1. Complying with NIST SP 800-171
EDUCAUSE Security Professionals Conference 2018
Jason Pufahl, CISO
April 12, 2018

2. DFARS Clause
The Department of Defense established DFARS which specifies that any research containing Controlled Unclassified Information (CUI) be protected using NIST security controls.
The DFARS Clause mandates that we:
Provide adequate IT security
Implement all 109 NIST controls
Comply by
Report areas of non-compliance to DoD within 30 days after contract award

3. NIST – What is it?
Controlled Unclassified Information (CUI) is data that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations and government-wide policies but is not classified.
NIST security controls applies to CUI shared by or through the federal government with a nonfederal entity.
As a higher educational institution, UConn is a nonfederal entity.
If there is no specific law that addresses how the CUI data shared by the federal government must be protected, NIST security controls must be adhered to by UConn.
Required compliance due to research contract DFARS clause.

4. NIST Controls
Control Family
Number of Controls
Access Control 22
System and Communications Protection 16
Identification and Authentication 11
Configuration Management 9
Audit and Accountability
Media Protection
System and Information Integrity 7
Maintenance 6
Physical Protection
Risk Assessment 3
Awareness and Training
Security Assessment
Incident Response
Personnel Security 2
Grand Total
109
NIST has 14 families of security requirements comprising of 109 controls
Basic: Ultimate Goal
Derived: Ways to accomplish the goal

5. Key Infrastructure Elements
Access
Control
Awareness &
Training
Audit &
Accountability
Configuration
Management
Identification &
Authentication
System &
Information
Integrity
Incident
Response
Key Infrastructure Elements
Mobility and Supportability
Fully Virtualized
NetApp Storage
Centralized Security Controls
Data Collection and Review
Firewalls
Malware Detection
Consistency
Operating System Management
Documentation Binder
System &
Communications
Protection
Maintenance
Security
Assessment
Risk
Assessment
Physical
Protection
Personnel
Security
Media
Protection

6. Office of VP for Research Compliance and Risk Management Administrator
Where to start?
Key Stakeholders
Security Office
Office of VP for Research
School of Engineering
InCHIP
Compliance and Risk Management Administrator
Faculty
Project Manager

7. Debate GovCloud NIST 800-171 Certification Logging Vectra Firewalls
Familiarity
Microsoft Azure
Local Data Center

9. Controls Workbook Map each control to technology or process (x 109!)
NIST Control Number and Type
Capability Requirements
UConn Defined Control Capabilities
Technology or Process
Configuration
Management
3.4.1 – Basic
Establish and maintain baseline configurations and inventories of organizational information systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
Baseline Windows operating system images are available and managed by ITS. • Baseline configurations documented and maintained for each information system type to include software versions, patch level configuration parameters, network information including topologies, and interfaces with other communication systems. • PI or IT Designee responsible for system and application life cycle changes.
Managed Workstation
Op Sys Deployment

10. Controls Workbook NIST 800-171 Control Number and Type
Capability Requirements
UConn Defined Control Capabilities
Technology or Process
Configuration
Management
3.4.8 – Derived
Apply deny-by-exception (blacklist) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.
Deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. • Administrative access for users to systems and applications is prohibited per • PI, IT Designee, or Automated Process only can install software. • Systems and/or applications will be accessed by authorized users only, as defined in section 3.1.
System Configuration
Op Sys Deployment

11. Roles and Responsibilities
Shared: 21
Controls implemented and managed through a combined effort of all groups.
System Owner/PI: 13
Controls implemented and managed by the PI or research group.
19%
109 Technical & Operational Controls
12%
System Admin: 11
Controls that require some work or interaction by SA to use or implement.
10%
ITS and CISO: 64
Controls that are covered based on the current status of UConn’s infrastructure and policies and/or are monitored by CISO.
59%

12. Export Control Workflow

13. NIST BINDER Two Types of Binders: 1) Common Control Provider
2) Program Specific

14. Training
Online NIST training developed by ITS and hosted in collaboration with UConn Human Resources.
Required by all ITS infrastructure support staff, PI and support staff
Reminders
Reports
Audit Trail

15. Principal Investigator (PI)
New Project? Complete Intake Form
CRM Administrator interviews PI to discuss specific project needs
Create secured research infrastructure (SRI) for project
CRM Administrator meets with PI to review:
Secured Research Infrastructure (SRI) PI Checklist Summary and
UConn NIST SP Security Control Requirements
3 Month Review
One-Year Review

16. Unfinished Business File Transfer Process Application Whitelisting
Binder Revisions

17. Resources
Website:
PI Intake Form
SRI PI Checklist Summary
UConn NIST Security Control Requirements

18. Jason Pufahl, UCONN CISO
Thank You!
Contact:
Jason Pufahl, UCONN CISO