ACR 2 Solutions, Inc. Simplifying Information Security Compliance May 2009

 We are a developer of enterprise level real-time risk management software  Simple, elegant, easy to use compliance solutions.  Tools to support regulatory laws and regulations such as: FISMA, GLBA, HIPAA, NAIC, NERC and PCI DSS.  Risk and Compliance solutions for public, private, and government organizations.  Risk and Compliance solutions that lower the total cost of (Information Security) Compliance (TCC).

 What is Risk Reporter ?  Why do I need it?  How does it work?  Where can I see it or try it?  Where can I get more information?

 What is Risk Reporter ?  Why do I need it?  How does it work?  Where can I see it or try it?  Where can I get more information?

Risk Reporter family of “near real-time” automated risk assessments for companies wanting to implement “best practices” compliance or regulated under: FISMA – Federal Information Security Management Act GLBA – Graham Leach Bliley Act NAIC – National Assoc. of Insurance Commissioners HIPAA – Health Info. Portability and Accountability Act PCI-DSS – Payment Card Ind. - Digital Security Standard All of the above regulations will soon have to support continuous monitoring of risk as required by NIST

 What is Risk Reporter ?  Why do I need it?  How does it work?  Where can I see it or try it?  Where can I get more information?

PARTIAL DISPLAY OF ALMOST CURRENT DOCUMENTS NIST AND FIPS REFERENCED DOCUMENTS

Threat Vulnerability Risk Safeguard Exposure Asset Gives rise to Exploits Leads to Can Damage And cause an Can be counter-measured by a Directly Effects

Technical Terminology UTM’s – Unified Threat Management devices Firewall with Secure Access, IPS, AV, logging and others IPS/IDS – Intrusion Detection/ Intrusion Prevention System These system monitor the attempted or real access of the network SCAP – Security Content Automation Program A Department of Homeland Security initiative to standardize results SCAP validated Vulnerability Scanner Network vulnerability scanners that have passed the test

 What is Risk Reporter ?  Why do I need it?  How does it work?  Where can I see it or try it?  Where can I get more information?

Three types of input to Risk Assessment 1. Management Data 2. Policy Data 3. Technical Controls This is the most difficult to answer – 600+ or more.. SCAP Vulnerability Scanners UTM / IPS / Firewall Syslog Generate the Compliance Reports Use the ‘Gap’ report to prioritize remediation and put safeguards in place

H. R (FISMA) § Federal agency responsibilities (a) …The head of each agency shall... (2) ensure that senior agency officials provide information security... through— (A) assessing the risk (B) determining the...information security appropriate (C) implementing policies and procedures... (D) periodically testing...security controls

How is a FISMA compliant risk assessment done? FISMA risk assessment procedures are in NIST special publication NIST protocols are binding on agencies one year after publication was published in An update is expected in July of 2008.

“Risk is the net negative impact of the exercise of a vulnerability, considering both the probability and the impact of occurrence” (NIST , p1).

Vulnerability assessment is a part of Risk Assessment. Probability and impact must also be considered. Vulnerability assessment alone cannot meet the FISMA requirements for Risk Assessment.

"Organizations should keep in mind that a CVSS score only assesses the relative severity of a vulnerability when compared to other vulnerabilities, and does not take into account any security controls that might mitigate exploitation attempts…” (NISTIR 7435, p 22)

The NIST definition of probability of risk (page 21) defines probability of risk as follows; High - The threat-source is highly motivated and sufficiently capable, and controls to prevent the vulnerability from being exercised are ineffective.

Required Steps For an NIST Risk Assessment Step 1 System Characterization (Section 3.1) Step 2 Threat Identification (Section 3.2) Step 3 Vulnerability Identification (Section 3.3) Step 4 Control Analysis (Section 3.4) Step 5 Likelihood Determination (Section 3.5) Step 6 Impact Analysis (Section 3.6) Step 7 Risk Determination (Section 3.7) Step 8 Control Recommendations (Section 3.8) Step 9 Results Documentation (Section 3.9) (NIST , p8)

Questionnaires, document review and automated scanning tools (800-30, p12). 3.1 Risk Reporter System Characterization SCAP validated scanner Secutor Magnus is available as a bundle w/ Risk Reporter but we support most scanners. Risk Reporter includes an extensive policy questionnaire keyed to ALL of the NIST minimum safeguards.

Natural threats, human threats and environmental threats (800-30, p13). Microsoft’s classification of threats (1999) Natural Disasters Human Error Malicious Insiders and Malicious Outsiders.

National Vulnerability Database (NVD), superseded the I-CAT database (800-30, p16). More than 36,000 Vulnerabilities Incorporated into the Risk Reporter SCAP validated scanner. Areas of Vulnerability in management, operations and technical areas all need to be considered (800-30, p18).

Vulnerability Sources Arise From: Management Procedure implementation and Internal controls Operational Data acquisition, Data storage, Data retrieval, Data modification and Data transmission

Vulnerability Sources also Arise From: Technical System design Environmental Wind, Fire, Flood, Power loss and Vehicle collision

The process was dramatically simplified by the 2005 publication of , “Recommended Security Controls for Federal Systems.”

The frequently updated list, in conjunction with the SCAP validated scan engine, is the basis for much of the Automated Risk Management program from the ACR process. Two key elements in control analysis are anti- virus protection and intrusion protection. Both are highly important precautions provided by Fortinet.

For an risk assessment, likelihood has a specific legal meaning: High - The threat-source is highly motivated and sufficiently capable, and controls to prevent the vulnerability from being exercised are ineffective. Medium - The threat-source is motivated and capable, but controls are in place that may impede successful exercise of the vulnerability.

Low - The threat-source lacks motivation or capability, or controls are in place to prevent, or at least significantly impede, the vulnerability from being exercised. Since 2004, cybercrime has exceeded illegal drugs as the #1 criminal enterprise Threat-source capability may be assumed.

Map Controls to Vulnerabilities List all of the safeguards of NIST Map safeguards to the four threat sources (Environmental, Human Error, Malicious Insider and Malicious Outsider) by inspection. Map safeguards to subsections within each threat source.

Although allows the option of higher levels of granularity, Risk Reporter has kept the recommended settings of Low, Medium and High. NIST is the “flagship document” of the NIST 800 series of FISMA compliance guidance documents. Page 1 notes that “Managing risk is not an exact science.”

Impact levels under have very specific definitions. High - Exercise of the vulnerability (1) may result in the highly costly loss of major tangible assets or resources; (2) may significantly violate, harm, or impede an organization’s mission, reputation, or interest; or (3) may result in human death or serious injury.

Medium - Exercise of the vulnerability (1) may result in the costly loss of tangible assets or resources; (2) may violate, harm, or impede an organization’s mission, reputation, or interest; or (3) may result in human injury. Low - Exercise of the vulnerability (1) may result in the loss of some tangible assets or resources or (2) may noticeably affect an organization’s mission, reputation, or interest.

The calculation of impact levels also maps to safeguards in a fairly obvious fashion. For example, a system that does not meet the requirements of safeguard CP-9 (Information System Backup) will be much more impacted by Fire than a system which is compliant with CP-9 and has a well written contingency plan (CP-2) that includes training (CP-3) and testing (CP-4).

The calculation algorithm for the risk assessment is given on page 25 of Low, Medium, and High likelihoods of adverse events are scored at 0.1, 0.5 or 1.0, respectively. In the same manner, Low, Medium, and High impacts are scored at 10, 50 and 100 respectively. By multiplying the likelihood score and the impact score, a risk score from 1 (low) to 100 (high) is calculated.

The Risk Reporter Gap Analysis report gives a mapping of the featured safeguards which are missing, against the identified risks in order of impact. This report may be used to prioritize changes in safeguards.

Upon completion of the Automated Risk Management program from the Risk Reporter risk assessment, the initial set of data will produce two reports, a “Baseline Report” showing the risk scores ordered by threat source and a “Risk Assessment Chart.” Samples are shown on the next slide

1.What is it? 2.Why do my customers want it? 3.How does it work? 4.Where can I see it? 5.Who has more information?

Free Demo Kits with licenses Government Technology Solutions

One DC agency just did one of these assessments manually. They want this automation software!