fit within the SCOPE of your systems capabilities.  And you are applying the MOST critical controls over more expensive security controls that have little or no impact to minimizing the risk.  So scoping and tailoring is something that requires a security professional and someone that knows the system well enough to know what controls are really needed and which one are not.

DIARMF-Select Documentation

During the selection process your Information System Security Officer should be working on the System Security Plan.  The details of what the SSP looks like is in NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems.  The SSP is like your play book on what will be implemented and why.

It should be robust enough to guide the implementation of the security controls but flexible enough so that you can continue to add to it during the implementation process.  

After the implementation of the security controls, the SSP will be needed for the Assessment of the security controls.

Filed Under: DIARMF, diarmf - select Tagged With: controls, DIARMF, diarmf-select, information assurance controls, information system, rmf security controls

Primary Sidebar

search


This is a breakdown of each of the NIST 800-53 security control families and how they relate to each step in the NIST 800-37 risk management framework process.

also available on Amazon!

View Book


This is a breakdown of each of the NIST 800-53 security control families and how they relate to each step in the NIST 800-37 risk management framework process.

also available on Amazon!

View Book


This book is an overview of how the NIST SP 800-37 risk management framework works from the perspective of an information system security officer (ISSO).

also available on Amazon!

View Book

NIST RMF 800-37 templates
Free 800-37 templates

The NIST 800 Template download contains a .doc file template and xls templates for POAMs, Federal, State, cloud based and a legacy template as well as resources where you can find more on NIST 800-37 documents for your use.

View Book

Learn to Make 6 Figures in CyberSecurity

RMF ISSO Foundations Training
RMF ISSO Foundations Training

RMF ISSO Foundations

I was an Information System Security Officer (ISSO) doing Risk Management Framework (NIST SP 800-37) for over a decade. I am a Cybersecurity veteran and I can explain (in plain English) what you DO in the Risk Management Framework process as an ISSO.

View Course

NIST SP 800-37 Presentation
NIST SP 800-37 Presentation

View Course

login

  • Register
  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org

Recent Posts

  • Cybersecurity Jobs Resume Marketing: Book 1 Find Cybersecurity jobs
  • Security Control Assessor (SCA) Methods table top exercise
  • Cybersecurity Pro opinion about Tiktok
  • Las Vegas teleworking
  • STIGS in the RMF Process

Meta

  • Register
  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org

Recent Comments

  • http://Www.Finance.Ipt.Pw/ on SRG/STIG Applicability Guide and Collection Tool Update
  • Elsa7 on ConvoCourses podcast: Cyber Security day to day activity
  • Tony on STIG Update – DISA has released the Microsoft SQL Server 2016 STIG Version 1
  • horloge on SCAP Compliance Checker SCC)
  • 218 Information assurance Success Criteria – ITSECURITYSURVIVAL.COM on Information Assurance Vulnerability Alert

Tags

8140 8570 ArcSight c&a CISSP convocourses cyber cybersecurity cyber security DIACAP DIARMF diarmf - implement disa DISA STIG dodd 8140 dodd 8140 cyberspace workforce HBSS IA implement implementation info assurance information assurance information security ISSO it jobs it jobs in usa job jobs Linux mcafee network nist nist risk management framework nist risk management framework 800-37 podcast risk risk assessment risk management risk management framework rmf security STIG stigs unix windows


This is a breakdown of each of the NIST 800-53 security control families and how they relate to each step in the NIST 800-37 risk management framework process.

also available on Amazon!

View Book

Copyright © 2023 · Author Pro on Genesis Framework · WordPress · Log in