FISSEA Conference 2004 Developing Role-based Learning Activities U.S. Department of State

U.S. Department of State Information Assurance Training Team Jeff Dektor Jason Geiger Susan Hansche Pat Harris

Overview Role-Based Training Requirements Role-Based Training Model IT Security Training Matrix Cell Format Example of Cell Format Training Activity Summary

Resources for Identifying Role-Based Training Requirements  NIST SP “IT Security Training Requirements: A Role- and Performance-Based Model”  Agency-specific IT security regulations and procedures Contains the IT Security Training Matrix

Functional Specialties: Generic organizational roles Training Areas: Fundamental training content categories Manage Acquire Design & Develop Implement & Operate Review & Evaluate Use Laws & Regulations Security Program System Life Cycle Security Role-Based Training Model

IT Security Training Matrix D IMPLEMENT & OPERATE C DESIGN & DEVELOP A MANAGE B ACQUIRE E REVIEW & EVALUATE F USE G OTHER 2SECURITY PROGRAM 3SYSTEM LIFE CYCLE SECURITY 1LAWS & REGULATIONS 2.1PLANNING 2.2MANAGEMENT 3.1INITIATION 3.2DEVELOPMENT 4OTHER 3.6TERMINATION 3.5OPERATIONS 3.4IMPLEMENTATION 3.3TEST & EVALUATION Functional Specialties Training Areas 1A 2.2A 2.1A 1F1E1D1C1B 3.4A3.4B 3.5A3.5C 3.6A3.6D3.6E 3.4E3.4F 3.5F3.5E3.5D 3.4C 3.5B 3.2E3.2F 3.3D3.3E3.3F 3.1B 3.2B 3.1A 3.2A 3.3C 2.1D 2.2D 3.1C 3.2C3.2D 3.1E3.1F 2.2E 2.1E2.1B 2.2B2.2C 2.1C 3.4D

Title Definition Behavioral Outcome Knowledge Levels Sample Learning Objectives Sample Job Functions IT Security Body of Knowledge Topics and Concepts Cell label Training Area Functional Specialty General learning objective Descriptive verbs for 3 training levels: Beginning; Intermediate; Advanced Specific performance objectives Relevant job titles or job functions Suggested topics Defines the training content area Cell Format

INFORMATION TECHNOLOGY SECURITY TRAINING MATRIX – Cell 2.1C Training Area: Security Program – Planning Functional Specialty: Design & Develop Definition – The design and establishment of organizational structures and processes for IT security program goal-setting, prioritizing, and related decision-making activities; these encompass such elements as organization-specific scope and content, including: policy, guidelines, needs identification, roles, responsibilities, and resource allocation. Behavioral Outcome – Individuals responsible for the design and development of an IT security program are able to create a security program plan specific to a business process or organization entity. Knowledge Levels – 1.Beginning – Locate, Understand, Apply 2.Intermediate/Advanced – Design, Develop, Decide Sample Learning Objectives – At the conclusion of this module, individuals will be able to: 1.Beginning – Understand the various components of an effective IT security program and relate them to the organization’s business process requirements. 2.Intermediate/Advanced – Design, develop, or modify IT security program requirements. Sample Job Functions – Chief Information Officer (CIO) Information Resource Manager IT Security Officer/Manager Example of Cell Contents Front Page

Activity: Develop a training solution for the assigned training requirement. Identify and describe: Learning objective Presentation mode(s) Individual or group learning/practice activity Learning measurement strategy

Summary 1.FISMA mandates IT security training. 2.NIST SP provides generic guidelines for developing role-based training. 3.Identify the functional specialty (role) and training area (content) for which the individual must be trained. 4.Use the IT Security Training Matrix to identify generic performance requirements. 5.Modify performance requirements to reflect your organization’s regulations, policies, and procedures.