Jennifer Hlad, LEDS & OUCR Trainer LASO 101 – 2013 OREGON STATE POLICE LAW ENFORCEMENT DATA SYSTEMS CRIMINAL JUSTICE INFORMATION SERVICES DIVISION

DEFINITIONS & ACRONYMS: CJIS: Criminal Justice Information Services CSA: CJIS Systems Agencies TAC: Terminal Agency Coordinator – LEDS Representative LASO: Local Agency Security Officer, the agency contact for CJIS Training (see CJIS Policy v5.2 section for role defined) CJI: Criminal Justice Information, any FBI CJIS provided data CJA: Criminal Justice Agency/Agencies NCJA: Noncriminal Criminal Justice Agency/Agencies

DEFINITIONS & ACRONYMS: ISO: Information Security Officer (see CJIS Policy v5.2 section for role defined) APB: The Advisory Policy Board, a federal entity FBI: Federal Bureau of Investigation NIST: National Institute of Standards & Technology

WHAT IS THE CJIS SECURITY POLICY? The essential premise of the CJIS Security Policy is to provide appropriate controls to protect the full lifecycle of CJI, whether at rest or in transit. The CJIS Security Policy provides: Guidance for the creation, viewing, modification, transmission, dissemination, storage and destruction of CJI. Rules & Mandates for every contractor, private entity, non criminal justice agency representative, or member of a criminal justice entity – with access to, or who operate in support of, criminal justice services and information.

WHO CAN BE A LASO? The LASO can be the LEDS Rep. A member of the Local IT Department A member of the your contracted IT Department A member of the city IT Department A member of the county IT Department Not necessarily within the agency, this role of IT supervision can be contracted out to a master IT department, EG: Sheriff’s Office uses the main County IT Department for this role. The LASO is not required to administer the CJIS Security Training. The agency will maintain the CJIS Security Training records at the local level. This can be the LEDS Rep., LASO or other appointed person.

WHAT IS A LASO REQUIRED TO DO? 1.Identify who is using the CSA approved hardware, software, and firmware and ensure no unauthorized individuals or processes have access to the same. 2.Identify and document how the equipment is connected to the state system. 3.Ensure that personnel security screening procedures are being followed as stated in the latest CJIS Security Policy. 4.Ensure the approved and appropriate security measures are in place and working as expected. 5.Support policy compliance and ensure the CSA ISO is promptly informed of security incidents.

IDENTIFYING USAGE OF LEDS HARDWARE, SOFTWARE, AND FIRMWARE Largely an IT role wherein it is decided what hardware (Toughbook's, PC’s, routers, switches, application use to access the state system such as WebLEDS, Forsecom, etc.) will be utilized within the agency

ENSURING NO UNAUTHORIZED INDIVIDUALS OR PROCESSES HAVE ACCESS TO LEDS Agencies shall manage information system accounts, including establishing, activating, modifying, reviewing, disabling, and removing accounts. This is important for employees leaving your agency – make sure you disable the web accounts so they cannot be accessed. Your agency should handle this by implementing a policy that covers access to LEDS for new, terminated or transferred employees.

IDENTIFY & DOCUMENT HOW THE EQUIPMENT IS CONNECTED TO THE STATE SYSTEM The Network Diagrams as highlighted in appendix C of the CJIS Security Policy V5.2 This is a Network Diagram of conceptual connections between various agencies:

NETWORK DIAGRAMS CONTINUED

ENSURE THAT PERSONNEL SECURITY SCREENING PROCEDURES ARE BEING FOLLOWED CJIS Security fingerprinting, typically reverted to the LEDS Representative. Fingerprint employee and submit prints to ID Services - within 30 days of employment Must be fingerprinted for each new law enforcement agency (lateral hires) Forms available: the ID Services fingerprint staff at with any Don’t forget to the ID Services staff once an employee has separated your agency to inactivate their CJIS Security flag for your agency.

ENSURE THE APPROVED AND APPROPRIATE SECURITY MEASURES ARE IN PLACE This is very unique to your agency and how you’ve structured your IT needs and your LEDS access infrastructure. See CJIS Security Policy V5.2 appendix J & K to reference various infrastructure requirements.

SUPPORT CJIS SECURITY POLICY COMPLIANCE Once your agency has established their internal policies addressing the needed CJIS Security Awareness topics, make sure all employees follow policies, have access to the policies, are aware of the policies and aware of the consequences for breaching policy. See provided sample protocols which you can customize to your agency and agency needs.

ENSURE THE CSA ISO IS PROMPTLY INFORMED OF SECURITY INCIDENTS This is reflected in an Incident Response Plan implemented within your agency. Detailed requirements of the Incident Response Plan are outlined in section 5.3 of the CJIS Security Policy v5.2. See included example policy in your packet.

MAINTENANCE OF CJIS TRAINING RECORDS HAS BEEN DESIGNATED TO THE LOCAL LEVEL It is your agencies responsibility to maintain CJIS Security Awareness training documentation. CJIS Security Awareness training shall be required within six months of initial assignment, and biennially thereafter, for all personnel who have access to CJI. There are three (3) types of access to CJI: Level 1:Physical Access Level 2:Physical and/or Logical Level 3:Personnel with Information Technology roles OSP has provided a way for agencies to maintain your records online using the CJIS Online Portal. Documentation on how to use this portal has been provided in you packet.

PHYSICAL ACCESS Question:Who has physical access? Answer:Anyone who has unescorted (eyes on at all times) access to areas that process or store CJI. Common examples include the following roles: Janitors Building maintenance Radio technician vendors Anyone given unfettered walking access to your secured location.

PHYSICAL AND/OR LOGICAL ACCESS Question:Who has physical and/or logical access? Answer:Any individual that has login credentials to a LEDS terminal.

PERSONNEL WITH INFORMATION TECHNOLOGY ROLES Question:What does this mean? Answer:Anyone that has unescorted access to networking equipment such as: routers switches and hubs or servers processing or storing CJI. Access can be as simple a key to the door that secures this equipment. This can also be as complex as vendors with VPN access (unescorted) to systems that process CJI.

QUESTIONS?

CONTACT INFO Jennifer Hlad, LEDS Training Specialist (Desk) (Fax) Greg Verharst, CJIS Information Security Officer Ext (Desk) (Fax)