Defense Security Service Top 10 Vulnerabilities July 10, 2013 Corrie Velez Jeff Vaccariello

Was I suppose to come in from my vacation Number 10 Not auditing and reviewing audit results for classified systems Ensure Information System Security Officer (ISSO) understands DSS auditing requirements Recognizes event codes and symbols Was I suppose to come in from my vacation

We don’t have time for security; we have a milestone to reach Number 9 Processing on an unaccredited system Must have an Authority to Operate (ATO), Interim Authority to Operate (IATO), or Self Certification Authority We don’t have time for security; we have a milestone to reach

Number 8 What's anti-virus Lack of process to detect and deter viruses / malicious code Anti Virus requirements should be documented in your Master System Security Plan (MSSP) or System Security Plan (SSP) What's anti-virus

Number 7 I swear I spun the lock Not reporting classified compromises Compromise must be reported within 24 hours of confirmation A final report is due within 15 days Check your Contract Security Classification Specification (DD254) for additional reporting requirements I swear I spun the lock

I needed to use it on my other program Number 6 Classified IS configuration and connectivity management Provide detailed description of hardware, software, and any other items listed in your SSP. Include make, model, serial numbers, memory, etc. I needed to use it on my other program

They are the customer, it’s their data Number 5 Persons without proper eligibility accessing classified Continuously check JPAS for accuracy and change in records Ensure visitors are checked for proper eligibility prior to granting access They are the customer, it’s their data

Number 4 Unreported FCL change conditions (foreign buyout, etc) Check with your legal department and company officers What's eFCL

They don’t work on anything classified, why do they need to be cleared Number 3 Uncleared Key Management Personnel How is your company structured? Is there a Board of Directors? If so, do they have authority to make decisions on classified issues Check all the company officers They don’t work on anything classified, why do they need to be cleared

What's the charge number, this packet is too long Personnel clearance re-investigations out-of-scope Check JPAS records continuously Make sure that employees submit all the necessary information What's the charge number, this packet is too long

He doesn't have a badge, he can’t even get on site Number 1 Poor safe combination security Meet with employees to inspect their safe He doesn't have a badge, he can’t even get on site