security control families
Post on 08-Feb-2016
36 Views
Preview:
DESCRIPTION
TRANSCRIPT
Security Control Families
Management Class
ID Class Family # ofCA Management Security Assessment and Authorization 6PL Management Planning 5PM Management Program Management 11RA Management Risk Assessment 4SA Management System and Services Acquisition 14/40AT Operational Awareness and Training 5CM Operational Configuration Management 9CP Operational Contingency Planning 10IR Operational Incident Response 8MA Operational Maintenance 6MP Operational Media Protection 6PE Operational Physical and Environmental Protection 19PS Operational Personnel Security 8SI Operational System and Information Integrity 13/84AC Technical Access Control 19AU Technical Audit and Accountability 14IA Technical Identification and Authentication 8SC Technical System and Communications Protection 34/75
Security Controls Overview
XX-1 Policy and Procedures
NIST Doc Review Strategy:
Bulleted Summaries Executive Summaries,
Overviews, Introductions
Table Summaries
Graphic Summaries
8
XX-1 Policy & Procedures
SP 800-12The Handbook
SP 800-100Manager’s Handbook
AC-1 Access Control AT-1 Security Awareness and TrainingAU-1 Audit and AccountabilityCA-1 Security Assessment and AuthorizationCM-1 Configuration ManagementCP-1 Contingency Planning IA-1 Identification and Authentication IR-1 Incident Response MA-1 System Maintenance MP-1 Media Protection PE-1 Physical and Environmental Protection PL-1 Security Planning PM-1 Information Security Program PlanPS-1 Personnel Security RA-1 Risk Assessment SA-1 System and Services Acquisition SC-1 System and Communications Protection SI-1 System and Information Integrity
Security Assessment & Authorization
Core RMF Documents
800-47 (SLA) 800-137 (CM)
CA-2 Security AssessmentsCA-3 Information System ConnectionsCA-5 Plan of Action and MilestonesCA-6 Security AuthorizationCA-7 Continuous Monitoring
Planning Family & Family PlansPL-2 System Security PlanPL-4 Rules of BehaviorPL-5 Privacy Impact AssessmentPL-6 Security-Related Activity Planning
800-18 (RMF) 800-100 (PM) OMB M-03-22 (Privacy)
CA-5 Plan of Action and Milestones -37
CP-2 Contingency Plan -34
CM-9 Configuration Management Plan-128
IR-8 Incident Response Plan -61
PM-1 Information Security Program Plan
PM-8 Critical Infrastructure PlanRMF 4.1 Security Assessment Plan -53a
Program Management
PM-2 Senior Information Security OfficerPM-3 Information Security ResourcesPM-4 Plan of Action and Milestones ProcessPM-5 Information System Inventory
PM-6Information Security Measures of Performance
PM-7 Enterprise ArchitecturePM-8 Critical Infrastructure PlanPM-9 Risk Management StrategyPM-10 Security Authorization ProcessPM-11 Mission/Business Process Definition
800-30 800-37 (RMF) 800-39 (RMF) 800-100 800-55 - Performance 800-60 800-65 - CPIC
FIPS 199 HSPD 7 – Critical
Infrastructure OMB 02-01 - SSP
Program Management Overview
Information Security Program Plan (PM) Critical Infrastructure Plan (HSPD 7) Capital Planning and Investment Control (SP 800-65) Measures of Performance (SP 800-55) Enterprise Architecture and Mission/Business Process
Definition
Information Security Program Plan
Defines Security Program Requirements Documents Management and Common Controls Defines Roles, Responsibilities, Management
Commitment and Coordination Approved by Senior Official (AO) Appoint Senior Information Security Officer
Critical Infrastructure Plan
HSPD-7 Critical Infrastructure Identification, Prioritization, and Protection
Essential Services That Underpin American Society Protection from Terrorist Attacks
– Prevent Catastrophic Health Effects or Mass Casualties – Maintain Essential Federal Missions– Maintain Order – Ensure Orderly Functioning of Economy – Maintain Public's Morale and Confidence in Economic and
Political Institutions Strategic Improvements in Security
Capital Planning & Investment Control
Investment Life Cycle Integrating Information Security into the CPIC Process Roles and Responsibilities
– Identify Baseline– Identify Prioritization Criteria– Conduct System- and Enterprise-Level Prioritization– Develop Supporting Materials– IRB and Portfolio Management– Exhibits 53 and 300 and Program Management
Investment Life Cycle
Integrating Information Security into the CPIC Process
Knowledge Check
If the interconnecting systems have the same authorizing official, an Interconnection Security Agreement is not required. True or False?
Which NIST SP, provides a seven-step process for integrating information security into the capital planning process?
This directive establishes a national policy for Federal departments and agencies to identify and prioritize United States critical infrastructure and key resources and to protect them from terrorist attacks.
The corrective action and cost information contained in which document, serve as inputs to the Exhibit 300s and are then rolled into the Exhibit 53?
Measures of Performance
Metric Types Metrics Development and Implementation Approach Metrics Development Process Metrics Program Implementation
– Prepare for Data Collection– Collect Data and Analyze Results– Identify Corrective Actions– Develop Business Case and Obtain Resources– Apply Corrective Actions
Metric Types
“Am I implementing the tasks for which I am responsible?”
“How efficiently or effectively am I accomplishing those tasks?”
“What impact are those tasks having on the mission?”
Metrics Development Process
Metrics Program Implementation
Federal Enterprise Architecture
Performance
Data
Business Service
TechnicalInformation Type
(SP 800-60)
Core Principles of the FEA
Business-driven Proactive and collaborative across the Federal
government Architecture improves the effectiveness and efficiency of
government information resources
Defining Mission/Business Processes
Defines mission/business processes with consideration for information security and the resulting risk to the organization;
Determines information protection needs arising from the defined mission/business processes and revises the processes as necessary, until an achievable set of protection needs is obtained.
Risk Assessment
RA-2 Security Categorization
RA-3 Risk Assessment
RA-5 Vulnerability Scanning
800-30r1 (draft) 800-37 800-40 -
Patch Management 800-70 - Checklists 800-115 - Assessments
Patch and Vulnerability Management Program
Create a System Inventory Monitor for Vulnerabilities, Remediations, and Threats Prioritize Vulnerability Remediation Create an Organization-Specific Remediation Database Conduct Generic Testing of Remediations Deploy Vulnerability Remediations Distribute Vulnerability and Remediation Information to Local
Administrators Perform Automated Deployment of Patches Configure Automatic Update of Applications Whenever Possible and
Appropriate. Verify Vulnerability Remediation Through Network and Host
Vulnerability Scanning Vulnerability Remediation Training
National Checklists Program
In which NIST special publication might you find guidance for the performance measurement of information systems?
Which FEA reference model was used to create the guide for mapping information types to security categories, in support of the first step of the Risk Management Framework?
What is the name of the security control, represented by the control ID RA-3, must be partially implemented prior to the implementation of other controls in order to complete the first two steps in the Risk Management Framework?
Where can information about vulnerabilities be found?
System & Services AcquisitionSA-2 Allocation of ResourcesSA-3 Life Cycle SupportSA-4 AcquisitionsSA-5 Information System DocumentationSA-6 Software Usage RestrictionsSA-7 User-Installed SoftwareSA-8 Security Engineering PrinciplesSA-9 External Information System ServicesSA-10 Developer Configuration ManagementSA-11 Developer Security TestingSA-12 Supply Chain ProtectionSA-13 Trustworthiness
800-23 – Acquisition Assurance
800-35 – Security Services
800-36 – Security Products
800-53a 800-64 - SDLC 800-65 - CPIC 800-70 - Checklists
Security Services Life Cycle
General Considerations for Security Services
Strategic/Mission Budgetary/Funding Technical/ Architectural Organizational Personnel Policy/Process
Security Product Testing
Identification and Authentication Access Control Intrusion Detection Firewall Public Key Infrastructure Malicious Code Protection Vulnerability Scanners Forensics Media Sanitizing
Common Criteria Evaluation and Validation Scheme
NIST Cryptographic Module Validation Program
Considerations for Selecting Information Security Products
Organizational Product Vendor Security Checklists for IT Products Organizational Conflict of Interest
Management Security Controls Key Concepts & Vocabulary
XX-1 Policy & Procedures CA - Security Assessment and Authorization PL – Planning Family & Family Plans
– Information Security Program Plan (PM)– Critical Infrastructure Plan (HSPD 7)
PM - Program Management– Capital Planning and Investment Control (SP 800-65)– Measures of Performance (SP 800-55)– Enterprise Architecture (FEA BRM)
RA - Risk Assessment– Security Categorization– Risk & Vulnerability Assessments
SA - System and Services Acquisition
top related