Risk Management Ramework Today - BAI RMF Resource Center

Risk Management Framework TodayFormerly DIACAP Dimensions And TomorrowSystem Categorization “Step by Step”By Lon J. Berman, CISSPIn the last issue of RMF Today andTomorrow, we examined the importanceof System Categorization (“Step 1” ofRMF) and discussed its overarchingprinciples. In this issue, we will walkthrough the categorization process stepby step.Step 1: Identify Information TypesThe first and perhaps most importantstep in the system categorization processis the determination of the “informationtypes” that are stored and processed bythe system. So what exactly is aninformation type? The formal definition,per FIPS 199, is “A specific category ofinformation (e.g., privacy, medical,proprietary, financial, investigative,contractor sensitive, securitymanagement) defined by an organizationor in some instances, by a specific law,Executive Order, directive, policy, orregulation.” In practice, each systemowner or organization needs todetermine the types of information storedand processed on their own system(s).November, 2015Volume 5, Issue 3In this issue:System Categorization “Step by Step”1What is STIG Viewer?2Top Ten—STIGs3Security ControlSpotlight—A LittleGood News4Training for Today and Tomorrow5NIST Special Publication (SP) 800-60 isa key resource to aid system owners inidentifying information types. SP 800-60is entitled “Guide for Mapping Types ofInformation and Information Systems toSecurity Categories”. Volume 1 isconcerned mostly with the categorizationprocess itself, while Volume 2(“Appendices”) is essentially a “catalog”of information types commonly stored orprocessed by government informationsystems, along with suggestedcategorizations for each type.System owners should carefully reviewSP 800-60 Volume 2 and identify therelevant information types. A complete“description” is given for each informationtype to aid in identifying the ones mostrelevant to any particular informationsystem. In most cases, only a handful ofthe numerous information typesdescribed in Volume 2 will be applicable.If there is information stored or processedby the system that does not readily “fit”into any of these predefined informationtypes, system owners are free to “invent”their own information type(s) as needed.Steps 2 and 3 then need to be completedfor each identified information type.Step 2: Provisional CategorizationSP 800-60 Vol 2 provides “provisional”categorization for each information type.The provisional categorization isessentially a recommendation forcategorization of the particularinformation type in the absence of any“special factors” (see below).SP 800-60 Vol 2 provides the provisionalcategorization for each information type inthe following format:“Security Category {(confidentiality,X), (integrity, X), (availability, X)}”In each case, “X” can be either High,Moderate or Low.This is followed by a narrative descriptionthat provides justification for each of thethree elements of the provisionalcategorization, i.e., confidentiality,integrity and availability.If the system owner has identifiedinformation categories that are not listedin SP 800-60 Vol 2, it is his/herresponsibility to come up with provisionalcategorization levels for confidentiality,integrity and availability, as well asproviding justification for each.See System Categorization, Page 2

Risk Management Framework Today And TomorrowWhat is STIG Viewer (and why are there two answers)? Page 2By Kathryn M. Farrish, CISSPSecurity Technical ImplementationGuides (STIGs) are published periodicallyby the Defense Information SystemsAgency (DISA). STIGs contain very detailed lists of security settings for commonly used IT system components, suchas operating systems, database management systems, web servers, network devices, etc.Compliance with applicable STIGs is oneof the key requirements of the RMF Assessment and Authorization (A&A) process. Applying and reviewing multipleSTIGs across numerous information system components can present a dauntingadministrative challenge. A number oftools have been developed to assist system owners and their support staff.DISA itself publishes a tool called theSTIG Viewer. This is an application thatruns on a Windows workstation. STIGs,published by DISA in XML format, can beuploaded into this tool and used to create checklists into which assessment results can be entered and managed. Additional features allow for searching of individual STIGs (or multiple STIGs) for particular subject areas or keywords.Completely separate, but similarlynamed, is www.stigviewer.com. This is aweb-based service provided by a company called Unified Compliance. It providesaccess to Unclassified STIG content,along with various searching and reporting functions. It is regularly updated asDISA releases new STIG content.System Categorization, from Page 1Step 3: Adjust for Special Factors“The system owner should be prepared tobrief the AuthorizingOfficial (AO) ifrequested .”SP 800-60 Vol 2 describes various“special factors” that may affect theprovisional categorization. The systemowner needs to review these, determine ifany are applicable, and adjust thecategorization for that information typeaccordingly.Once Step 2 and Step 3 have beencompleted for each identified informationtype, it is time to proceed to Step 4.Step 4: Categorize the InformationSystem as a WholeTo determine the “final” categorizationof the information system as a whole,the system owner simply chooses amongall the information types for the highestvalue for Confidentiality, the highestvalue for Integrity, and the highest valuefor Availability.The overall categorization of theinformation system is expressed as:Confidentiality-X, Integrity-X,Availability-X (where “X” is either High,Moderate or Low) - for example“Confidentiality-Moderate, IntegrityModerate, Availability-Low”(“M-M-L” for short).This is the complete categorizationprocess for DoD systems, as well as forNational Security Systems (NSS) locatedoutside DoD. For non-NSS locatedoutside DoD, the system owner takesthe additional step of choosing thehighest value among the categorizationlevels for confidentiality, integrity andavailability, resulting in a single system-wide categorization level of High,Moderate or Low.Step 5: Document ResultsThe system owner should carefullydocument each of the categorizationsteps, with appropriate justification,and be prepared to brief theAuthorizing Official (AO) if requested.

Risk Management Framework Today And TomorrowPage 3Top Ten—STIGsBy Annette LeonardThe Defense Information SystemsAgency (DISA) is responsible fordeveloping security guidance forconfiguring DoD information systems.An extensive collection of SecurityTechnical Implementation Guides(STIGs) is published at http://iase.disa.mil/stigs/Pages/index.aspx.STIGs contain detailed configurationguidance (settings) for commonly-usedsoftware products and other systemcomponents. Most of these documentsare updated on a regular basis.CCI-000363 (part of security control CM6) states “The organization definessecurity configuration checklists to beused to establish and documentconfiguration settings for theinformation system technology productsemployed.” The assessment procedurefor this CCI goes on to state “DoD hasdefined the security configurationchecklists as DoD security configurationor implementation guidance, e.g.,STIGs, SRGs ”Our “Top Ten” list in this issuehighlights the STIGs (or families ofSTIGs) that DoD information systemowners are most likely to encounter.10. Application Security andDevelopment STIG. This STIG is a littledifferent than most because it concernsthe software development processrather than configuration of a particularsystem component. Any system wherethere is software development activitygoing on will need to comply.9. Remote Desktop STIGs. This familyof STIGs covers remote desktoptechnologies such as Citrix, which willbe applicable to any system utilizingsuch technologies.8. Network STIGs. This is an extensivefamily of STIGs that cover everythingfrom specific network devices, such asrouters and firewalls, to network designfeatures such as infrastructure andDMZ. Systems encompassing networks,such as data centers, will need to payattention to STIGs in this family.7. Office Automation STIGs. Manysystems (not just workstations) includeoffice automation products such asMicrosoft Office (Word, Excel, etc.).There are available STIGs for numerousversions of these products.6. Host Based Security System (HBSS)STIGs. DoD policy requires HBSS on allinformation systems. These STIGsprovide configuration specifications fornumerous HBSS modules.5. Antivirus STIGs. All systems arerequired to incorporate antivirustechnologies and there are STIGsavailable to cover the most popularcommercial products, such asSymantec and McAfee.4. Web Browser STIGs. Systems thatinclude web browsers will need to payattention to this family of STIGs thatcovers products such as InternetExplorer, Mozilla Firefox and Netscape.3. Web Server and Application ServerSTIGs. Modern information systemsrely on at least some web technology.This family includes STIGs for popularweb servers such as Apache andMicrosoft Internet Information Server(IIS), as well as application serverssuch as Tomcat and JBoss.2. Database STIGs. Most systems relyon database technology. The STIGs inthis family cover the most popularcommercial database managementsystems (DBMS), including Oracle andMicrosoft SQL Server. A more generalDatabase Security Requirements Guide(SRG) is available to cover other DBMS.1. Operating System STIGs. Nearlyevery system owner will need to beconcerned about the STIGs thatpertain to the specific operatingsystems in use within the systemboundary. STIGs in this family includeWindows (numerous versions for bothservers and workstations), UNIX/LINUX(numerous versions), Mainframe, Mac,and Virtualization (VMWARE).