FITSP-M Module 3 Risk Management Framework Leadership “…Through the process of risk management, leaders must consider risk to U.S. interests from adversaries using cyberspace to their advantage and from our own efforts to employ the global nature of cyberspace to achieve objectives in military, intelligence, and business operations… “ - The National Strategy For Cyberspace Operations Office Of The Chairman, Joint Chiefs Of Staff, U.S. Department Of Defense FITSP-M Exam Module Objectives Application Security Contingency Planning Data Security Planning Risk Assessment Security Assessments and Authorization Risk Management Framework Overview Section A: SP 800-37r1 – Evolution of Risk Management – International and National Standards – Components of Risk Management Section B: Risk Management Framework (RMF) – Characteristics of RMF – The Fundamentals of RMF Section C: Roles & Responsibilities Section D: Steps in the RMF Process Section A SP 800-37R1 - GUIDE FOR APPLYING THE RISK MANAGEMENT FRAMEWORK TO FEDERAL INFORMATION SYSTEMS Evolution of Risk Management SP 800-37 updated Revision 1 From Guidelines for C&A of Federal Information Systems to Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach SP 800-39 supersedes SP 800-30 From Risk Management Guide for Information Technology Systems to Managing Information Security Risk Organization, Mission and Information System View Risk Management Approach Risk Management Redefined Harmonization of International and National Standards ISO/IEC 31000 - Risk management – Principles and guidelines ISO/IEC 31010 - Risk management – Risk assessment techniques ISO/IEC 27001 - Information technology – Security techniques – Information security management systems – Requirements ISO/IEC 27005 - Information technology – Security techniques – Information security risk management systems Section B SP 800-37R1 – RISK MANAGEMENT FRAMEWORK (RMF) Risk Management Framework and the SDLC Phase Initiation Traditional C&A Task Subtask 1: Preparation. Information System Description Security Categorization Risk Management Framework Step Task 1.2 Information System Description 1.1 Security Categorization 1.3 Information System Registration Threat Identification Vulnerability Identification Security Control Identification 2.1 Common Control Identification 2.2 Security Control Selection 3.1 Security Control Implementation 3.2 Security Control Documentation 2.3 Monitoring Strategy Initial Risk Determination 2: Notification Notification Planning And Resources 3: SSP Analysis, Update, And Acceptance. Security Categorization Review System Security Plan Analysis System Security Plan Update System Security Plan Acceptance 2.4 Security Plan Approval Continuous Monitoring Accreditation Certification Traditional C&A Phase Task Subtask 4: Security Documentation Supporting Materials Control Methods And Procedures Assessment Security Assessment Security Assessment Report 5: Security Findings And Recommendations Certification System Security Plan Update Documentation POAM Preparation Accreditation Package Assembly 6: Accreditation Final Risk Determination Decision Risk Acceptability 7: Security Security Accreditation Package Accreditation Transmission Documentation System Security Plan Update 8: Configuration Documentation Of Information Management System Changes Security Impact Analysis 9: Control Security Control Selection Monitoring Selected Security Control Assessment Risk Management Framework Step Task 4.1 4.2 4.3 4.4 Assessment Preparation Security Control Assessment Security Assessment Report Remediation Actions 5.1 5.2 5.3 5.4 Plan of Action and Milestones Security Authorization Package Risk Determination Risk Acceptance 6.1 Information System and Environment Changes 2.3 Monitoring Strategy (sorta) 6.2 Ongoing Security Control Assessments 10: Status System Security Plan Update 6.4 Key Updates Reporting And POAM Update 6.3 Ongoing Remediation Actions Documentation Status Reporting 6.5 Security Status Reporting RMF 6.6 Ongoing Risk Determination and Acceptance RMF 6.7 Information System Removal and Decommissioning 14 15 16 17 18 Fundamentals of RMF Integrated Organization-wide Risk Management System Development Life Cycle Information System Boundaries Security Control Allocation Roles & Responsibilities Integrated Organization-Wide Risk Management System Development Life Cycle Phases of the SDLC – – – – – Initiation Development/Acquisition Implementation Operation/Maintenance Disposal Security Requirements Integrated Project Teams Reusing Information RMF Task 1.1 Security Categorization Initiation (concept/requirements definition) 1.2 Information System Description Initiation (concept/requirements definition) 1.3 Information System Registration 2.1 Common Control Identification Initiation (concept/requirements definition) 2.2 2.3 2.4 3.1 Security Control Selection Monitoring Strategy Security Plan Approval Security Control Implementation Initiation (concept/requirements definition) Initiation (concept/requirements definition) Development/Acquisition Development/Acquisition 4.1 4.2 4.3 4.4 Assessment Preparation Security Control Assessment Security Assessment Report Remediation Actions Categorize Select Implement Security Control Documentation ssess 3.2 Phase Step Task SDLC Initiation (concept/requirements definition) Implementation Development/Acquisition Development/Acquisition Development/Acquisition Development/Acquisition Development/Acquisition Implementation Implementation Implementation Implementation Implementation 5.1 Plan of Action and Milestones 5.2 Security Authorization Package 5.3 Risk Determination 5.4 Risk Acceptance 6.1 System and Environment Changes 6.2 Ongoing Security Control Assessments Operation/Maintenance. 6.3 Ongoing Remediation Actions Operation/Maintenance. 6.4 Key Updates Operation/Maintenance. 6.5 Security Status Reporting Operation/Maintenance. 6.6 Ongoing Risk Determination and Acceptance Operation/Maintenance. 6.7 System Decommissioning Monitor Authorize Implementation Implementation Implementation Implementation Operation/Maintenance. Disposal Knowledge Check Which NIST special publication supersedes SP 800-30 as the source for guidance on risk management? What are the four components of the new Risk Management Model? Give an example of Tier 1 risk. Which phase of the SDLC should define security requirements? Development/Acquisition Initiation Disposal Implementation Operation/Maintenance. RMF 1 - Security Categorization RMF 2 - Security Control Selection RMF 3 - Security Control Implementation RMF 4 - Security Control Assessment RMF 5 - Security Authorization RMF 6 - Security Control Monitoring Place the SDLC Phase within the appropriate RMF step Information System Boundaries Establishing Information System Boundaries Boundaries for Complex Information Systems Changing Technologies and the Effect on Information System Boundaries Changing Technologies Effect on Information System Boundaries Dynamic Subsystems – Net-centric – Service-oriented Architecture – Cloud Computing External Subsystems – Contractor Systems Trust Relationships FedRAMP Federal Risk and Authorization Management Program Accelerate the adoption of secure cloud solutions through reuse of assessments and authorizations Increase confidence in security of cloud solutions Achieve consistent security authorizations using a baseline set of agreed upon standards and accredited independent third party assessment organizations Ensure consistent application of existing security practices Increase confidence in security assessments Increase confidence in security assessments Increase automation and near real-time data for continuous monitoring Security Control Allocation Options System-specific Common Hybrid Inherited Section C ROLES & RESPONSIBILITIES Organization-wide RM Strategy/ New Roles Risk Executive (function) Information Security Architect Information System Security Engineer RMF Roles & Responsibilities Head Of Agency (Chief Executive Officer) Risk Executive (Function) Chief Information Officer Information Owner/Steward Senior Information Security Officer Authorizing Official Authorizing Official Designated Representative Common Control Provider Information System Owner Information System Security Officer Information Security Architect Information System Security Engineer Security Control Assessor Head Of Agency (Chief Executive Officer) Highest-level Senior Official Overall Responsibility – Information & Information Systems Security Integrated with Strategic and Operational Processes Sufficiently Trained Personnel Establishes Appropriate Accountability Provides Active Support Oversight of Monitoring Risk Executive (Function) Ensures Risk-related Considerations are Organizationwide Consistent Across Organization Coordinates with Senior Leadership to: – – – – – Provide Comprehensive Approach Develop a Risk Management Strategy Facilitate Sharing of Risk Information Provides Oversight Provide Forum to Consider All Risk Sources Chief Information Officer Designating Senior Information Security Officer Information Security Policies Ensuring Adequately Trained Personnel Assisting Senior Officials with Their Security Responsibilities Appropriate Allocation of Resources FISMA Reporting Information Owner/Steward Authority For Specified Information May or May Not Be the Same as System Owner Provide Input to Information System Owners Rules of Behavior Single System May Contain Information from Multiple Information Owners/Stewards Senior Information Security Officer Carries Out the CIO FISMA Responsibilities Primary Liaison for CIO to Organization’s Senior Officials Possesses Professional Qualifications Heads Office that Conducts FISMA Reporting Authorizing Official Formally Assumes Responsibility Budgetary Oversight Accountable for Security Risks Senior Management Position Approve Security Plans and Plan of Actions and Milestones (POAMs) Information System May Involve Multiple Authorizing Officials Authorizing Official Designated Representative Common Control Provider Documenting Common Controls Validating Required Control Assessments Documenting Assessment Findings in SAR Producing POAMs Information System Owner Aka Program Manager Focal Point for Information System (IS) Responsible for IS throughout the SDLC Addressing The Operational Interests of User Community Ensuring Compliance with Information Security Requirements SSP, Development and Maintenance Deciding Who Has Access to System Works with Assessor to Remediate Deficiencies Information System Security Officer Ensures Appropriate Security Posture Principal Advisor Day-to-Day Security Operations – – – – – Environmental Physical Personnel Incident Handling Training and Awareness Policies and Procedures Active System Monitoring Information Security Architect Security Requirements Adequately Addressed In Enterprise Architecture – Reference Models – Segment And Solution Architectures – Resulting Information Systems Liaison Between The Enterprise Architect And Information System Security Engineer Advisor to Senior Officials – – – – – System Boundaries Assessing Severity of Deficiencies POAMs Risk Mitigation Approaches Security Alerts Information System Security Engineer Information System Security Engineering: A process that captures and refines information security requirements and ensures that the requirements are effectively integrated into information technology component products and information systems through purposeful security architecting, design, development, and configuration. Part of the Development Team Employ Security Control Best Practices Coordinate Security-related Activities Security Control Assessor Conduct SSP Assessments Conduct Control Assessments Provide Assessment of Deficiencies Recommend Corrective Action Prepare SAR (Security Assessment Report) Assessor Independence – Unbiased Assessment Process – Objective Information for Risk Determination Knowledge Check What establishes the scope of protection for organizational information systems? What is the difference between a dynamic subsystem and an external subsystem. What program uses a “do once, use many times” framework that will save cost, time, and staff required to conduct redundant agency security assessments. Which RMF role helps to ensure that risk-related considerations for individual information systems are viewed from an organization-wide perspective? Which RMF role is responsible for ensuring that the information security requirements necessary to protect the organization’s core missions and business processes are adequately addressed in all aspects of enterprise architecture? Section D STEPS IN THE RMF PROCESS The Risk Management Process Well-defined, Risk-related Tasks – Sequential – Iterative Clearly Defined Roles Tight Integration with SDLC Milestone Checkpoints Level of Effort – Importance/Criticality of a System – Categorization, The First Step… Steps of the RMF Step 1 – Categorize Information System Step 2 – Select Security Controls Step 3 – Implement Security Controls Step 4 – Assess Security Controls Step 5 – Authorize Information System Step 6 – Monitor Security Controls Gap Analysis Step 1 – Categorize Information System Security Categorization Information System Description Information System Registration Step 2 – Select Security Controls Common Control Identification Security Control Selection Monitoring Strategy Security Plan Approval Step 3 – Implement Security Controls Security Control Implementation Security Control Documentation – Planned Inputs – Expected Behavior – Expected Outputs Step 4 – Assess Security Controls Assessment Preparation Security Control Assessment Security Assessment Report Remediation Actions Step 5 – Authorize Information System Plan Of Action And Milestones Security Authorization Package Risk Determination Risk Acceptance Step 6 – Monitor Security Controls Information System And Environment Changes Ongoing Security Control Assessments Ongoing Remediation Actions Key Updates Security Status Reporting Ongoing Risk Determination And Acceptance Information System Removal And Decommissioning Risk Management Framework Key Concepts & Vocabulary Section A: SP 800-37r1 – – – – Evolution of Risk Management Harmonization of International and National Standards Components of Risk Management Multitiered Risk Management Section B: Risk Management Framework (RMF) – Characteristics of RMF – The Fundamentals of RMF – Steps in the RMF Process Questions? Next Module: Gap Analysis
© Copyright 2024