UConn NIST 800-171 Compliance Project UITS All Staff Meeting Jason Pufahl, CISO October 30, 2017

DFARS Clause The Department of Defense established DFARS 252. 204-7012 which specifies that any research containing Controlled Unclassified Information (CUI) be protected using NIST 800-171. DFARS Clause 252.204-7012 mandates: Provide adequate IT security Implement all 109 NIST 800-171 controls Comply by 12-31-2017 Report areas of non-compliance to DoD within 30 days after contract award

Key Infrastructure Elements Access Control Awareness & Training Audit & Accountability Configuration Management Identification & Authentication System & Information Integrity Incident Response Key Infrastructure Elements Mobility and Supportability Fully Virtualized NetApp Storage Centralized Security Controls Data Collection and Review Firewalls Malware Detection Consistency Operating System Management Documentation Binder System & Communications Protection Maintenance Security Assessment Risk Assessment Physical Protection Personnel Security Media Protection

Total Number of Controls Compliance Efforts Control Family UITS and CISO System Admin System Owner or PI Shared Total Number of Controls Access Control 14 3 5 22 System and Communications Protection 13 1 2 16 Identification and Authentication 10 11 Configuration Management 7 9 Audit and Accountability Media Protection 6 System and Information Integrity Maintenance Physical Protection Risk Assessment Awareness and Training Security Assessment Incident Response Personnel Security Grand Total 64 21 109

Roles and Responsibilities Shared: 21 Controls implemented and managed through a combined effort of all groups. System Owner/PI: 11 Controls implemented and managed by the PI or research group. System Admin: 11 Controls that require some work or interaction by SA to use or implement. UITS and CISO: 64 Controls that are covered based on the current status of UConn’s infrastructure and policies and/or are monitored by CISO.

Configuration Management (9) NIST 800-171 Control Number Control Type Capability Requirements UConn Defined Control Capabilities 3.4.1 Basic Establish and maintain baseline configurations and inventories of organizational information systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. Baseline Windows operating system images are available and managed by UITS. • Baseline configurations documented and maintained for each information system type to include software versions, patch level configuration parameters, network information including topologies, and interfaces with other communication systems. • PI or IT Designee responsible for system and application life cycle changes.

Configuration Management (9) NIST 800-171 Control Number Control Type Capability Requirements UConn Defined Control Capabilities 3.4.8 Derived Apply deny-by-exception (blacklist) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. Deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. • Administrative access for users to systems and applications is prohibited per 3.1.6. • PI, IT Designee, or Automated Process only can install software. • Systems and/or applications will be accessed by authorized users only, as defined in section 3.1.

DFARS and Beyond Export Control Human Subject Research Protected Health Information Industry Partners

Key Contributors Thank you!!! George Assard Chris Tarricone Mike Lang Paul Majkut OVPR Catherine Rhodes Thank you!!!