1. Wednesday, February 18, 2015 10:00 a.m. – 11:30 a.m., Central Time Presented by Information Technology Services Division (ITSD), Information Technology Security (ITS), Access Management Branch (AMB) United States Department of Agriculture Office of the Chief Financial Officer National Finance Center NFC User Group Meeting

2. NFC ASO User Group Meeting Agenda Welcome Webinar Guidelines News & Updates –Secretary of Agriculture’s Signature Process Improvement Initiative –Expansion of Inactivity Process to Web Apps –Email Address Update –Role Based Security –Miscellaneous Questions & Comments February 18, 20152

3. NFC ASO User Group Meeting Webinar Guidelines Place your phone on ‘mute’ Do not put your phones on ‘hold’ Include your agency acronym with your name when signing in Send your name & agency, comments & questions via the Notes tab during the webinar Email NFC.ASO@nfc.usda.gov for a copy of the presentation or download it from the NFC Security Corner User Group Page (https://www.nfc.usda.gov/Security/user_group.html)NFC.ASO@nfc.usda.govhttps://www.nfc.usda.gov/Security/user_group.html  Limit background noise, side conversations, etc. when asking questions Remember: Your participation is critical to our success! February 18, 20153

4. 4 Processing times continue to improve Oct 2012 - Averaged 20.5 days to process requests Dec 2014 - Averaged 3.5 days to process requests (83% reduction) Jan 2015 - Averaged 2.69 days to process requests Looking ahead Continuous monitoring and improvements Feedback is important Compliance with policy will keep us on track NFC ASO User Group Meeting Secretary of Agriculture’s Signature Process Improvement Initiative

5. February 18, 20155 Notices delivered Jan 7, Jan 26, Feb 3 Deletions Began Feb 9 Suspended pending solution to infrequently used apps Apps affected SALL, DPRW, FUND, FSDE, ITRS, OFEE, PADS, RPTC, HIPS Must log into each application to remain active Emails 30 day warning, 60 day disable, 120 day delete Identifies application in subject line and greeting Identifies action taken Identifies user name Still missing user email addresses NFC ASO User Group Meeting Expansion of Inactivity Process to Web Apps

6. February 18, 20156 Number Accounts Deleted: 14,391 Percent Never Used: 62.88% Percent Logged in but Deleted: 37.12% Average Number of Days Since Last Logon: 1,068 SAC User Totals: 1 SAC Code – 2,535 2 SAC Codes – 8,410 3 SAC Codes – 3,446 NFC ASO User Group Meeting Expansion of Inactivity Process to Web Apps

7. February 18, 20157 NFC ASO User Group Meeting Expansion of Inactivity Process to Web Apps

8. February 18, 20158 NFC ASO User Group Meeting Expansion of Inactivity Process to Web Apps

9. February 18, 20159 ASO Comments Leslie Perkins – AMS: OFEE Biennial Review of Charges for Things of Value web application. This is a biennial (every 2 year) reporting requirement. Why would ANYONE be required to log into the system every 6 months to maintain access? Linda Price – RD: OFEE Warning: User Account Deleted. Considering I only use this 1 time per year, that would probably be why it was more than 120 days…There has never been this requirement in the past and a warning is normal protocol before deleting a user on most systems. NFC ASO User Group Meeting Expansion of Inactivity Process to Web Apps

10. February 18, 201510 Possible Exclusions Infrequently used Apps DPRW OFEE Users on extended leave On the mainframe, we can put users in a special dept (EXTLV) that will keep them from being deleted in the inactive accounts process if they’re going to be on extended leave. It would be great if we could do something similar with the Web Apps. A flag maybe? Removal of ASUSPENDs Must log in immediately after access given to prevent being deleted NIST 800-53: AC-02 (3) Account Management The information system automatically disables inactive accounts after [Assignment: organization-defined time period]. NFC ASO User Group Meeting Expansion of Inactivity Process to Web Apps

11. February 18, 201511 Notice went out November 20, 2014 Currently loading email addresses for all users ASOs provide email addresses via access forms ASOs provide email addresses via spreadsheet AMB extract email addresses from Insight Completed ASOs, APHIS, other agencies Admins instructed to give one warning after missing address, then cancel future forms NFC ASO User Group Meeting Email Address Update

12. February 18, 201512 First Up: IRS & NIST Will post user guide Implementation Strategy / Process Use Security Requirements Matrix (SRM) to document access for roles Phased Approach ASO Responsibilities Forms Schedules Sample forms / SRMs NFC ASO User Group Meeting Role Based Security

13. February 18, 201513 Training All Training / User Group meetings have been placed on the web site Can now register for multiple sessions at one time New Training for Distributed Security Administrators (DSAs) Register online at https://www.nfc.usda.gov/Security/Security_Training.htmlhttps://www.nfc.usda.gov/Security/Security_Training.html 1:00 p.m. – 3:00 p.m., Central Time If Wednesday falls on a holiday, class will be moved to following Thursday ASO Basic Training (1 st Wednesdays) Remedy Requester Console Training (2 nd Wednesdays) ASO Intermediate Training (4 th Wednesdays) Remedy Requester Console New Paycheck8 Summary Line NFC ASO User Group Meeting Miscellaneous

14. February 18, 201514 Form AD-3100-A Changes 1.Modify the form to change all references to 'Agency' to 'Agency/Tribal Organization' 2.Add Block numbers 3.Lengthen the two Email address fields 4.Add Mailing Address (2 lines for Address; City, State, ZIP fields) 5.Add Note at bottom of form associated with Security Officer Type field: ‘Tribal Organizations use Division and Department only’) 6.Add an ACTION REQUIRED block with options for ADD, MODIFY & DELLETE 7.Add SPECIAL INSTRUCTIONS block 8.Increase size of PHONE field More changes coming for AD-3100-P & AD-3100-R NFC ASO User Group Meeting Miscellaneous

15. February 18, 201515 Remedy Requester Console New Paycheck8 Summary Line in Remedy Requester Console Contractor Report Available Issue Resolved Security Incidents Using the IDs of others after they retired Changing passwords of IDs to allow others to use them NFC ASO User Group Meeting Miscellaneous

16. NFC ASO User Group Meeting Contact Information Access & Report Requests via Remedy Requester Console https://servicecenter.nfc.usda.gov/arsys/home Trouble Tickets (Operations & Security Center) OSC.Etix@nfc.usda.govOSC.Etix@nfc.usda.gov or (800) 767-9641 Contact AMB (Request Training, Notifications) NFC.ASO@nfc.usda.gov Security Corner https://www.nfc.usda.gov/Security/Security_home.html Ivan Jackson Associate Director, ITSD, ITS Ivan.Jackson@nfc.usda.gov Lisa Stafford Chief, ITSD, ITS, AMB Lisa.Stafford@nfc.usda.gov Remedy Requester Console Training Louis Collins, AMB Staff Louis.Collins@nfc.usda.gov James Varnado, AMB Staff James.Varnado@nfc.usda.gov Evangeline Duncan, AMB Staff Evangeline.Duncan@nfc.usda.gov ASO Basic Training Jennee Marquez, AMB Staff Genevieve.Marquez@nfc.usda.gov ASO Intermediate Training Susan Traill, AMB Staff Susan.Traill@nfc.usda.gov February 18, 201516

17. NFC ASO User Group Meeting Questions? Comments? February 18, 201517