DoD Information Technology Security Certification and Accreditation Process (DITSCAP) Phase III – Validation Thomas Howard Chris Pierce

Resources

1.Register the system – Inform DAA, CA, PM and Users. 2.Determine system security requirements. 3.Develop system architecture and define C&A boundary. 4.Identify threat environment. 5.Prepare security CONOPS. 6.Identify organizations involved in the C&A activities. 7.Tailor the activities and determine the level of effort. 8.Develop draft SSAA. Phase 1 Tasks Phase 1 - Definition Initiates the DITSCAP process by acquiring or developing the information necessary to understand the IT and then using that information to plan the C&A tasks.

Phase 2 - Verification Verify the system’s compliance with the requirements agreed on in the SSAA. The goal is to obtain a fully integrated system for certification testing and accreditation. Phase 2 Tasks - Certification 1.Review and validate security architecture. 2.Software design analysis (i.e., NMCI applications). 3.Review network connection rule compliance. 4.Review integration approach of products. 5.Review life cycle management support requirements. 6.Conduct vulnerability assessment.

Phase 3 - Validation Validates the fully integrated system compliance with the requirements stated in the SSAA. The goal is to obtain full approval to operate the system - accreditation. Phase 3 Tasks - Validation 1.Conduct Security Test and Evaluation. 2.Conduct penetration testing. 3.Validation of security requirements compliance. 4.Conduct site accreditation survey. 5.Develop and exercise contingency/incident response plan. 6.Conduct risk management review. 7.Identify residual risk and review with CA. 8.Present ST&E results and residual risk to the DAA.

Overview of Steps Step 1 - Refine the SSAA Step 2 - Certification Evaluation of the Integrated IS Step 3 - Develop Recommendation and DAA Decision

1 - Refine the SSAA Ensures requirements and agreements still apply Review runs throughout Phase III All details are added to the SSAA to reflect system’s current state Changes are submitted to DAA CA Program manager User representative

2 - Certification Evaluation of the Integrated IS This step certifies the following: The fully integrated and operational system complies with the SSAA requirements. The IS may be operated at an acceptable level of risk

2 - Certification Evaluation of the Integrated IS These are the certification tasks: 2.1 Security Test and Evaluation 2.2 Penetration Testing 2.3 TEMPEST and Red-Black verification 2.4 Validation of COMSEC compliance 2.5 System management analysis 2.6 Site Accreditation Survey 2.7 Contingency plan evaluation 2.8Risk-based management review

2.1.1 – Security Test & Evaluation Assess implementation of design and features are in accordance with the SSAA Validates the correct implementation of identification and authentication, access controls and network connection rule compliance. Test plans and procedures will address security requirements and provide evidence of residual risk. The results of tests will validate proper installation and operation of features.

Security Test & Evaluation Multiple Locations are handled in the following ways: ST & E will occur at central integration and test facility If facility not applicable, possible test at intended- operating sites System installation and security configuration should be tested at operational sites.

2.2 - Penetration Testing Penetration Testing Penetration testing is suggested for applicable system classes Testing may include attempts based on common vulnerabilities of technology in use.

2.3 - TEMPEST & RED-BLACK Verification Used to validate that equipment and site meet security requirements TEMPEST - Short name referring to investigation, study, and control of compromising emanations from IS equipment. RED-BLACK – refer to inspection of cables and power lines

2.4 - Validation and COMSEC compliance COMSEC Communication Security Evaluates how well SSAA COMSEC requirements are integrated Validates the following: That the IS is COMSEC approved That the IS follows COMSEC management procedures

System Management Analysis System management infrastructure checked for support of maintenance of environment, mission and architecture. The roles and responsibilities of ISSO are examined for SSAA consistency. System and security management organization are examined to determine ISSO incident reporting and security changes implementation ability.

System Management Analysis Benefits of System Management Analysis: Insight of level of secure operation of the environment Indication of the effectiveness of security personnel Insight into potential security problem areas

System Management Analysis Configuration management program is mandatory for maintenance of a secure posture Evaluates change control and configuration management practices on integrity of software and hardware Periodic re-verification on configuration for unauthorized changes

2.6 - Site Accreditation Survey Ensures that site operation is accomplished in accordance with SSAA Validates that operational procedures pose no unacceptable risk When system not confined to fixed site, system will be evaluated in a representative site or environment

2.7 - Contingency Plan Evaluation Evaluates that contingency, back-up and continuity service plans meet SSAA requirements DoD Directive requires periodic test for critical systems

2.8 - Risk Management Review Evaluates operation of system to see if CIA is being maintained Evaluates system vulnerabilities Evaluates operational procedures and safeguards in offsetting a risk

3 – Develop Recommendation and DAA Decision Begins after completion of all certification tasks Ends with DAA Accreditation decision Purpose Consolidate findings Submit CA’s report Produce DAA decision

3.1 – CA’s Recommendation CA issues system certification if technical requirements are satisfied Supplemental recommendations might be made to improve security posture Should provide input to future enhancement and change management decisions

Deficiencies CA may uncover security deficiencies, but believe risk level is acceptable CA may make recommendation as long as there will be timely correction of deficiencies SSAA will reflect deficiencies Agreement obtained outlining acceptable operating conditions

3.1.2 – Don’t Accredit If CA determines the system Does not satisfy the SSAA, and Short-term risks are unacceptable CA will recommend the system not be accredited

3.2 – DAA Accreditation Decision Accreditation package consists of: CA’s recommendation DAA authorization to operate Supporting documentation SSAA Supporting documentation may vary, but should include at least: Security findings and deficiencies Risks of operation

DAA Accreditation Decision If decision is to accredit it will include security parameters of acceptable operating conditions If decision does not meet SSAA requirements a temporary approval may be issued if system need be operational This requires a return to Phase I to negotiate accepted solutions, schedule, and security actions

DAA Accreditation Decision When accreditation has been issued the responsibility for the SSAA moves to the system operator Phase IV begins if decision is to accredit If accreditation is withheld Reasons for denial are stated Suggested solutions are provided DITSCAP reverts to Phase I to resolve the issues

Mobile systems are difficult to accredit at all possible locations Generic accreditation may be issued for a typical operating environment It is the official authorization to employ identical copies in a specified environment Generic Accreditation

SSAA will identify Specific uses of the system Operational constraints and procedures DAA would include disclaimer stating that operators are responsible for monitoring the environment for compliance

Roles and Responsibilities Describes the functional relationships and integration of these roles of each of the In some cases the roles may be performed by three separate organizations In other cases some roles may be combined

Phase 1 – Role and Responsibility Program ManagerDAA and CAUser Representative Initiate security dialogue with DAA, the CA, and the user representative. Define system schedule and budget. Define and/or validate system performance, availability, and functionality requirements. Support DITSCAP tailoring and level of effort determination. Draft or support drafting of the SSAA. Reach agreement on the SSAA. Approve the SSAA. Define ITSEC accreditation requirements. Obtain threat assessment. Begin vulnerability and risk assessments. Assign the CA. Support DITSCAP tailoring and determine the level of effort. Draft or support drafting of the SSAA. Reach agreement on the SSAA. Approve the SSAA. Validate and/or define system performance, availability and functionality requirements. Support DITSCAP tailoring and level of effort determination. Reach agreement on the SSAA. Approve the SSAA.

Phase 2 – Role and Responsibility Program ManagerDAA and CAUser Representative Review the SSAA. Develop system or system modifications. Support certification actions. Review certification results. Revise system as applicable. Review the SSAA. Evaluate developing system. CA performs certification actions. CA assesses vulnerabilities CA reports results to the program manager, the DAA, and the user representative. Maintain the SSAA. Review the SSAA. Support certification actions.

Phase 3 – Role and Responsibility Program ManagerDAA and CAUser Representative Review the SSAA. Test integrated system. Support certification actions. Review certification results. Revise system as applicable. Support SSAA revisions. Review the SSAA. Evaluate developing system. CA performs certification actions. Assess vulnerabilities and residual risk CA reports results to the program manager, the DAA, and the user representative. CA develops recommendation to the DAA. CA prepares accreditation package. Review the SSAA. Issue decision. Review the SSAA. Support certification actions. Review certification results. Support SSAA revisions.

Conclusion Validate that Phase I & II has produced an IS that operates in a specified computing environment with acceptable risk The goal is to obtain full approval to operate – Accreditation

Questions?