Certification and Accreditation CS Syllabus Ms Jocelyne Farah Mr Clinton Campbell

Introduction Verification Security Features Implemented Documentation Validation Validate the integrated system Post Accreditation Monitor compliance and change management Definition Mission, Architecture & Environment Security Requirements SSAA n NSDD 145 and related laws: Must protect both classified and unclassified; but also sensitive information

3Overview n Core Materials –National Information Assurance Certification and Accreditation Process (NIACAP) –DoD Information Technology Security Certification and Accreditation Process (DITSCAP) n Units Outline 1.Background 2.ITSEC System Classification 3.Process Overview 4.Risk Management 5.Common Criteria 6.Phase 1 – Definition 7.Phase 2 – Verification 8.Phase 3 – Validation 9.Phase 4 – Post Accreditation n Assignments Ref: NIACAP, DITSCAP, and DITSCAP Manual

4 Unit 1:Background n Threats, Vulnerabilities, & Risk n Guidance –Selected Applicable Public Law –National Security Policy & Directives –DoD Policy, Directives, & Instructions n Definitions –System & System Classes –Designated Approving Authority (DAA) –Certification –Accreditation

5 Unit 2:ITSEC System Classification n ITSEC Classes –Introduction –Interfacing Mode –Processing Mode –Attribution Mode –Mission-Reliance Factor –Accessibility Factor –Accuracy Factor –Information Category n Security Requirements n Determination of System Class

6 Unit 3:Security Process Overview n C&A Process –Phase I- Definition –Phase II- Verification –Phase III- Validation –Phase IV- Accreditation n Critical Concepts –SSAA Overview –Key to Success – Agreement –Life Cycle Tailoring –Certification Levels –Risk Management

7 Unit 4:Risk Management n Review – Threats, Vulnerabilities, & Risk n Identifying and Assessing Risk n Assessing Threats and Vulnerabilities n Risk Management Concept

8 Unit 5:Common Criteria (CC) n Purpose n Overview n COTS Products Using the CC

9 Unit 6:Phase I-Definition n Accreditation Options n Accreditation Boundaries n Phase I –Overview –Activities –Certification Tasks –Role and Responsibilities

10 Unit 7:Phase II- Verification n Phase II –Overview –Activities –Certification Tasks –Role and Responsibilities n Minimal Security Checklists –System Architecture Analysis –S/W H/W Firmware Design Analysis –Network Connection Rule Compliance Analysis –Integrity Analysis of Integrated Products n Common Criteria –Life Cycle Management Analysis –Vulnerability Assessment

11 Unit 8:Phase III- Validation n Phase III –Overview –Activities –Certification Tasks –Role and Responsibilities n Minimal Security Checklist –Security Test and Evaluation –Penetration Testing –Tempest and Red/Black Verification –COMSEC Compliance Verification –System Management Analysis –Site Accreditation Survey –Contingency Plan Evaluation –Risk Management Review

12 Unit 9:Phase IV- Post Accreditation n Phase IV –Overview –Activities –Certification Tasks –Role and Responsibilities

13Assignments n Team Presentation Selection: To Be Determined n Additional Assignments: To Be Determined