1. Ensuring Information Security
Session T- 2
Ensuring Information Security
Bob Ingwalson
&
Tom Peters
U.S. Department of Education

2. Secure Your Information2

4. Systems are Vulnerable!

5. We Implement Security Based on Cost vs. Risk5

6. Protect Sensitive Information
07 RECAP
In the Office
On the System
=============
Ensuring Security
Incident Detection and Reporting

7. Shipping and deliveries CDs/DVDs Printers USB/Flash/Thumb drives
Office Security
Handling and storage
Phones
Faxes
Shipping and deliveries
CDs/DVDs
Printers
USB/Flash/Thumb drives
Physical Security
Personnel Security
Policy and Procedures 7

8. System Security (Defense in Depth)
Policy
Personnel Security
Physical Security
Network Security
Host based Security
Application Security

9. Ensure Security
Federal law requires Federal Agencies to comply with NIST standards
Federal Student Aid security is based on NIST standards and guides
Federal Student Aid uses US-CERT’s reporting guidance for security incidents

10. Ensuring Security Using the
NIST System Security Lifecycle

11. Security Categorization
Security Categorization begins by identifying the system
Boundaries
Organizational Importance/Criticality
Information Sensitivities
CIA - HML
FIPS 199, SP

12. Information Sensitivities

13. Security Control Selection
Select controls based on data sensitivity and system criticality
NIST SP , Recommended Security Controls for Federal Information Systems
“In addition to the agencies of the federal government, state, local, and tribal governments, and private sector organizations that compose the critical infrastructure of the United States, are encouraged to use these guidelines, as appropriate.”
17 Control Families
171 Controls each providing high, moderate, and low baselines

14. Security Control Selection

15. Security Control Selection
PE-8 ACCESS RECORDS
Control: The organization maintains visitor access records to the facility where the information system resides (except for those areas within the facility officially designated as publicly accessible) that includes: (i) name and organization of the person visiting; (ii) signature of the visitor; (iii) form of identification; (iv) date of access; (v) time of entry and departure; (vi) purpose of visit; and (vii) name and organization of person visited. Designated officials within the organization review the visitor access records [Assignment: organization-defined frequency].
Supplemental Guidance: None.
Control Enhancements:
(1) The organization employs automated mechanisms to facilitate the maintenance and review of access records.
(2) The organization maintains a record of all physical access, both visitor and authorized individuals.

16. Security Control Refinement (assess the risk – SP 800-30)

17. Security Control Refinement
High If an observation or finding is evaluated as high risk, there is a strong need for corrective measures. An existing system may continue to operate, but a corrective action plan must be put in place as soon as possible.
Moderate If an observation is rated as moderate risk, corrective actions are needed and a plan must be developed to incorporate these actions within a reasonable period of time.
Low If an observation is described as low risk, the system’s authorizing official must determine whether corrective actions are still required or decide to accept the risk.

18. Security Control Refinement

19. Security Control Documentation
Plans of Actions and Milestones (SP )
Security Control Weaknesses
Plan of remediation
System Security Plan (SP , SP )
System Description
Rules of Behavior
Security Controls (in-place and planned)
Contingency Plan (SP )
Business Impact Analysis (BIA)
Notification / Activation Recovery Deactivation

20. Security Control Implementation
Implement Plans of Actions and
Milestones (POAMs)
Update system controls based on
security plan
Use security configuration guides
(SP )
Update System Security Plan

21. Security Control Assessment (SP 800-53A, SP 800-37)
Independent reviewer (Certification Agent)
Reviews controls identified in System
Security Plan
Determines control effectiveness
Use to update POAMs
Provides input to system authorization
official

22. Security Authorization (SP 800-37)
Determines Risk to agency, agency assets, or individuals

23. Security Control Monitoring (SP 800-37, SP 800-53A)
Continuously track changes and new
vulnerabilities to system
Vulnerability scans and penetration testing
Audit and Log monitoring
Security configuration and compliance
Assessments and reviews
Intrusion detection and prevention systems
(IDPSs) for effective incident response
Good Day!. As Bob mentioned a

24. Security Incident Response and Reporting
What’s a Security Incident?
An incident can be unintentional or malicious. SP states: “A computer security incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices. Examples of incidents are as follows:”
Denial of Service  
Malicious Code  
Unauthorized Access  
Inappropriate Usage

25. Security Incident Response and Reporting
US-CERT’s Classification of Incidents

26. Security Incident Response and Reporting

27. Preparation Creating an incident response policy
Statement of management commitment
Purpose and objectives of the policy
Scope of the policy (to whom, what it applies to, and under what circumstances)
Definition of computer security incidents and their consequences within the context of the organization
Organizational structure and delineation of roles, responsibilities, and levels of authority
Prioritization or severity ratings of incidents
Performance measure
Reporting and contact forms

28. Preparation (con’t)
Developing procedures for performing incident handling and reporting, based on the incident response policy
Setting guidelines for communicating with outside parties regarding incidents
Selecting a team structure and staffing model
Establishing relationships between the incident response team and other groups, both internal (e.g., legal department) and external (e.g., law enforcement agencies)
Determining what services the incident response team should provide
Staffing and training the incident response team.

29. Detection and Analysis
Incident Categories
Signs of an Incident
Sources of Precursors and Indications
Incident Analysis
Incident Documentation
Incident Prioritization
Incident Notification

30. Contain, Eradicate, Recover
Enact your containment strategy
Isolate affected systems
Evidence Gathering and Evidence Handling
Chain of Custody
Remove the risks to the systems
Recover the systems
Restore from clean backups
Rebuild systems
Replace compromise files and applications
Install patches
Change passwords

31. Post Incident Activities
Lessons Learn (Hotwash)
Be critical
Use collected data
Review security settings (what allowed incident to occur)
Review what went right and what needs improvement
Evidence Retention
Prosecution
Data Retention
Costs

32. Resources Vulnerabilities: Guidance: OWASP (http://www.owasp.org)
SANS Top 20 (
National Vulnerability Database (
cgisecurity (http//
Guidance:
National Institute of Standards and Technology (NIST) Computer Security Resource Center (
Center for Internet Security (CIS) (
Educause ( 32

33. Questions?

34. Contact Information
We appreciate your feedback and comments. We can be reached at:
Bob Ingwalson
Phone:
Fax:
Tom Peters
Phone: 34 34