Defense Security Service Industrial Security Field Operations

Size: px

Start display at page:

Download "Defense Security Service Industrial Security Field Operations"

Shona Hood
6 years ago
Views:

1 NAO Presentation Impact 2017 April 25, 2017 Defense Security Service Industrial Security Field Operations Karl Hellmann Assistant Deputy Director, NISP Authorization Office (NAO)

2 NAO Topics RMF Overview RMF Timeline, Tools & Artifacts Developing an Organizational Risk Assessment Automation Initiatives Updates RMF Training 2

DSS In Transition TAILORED SECURITY PROGRAM (TSP) (Throughout each step): DSS, facilities, and PMs define countermeasures to validate Implementation and value, assess effectiveness, and use MOEs for

3 DSS In Transition TAILORED SECURITY PROGRAM (TSP) (Throughout each step): DSS, facilities, and PMs define countermeasures to validate Implementation and value, assess effectiveness, and use MOEs for continuous improvement PRIORITIZATION (RMF steps 1-2): DSS is developing and piloting SOPs for prioritizing facility engagement based on national intelligence information. / ASSET IDENTIFICATION (RMF steps 1-2): DSS is also developing and validating an effective process for identifying national security assets at cleared facilities. THREAT, VULNERABILITY, and IMPACT (TVI) (RMF steps 2-4): DSS is detailing how ISSPs can most effectively consider threat to assets and analyze vulnerabilities to those assets at cleared facilities. 3

4 RMF Transition Schedule Date Milestones June 2016 June 2016 October 2016 Released RMF Supporting Artifacts, tools and job aids; Constantly updated Created DSS RMF Resource Center at Phased RMF implementation began for Stand-alone systems w/o authorizations 31 March 2017 Released DSS Assessment and Authorization Process Manual v1.1 (DAAPM) (Sep 30, 2017 will release DAAPM v2.0 for all systems) 1 January 2018 ALL industry systems transition to RMF 4

5 Why Phased Implementation? The phased implementation was to ensure that both Industry and DSS were successful w/rmf Success is measured by the ability of Industry to submit acceptable SSP s and DSS to complete authorization decisions within the 30 day after submission timeline The first phase of the transition was to submit only SSP s for stand-alone systems (the simplest systems we authorize) using the RMF process; resulted in not a heavy workload We ve seen that Industry and DSS can successfully accomplish the RMF process & will transition more complex systems (LAN s/wan s/sipr) to the RMF process in January

6 Artifacts & Tools ( Template SSP s NIST Overlays for tailoring controls DAAPM v1.1 Control Mapping NISPOM to NIST Guide Technical Assessment Guides NAO Windows Configuration Toolkit and SCAP/STIG Content hosted within DSS Environment 6

7 Risk Assessment Coordinate with your government customer o Classification of program o Government threat assessment o Categorization of like government systems Local conditions for the facility o Facility location o System protections o Physical protections o Personnel at facility Corporate policies and procedures o Incident Response Plan o Disaster Recovery o Continuity of Operations DSS coordination o PDS Approval o Approval of physical security 7

8 Automation Initiatives (OBMS) OBMS is the RMF system of record and must be used for all Assessment and Authorization actions. OBMS hosts the MOU template and the SCAP Compliance Checker (SCC) installers for all major operating systems. OBMS also contains the completed NAO Windows Configuration Toolkit for Windows 7 that will bring a contractor system to within 88% of technical security compliance. Guides are located at: 8

9 Automation Initiatives Released the NAO Windows 7 Configuration Toolkit effective 31 March 2017 Brings Windows 7 systems (our most popular supported OS) to 88% compliance with DISA standards Has been downloaded by industry over 300 times SCC hosted within OBMS for industry use SCC content accessed and was downloaded by industry 1100 times in the first 6 months of availability 9

16) Step 6 Step 1 Step 2 Selecting Security Controls (CS103.16) Authorizing Systems (CS106.

10 RMF Training Provided by CDSE Introduction to RMF (CS124.16) Continuous Monitoring (CS200.16) Categorization of the System (CS102.16) Monitoring Security Controls (CS107.16) Step 6 Step 1 Step 2 Selecting Security Controls (CS103.16) Authorizing Systems (CS106.16) Step 5 Step 4 Step 3 Implementing Security Controls (CS104.16) Assessing Security Controls (CS105.16) 1 0

11 Closing Comments Industry can transition to RMF at any time when their current Accreditations expire; don t wait until the last days RMF training is a must to understand the intricacies of the process and position your facility for success We re in this together; RMF is also new to DSS and we re constantly training and learning RMF is about risk management and DSS will be making adjustments to the process as warranted RMF Frequently Asked Questions will be updated by end of April and posted DSS RMF Resource Center at 11

12 Discussion 12

Financial Audit and Cyber Security: FM Overlay and RMF

Financial Audit and Cyber Security: FM Overlay and RMF Amira Tann, Director IT Analysis & Internal Controls DON CIO Danny Chae, IT Audit Internal Review Lead DASN FMP 23 Feb 2017 Overlap Between Cybersecurity