United States Department of Agriculture (USDA) eGovernment Program

#########  {#section .unnumbered}

#########  {#section-1 .unnumbered}

######### Technological Profile - Security Plan  {#technological-profile---security-plan .unnumbered}

######### eDeployment Business Case  {#edeployment-business-case .unnumbered}

February 2003

![](media/image1.jpeg){width="1.75in" height="1.2666666666666666in"}

**Table of Contents**

[Revision History iii](#revision-history)

[Previous Change History iii](#previous-change-history)

[Document Sign-off iii](#document-sign-off)

[1 Introduction 1](#introduction)

[2 System Identification 2](#system-identification)

[2.1 System Name/Title 2](#system-nametitle)

[2.2 Responsible Organizations 2](#responsible-organizations)

[2.3 Information Contacts 2](#information-contacts)

[2.4 Assignment of Security Responsibility
2](#assignment-of-security-responsibility)

[2.5 System Operational Status 2](#system-operational-status)

[2.6 General Description/Purpose 2](#general-descriptionpurpose)

[2.6.1 Portal Services 3](#portal-services)

[2.6.2 Web Content Management 3](#web-content-management)

[2.6.3 Document Management 3](#document-management)

[2.7 System Environment 3](#system-environment)

[2.8 System Interconnection/Information Sharing
3](#system-interconnectioninformation-sharing)

[2.9 Applicable Laws, Standards and Policies
4](#applicable-laws-standards-and-policies)

[2.10 Information Sensitivity 5](#information-sensitivity)

[3 Security Requirements 7](#security-requirements)

[4 Management Controls 8](#management-controls)

[4.1 Risk Assessment and Management 8](#risk-assessment-and-management)

[4.2 Rules of Behavior 8](#rules-of-behavior)

[4.3 Planning for Security in the Life Cycle
10](#planning-for-security-in-the-life-cycle)

[4.4 Authorize Processing 10](#authorize-processing)

[5 Operational Controls 11](#operational-controls)

[5.1 Personnel Security 11](#personnel-security)

[5.2 Physical Security 12](#physical-security)

[5.3 Production, Input/Output Controls
13](#production-inputoutput-controls)

[5.4 Contingency Plans and Disaster Recovery
13](#contingency-plans-and-disaster-recovery)

[5.5 Hardware and Software Maintenance Controls
13](#hardware-and-software-maintenance-controls)

[5.6 Data Integrity/Validation Controls
14](#data-integrityvalidation-controls)

[5.7 Documentation 14](#documentation)

[5.8 Security Awareness and Training
14](#security-awareness-and-training)

[6 Technical Controls 15](#technical-controls)

[6.1 Identification & Authentication 15](#identification-authentication)

[6.2 Logical Access Controls 16](#logical-access-controls)

[6.3 Public Access Controls 16](#public-access-controls)

[6.4 Audit Review and Audit Trails 17](#audit-review-and-audit-trails)

[7 Security Technical Architecture 18](#security-technical-architecture)

[8 Technical Overview 20](#technical-overview)

[9 Appendices 21](#appendices)

[9.1 Acronyms 21](#acronyms)

[9.2 Glossary of Terms 22](#glossary-of-terms)

# Revision History {#revision-history .unnumbered}

## Previous Change History {#previous-change-history .unnumbered}

Table a -- Previous Change History

  --------------------------- ------------------------ -------------------------- -----------------------------
  **[Version]{.smallcaps}**   **[Date]{.smallcaps}**   **[Author]{.smallcaps}**   **[Comment]{.smallcaps}**

  1.0                         11/19/2002               Seema Gupta                Initial Draft

  1.1                         11/20/2002               Elaine K. Turville         Team Updates

  1.2                         11/21/2002               Elaine K. Turville         Updated with Team Comments

  1.3                         12/09/2002               Elaine K. Turville         Updated formatting and naming

  1.4                         02/18/2003               Liesl M. Awalt             Updated with team comments

  1.5                         02/18/2003               Liesl M. Awalt             Updated with cyber security
                                                                                  comments
  --------------------------- ------------------------ -------------------------- -----------------------------

## Document Sign-off {#document-sign-off .unnumbered}

Table b -- Document Sign-off

  ------------------------ ------------------------ ---------------------------------------
  **[Date]{.smallcaps}**   **[Name]{.smallcaps}**   **[Title]{.smallcaps}**

                                                    
  ------------------------ ------------------------ ---------------------------------------

# Introduction

Over the past few years, the concept of business operations has been
taken over by the concept of cyber business operations. As organizations
have embraced the electronic means of business and information exchange,
information has taken the center stage in being one of the most valuable
organizational assets. With customers, vendors, business partners, and
suppliers accessing the internal resources of USDA, the notion of
securing enterprise information becomes mission critical. The main goal
in securing information is to maintain Confidentiality, Integrity and
Availability of the information. A breech in the information security
can put the enterprise resources at risk, liable to legal action,
financial loss and loss of trust. Thus it becomes imperative that the
security be at the center of an organization's IT strategy.

The purpose of this document is to is to create a framework for the
following topics:

-   Securing authentication and authorization of employees, partners and
    customers;

-   Leveraging the Enterprise Security Architecture for the eDeployment
    solutions;

-   Utilizing data encryption and digital certificates for sensitive
    data exchange over the Internet;

-   Securing ownership, responsibility and accountability for the
    solution; and

-   Auditing and tracking users for protected applications.

The following sections will address the above:

-   **System Identification**: Provides information on the ownership,
    responsibility, and accountability for the Enabler solutions. This
    section also provides information on the target system environment,
    interoperability between the enablers and mandated laws, standards
    and policies.

-   **Security Requirements**: Requirements necessary as part of the
    eDeployment solution.

-   **Management Controls**: This section provides detailed information
    on the management controls required to secure the solution. These
    include risk assessment and management, user behavior rules,
    information on security as a function of the Application Life Cycle
    and system component authorization authority.

-   **Operational Controls**: This section provides details on the
    operational controls required to secure the solution.

-   **Technical Controls**: Technical Control section provides
    information on the authentication, access control, and audit
    requirements for the solution.

-   **Security Technical Architecture**: This section outlines the
    conceptual security architecture for eDeployment.

-   **Technical Overview**: Provides a technical summary of the
    eDeployment solution.

# System Identification 

## System Name/Title

The eDeployment solution is comprised of the following components:

-   Web Content Management;

-   Document Management;

-   Portal Services;

-   Web Presence; and

-   Data Management.

Of these components, the first three (Web Content Management, Document
Management and Portal Services) seek to build enterprise systems to
address a business need. Since a security plan addresses the security
needs of system-based solutions, this document will focus on only those
solutions.

## Responsible Organizations

The sponsoring organization, responsible for the administration,
operations, and maintenance of the USDA eDeployment solution, is the
OCIO of USDA.

## Information Contacts

USDA OCIO serves as the primary point of contact regarding the
eDeployment solution.

## Assignment of Security Responsibility

The eDeployment Project Manager and ultimately the OCIO are responsible
for security oversight of the system. All USDA General Support (GSS) and
Major Software Applications are required to undergo a security
certification process and be accredited by a Designated Accrediting
Authority (DAA) prior to being place in operation. The DAA for this
system is not yet determined.

## System Operational Status

The eDeployment solution and its enabler components, namely: Portal
Services, Web Content Management, Document Management, Web Presence, and
Data Management, are currently in the planning phase.

## General Description/Purpose

The eDeployment solution will be created as a baseline framework to
support many of the eCommerce initiatives that are desired at USDA. The
needed functionality centers on being able to effectively manage content
and documents, organizing information in a clear and concise manner for
external and internal users and creating a single look and feel across
the USDA enterprise. The following components are part of the
eDeployment solution. The interdependencies for each of the systems are
listed below:

### Portal Services

-   Interface with the eAuthentication component for authentication;

-   Interface with collaboration servers to provide services like
    chatting, web cam, virtual conferences and virtual whiteboards etc;

-   Provide email functionality to the users, the Portal solution has to
    be linked to the Department's email servers;

-   Enable content hosting via Portal, Web Content Management Systems
    are linked for content delivery;

-   Provide access to the various enterprise applications (legacy and
    modernized (web));

-   Interface with the databases, file and image servers for content
    delivery; and

-   Interface with the other instances of the Portal within the
    Enterprise architecture.

### Web Content Management

-   Provide content to the Portal or other Web applications;

-   Share information with the Collaboration component of the System;
    and

-   Interface with the Document Management component for sharing of
    content/documents; and

-   Interface with eAuthentication component for single-sign-on and
    email servers for workflow management.

### Document Management

-   Interface with the Portal and Web Content Management components for
    content sharing;

-   Interface with eAuthentication component will provide single
    sign-on; and

-   Interface with email servers.

## System Environment

The eDeployment solution will consist of multiple servers and
workstations integrated behind multiple commercial off the shelf (COTS)
packages. The exact physical architecture will be determined after
vendor/product analysis is completed and the final products are
selected.

## System Interconnection/Information Sharing

The network architecture will be determined once the physical
architecture has been determined. The servers and workstations will
reside within the USDA network and will interconnect with multiple
Agency specific existing applications.

## Applicable Laws, Standards and Policies

The eDeployment solution will comply with security policy that applies
to all USDA computer systems including the following standards and
policies:

Table 2.9-- Quality Assurance Standard/Policy

+-------------------------+--------------------------------------------+
| **[Title]{.smallcaps}** | > **[Government Paperwork elimination act  |
|                         | > (gpea)]{.smallcaps}**                    |
+-------------------------+--------------------------------------------+
| *                       | > Public Law 105-277                       |
| *[Number]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **                      | > 44 USC 3504, Title XVII                  |
| [Version]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **[Date]{.smallcaps}**  | > October 21, 1998                         |
+-------------------------+--------------------------------------------+
| **[Originating          | > United States Congress                   |
| Orga                    |                                            |
| nization]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **[Originating          |                                            |
| Office]{.smallcaps}**   |                                            |
+-------------------------+--------------------------------------------+
| **                      | > http://www.access.gpo.gov/congress/      |
| [Website]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+

+-------------------------+--------------------------------------------+
| **[Title]{.smallcaps}** | > **[Management Accountability and         |
|                         | > Control]{.smallcaps}**                   |
+-------------------------+--------------------------------------------+
| *                       | > A-123                                    |
| *[Number]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **                      | > Revised                                  |
| [Version]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **[Date]{.smallcaps}**  | > June 21, 1995                            |
+-------------------------+--------------------------------------------+
| **[Originating          | > Office of Management and Budget (OMB)    |
| Orga                    |                                            |
| nization]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **[Originating          | > Office of Federal Financial Management   |
| Office]{.smallcaps}**   |                                            |
+-------------------------+--------------------------------------------+
| **                      | > <http://www.wh                           |
| [Website]{.smallcaps}** | itehouse.gov/omb/circulars/a123/a123.html> |
+-------------------------+--------------------------------------------+

+-------------------------+--------------------------------------------+
| **[Title]{.smallcaps}** | > **[management of federal information     |
|                         | > resources]{.smallcaps}**                 |
+-------------------------+--------------------------------------------+
| *                       | > A-130                                    |
| *[Number]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **                      | > Revised                                  |
| [Version]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **[Date]{.smallcaps}**  | > November 28, 2000                        |
+-------------------------+--------------------------------------------+
| **[Originating          | > Office of Management and Budget (OMB)    |
| Orga                    |                                            |
| nization]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **[Originating          | > Office of Federal Financial Management   |
| Office]{.smallcaps}**   |                                            |
+-------------------------+--------------------------------------------+
| **                      | > <http://www.wh                           |
| [Website]{.smallcaps}** | itehouse.gov/omb/circulars/a127/a127.html> |
+-------------------------+--------------------------------------------+

+-------------------------+--------------------------------------------+
| **[Title]{.smallcaps}** | > **[Generally Accepted Principles and     |
|                         | > practices for securing it                |
|                         | > systems]{.smallcaps}**                   |
+-------------------------+--------------------------------------------+
| *                       | > Special Publication 800-14               |
| *[Number]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **                      |                                            |
| [Version]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **[Date]{.smallcaps}**  | > September 1996                           |
+-------------------------+--------------------------------------------+
| **[Originating          | > National Institute of Standards and      |
| Orga                    | > Technology (NIST)                        |
| nization]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **[Originating          | > Computer Systems Laboratory              |
| Office]{.smallcaps}**   |                                            |
+-------------------------+--------------------------------------------+
| **                      | > <ht                                      |
| [Website]{.smallcaps}** | tp://csrc.nist.gov/publications/nistpubs/> |
+-------------------------+--------------------------------------------+

+-------------------------+--------------------------------------------+
| **[Title]{.smallcaps}** | > **[Guidelines for security certification |
|                         | > & accreditation of federal it            |
|                         | > systems]{.smallcaps}**                   |
+-------------------------+--------------------------------------------+
| *                       | > Special Publication 800-37               |
| *[Number]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **                      |                                            |
| [Version]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **[Date]{.smallcaps}**  | > October 28, 2002                         |
+-------------------------+--------------------------------------------+
| **[Originating          | > National Institute of Standards and      |
| Orga                    | > Technology (NIST)                        |
| nization]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **[Originating          | > Federal Information Processing Standards |
| Office]{.smallcaps}**   | > (FIPS)                                   |
+-------------------------+--------------------------------------------+
| **                      | > http://csrc.nist.gov/sec-cert/           |
| [Website]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+

+-------------------------+--------------------------------------------+
| **[Title]{.smallcaps}** | > **[Computer Security act of              |
|                         | > 1987]{.smallcaps}**                      |
+-------------------------+--------------------------------------------+
| *                       | > DN-3140-6                                |
| *[Number]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **                      | > Cyber Security Guidance CS-013, CS-018   |
| [Version]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **[Date]{.smallcaps}**  | > 1987                                     |
+-------------------------+--------------------------------------------+

+-------------------------+--------------------------------------------+
| **[Title]{.smallcaps}** | > **[Privacy act of 1974]{.smallcaps}**    |
+-------------------------+--------------------------------------------+
| *                       | Public Law 93-579                          |
| *[Number]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **                      | > 5 USC Section 552a                       |
| [Version]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **[Date]{.smallcaps}**  | > January 2, 1991                          |
+-------------------------+--------------------------------------------+
| **[Originating          | > Office of Management and Budget (OMB)    |
| Orga                    |                                            |
| nization]{.smallcaps}** |                                            |
+-------------------------+--------------------------------------------+
| **[Originating          |                                            |
| Office]{.smallcaps}**   |                                            |
+-------------------------+--------------------------------------------+
| **                      | >                                          |
| [Website]{.smallcaps}** | <http://www.usdoj.gov/04foia/privstat.htm> |
+-------------------------+--------------------------------------------+

##  {#section-2 .unnumbered}

## Information Sensitivity

The sensitivity of the information processed or protected by the
eDeployment solution will vary significantly. Agencies and subscriber
organizations will evaluate the environment and the associated threats
and vulnerabilities and determine the level of risk that can be
supported based on the sensitivity or significance of the information.

Information Sensitivity is derived from the ratings of the
confidentiality, integrity, and availability.

-   Confidentiality is the
    [assurance](http://www.atis.org/tg2k/_assurance.html) that
    [information](http://www.atis.org/tg2k/_information.html) is not
    disclosed to unauthorized persons, processes, or devices;

-   Integrity refers to the assurance that data has not been altered
    from one point to another; and

-   Availability refers to the accessibility to enterprise resources.
    The availability of the applications and content is of importance
    for mission critical applications. Non-availability due to scheduled
    maintenance is acceptable, but the non-availability may also occur
    due to the denial of service (attacks which slow servers or networks
    down or bring them to a halt) or virus attacks.

Table 2.10 -- Information Sensitivity

+-----------+---------------------------------------------+------------+
| **[Sys    | **[Potential Information                    | **[S       |
| tem]{.sma | Type]{.smallcaps}**                         | ensitivity |
| llcaps}** |                                             | R          |
|           |                                             | ating]{.sm |
|           |                                             | allcaps}** |
+===========+=============================================+============+
| Web       | -   User Information;                       | High       |
| Content   |                                             |            |
| M         | -   Enterprise content;                     |            |
| anagement |                                             |            |
|           | -   Media, Images;                          |            |
|           |                                             |            |
|           | -   Employment and Careers;                 |            |
|           |                                             |            |
|           | -   Transportation;                         |            |
|           |                                             |            |
|           | -   Social Programs;                        |            |
|           |                                             |            |
|           | -   Recreation;                             |            |
|           |                                             |            |
|           | -   Natural Resources;                      |            |
|           |                                             |            |
|           | -   National Defense;                       |            |
|           |                                             |            |
|           | -   Health and Safety;                      |            |
|           |                                             |            |
|           | -   Environmental Protection;               |            |
|           |                                             |            |
|           | -   Agriculture and Food;                   |            |
|           |                                             |            |
|           | -   Agency Specific Data covered under the  |            |
|           |     Privacy Act; and                        |            |
|           |                                             |            |
|           | -   Sensitive and Classified Data.          |            |
+-----------+---------------------------------------------+------------+
| Document  | -   User Information;                       | High       |
| M         |                                             |            |
| anagement | -   Customer Information;                   |            |
|           |                                             |            |
|           | -   Statistical Information;                |            |
|           |                                             |            |
|           | -   Reporting Data;                         |            |
|           |                                             |            |
|           | -   Agency Specific Data covered under the  |            |
|           |     Privacy Act;                            |            |
|           |                                             |            |
|           | -   Sensitive and Classified Data;          |            |
+-----------+---------------------------------------------+------------+
| Portal    | -   Public Domain Information               | High       |
| Services  |                                             |            |
|           | ```{=html}                                  |            |
|           | <!-- -->                                    |            |
|           | ```                                         |            |
|           | -   Employment and Careers;                 |            |
|           |                                             |            |
|           | -   Transportation;                         |            |
|           |                                             |            |
|           | -   Social Programs;                        |            |
|           |                                             |            |
|           | -   Recreation;                             |            |
|           |                                             |            |
|           | -   Natural Resources;                      |            |
|           |                                             |            |
|           | -   National Defense;                       |            |
|           |                                             |            |
|           | -   Health and Safety;                      |            |
|           |                                             |            |
|           | -   Environmental Protection;               |            |
|           |                                             |            |
|           | -   Agriculture and Food;                   |            |
|           |                                             |            |
|           | -   Agency Specific Data covered under the  |            |
|           |     Privacy Act; and                        |            |
|           |                                             |            |
|           | -   Sensitive and Classified Data.          |            |
+-----------+---------------------------------------------+------------+

## Privacy

Privacy and public trust issues are inherently associated with the
implementation of any IT system, and eDeployment is no exception. The
eDeployment project manager and implementation team will work with
privacy advocates in OCIO's cyber security office, as well as inside and
outside of the Federal government, to ensure that acceptable privacy
policies are in place. In addition, the Certification and Accreditation
process and independent audit requirements will ensure proper
implementation of policies and practices concerning the protection of
privacy information.

# Security Requirements

The following eDeployment Security requirements are detailed in the
eDeployment Technological Profile -- Technical Requirements Business
Case document.

Table 3-- Security Requirements

+---+----------------+----------+--------+----------------------------+
| * | **[Requirement | **       | **     | **[Requirement             |
| * | \#]            | [Groupin | [Prior | Description]{.smallcaps}** |
| [ | {.smallcaps}** | g]{.smal | ity]{. |                            |
| \ |                | lcaps}** | smallc |                            |
| # |                |          | aps}** |                            |
| ] |                |          |        |                            |
| { |                |          |        |                            |
| . |                |          |        |                            |
| s |                |          |        |                            |
| m |                |          |        |                            |
| a |                |          |        |                            |
| l |                |          |        |                            |
| l |                |          |        |                            |
| c |                |          |        |                            |
| a |                |          |        |                            |
| p |                |          |        |                            |
| s |                |          |        |                            |
| } |                |          |        |                            |
| * |                |          |        |                            |
| * |                |          |        |                            |
+===+================+==========+========+============================+
| 1 | The solution   | Security | 1      | The solution should enable |
| . | should enable  |          |        | the administrators to      |
|   | administrators |          |        | create a granular          |
|   | to establish a |          |        | structure of               |
|   | hierarchy of   |          |        | administration. The        |
|   | components and |          |        | administrators should be   |
|   | rules for      |          |        | able to create component   |
|   | feature        |          |        | accessibility rules, Read  |
|   | accessibility  |          |        | Write and Delete rules.    |
|   | to Users.      |          |        |                            |
+---+----------------+----------+--------+----------------------------+
| 2 | The solution   | Security | 1      | The solution should track  |
| . | should         |          |        | all events on the servers  |
|   | maintain logs  |          |        | for example user logins,   |
|   | of all user    |          |        | tracking of activities     |
|   | activity.      |          |        | performed by the user,     |
|   |                |          |        | user log-out etc           |
+---+----------------+----------+--------+----------------------------+
| 3 | The solution   | Security | 1      | The solution should        |
| . | should provide |          |        | generate logging event     |
|   | the ability to |          |        | reports compatible with    |
|   | generate       |          |        | generic reporting tools.   |
|   | activity       |          |        |                            |
|   | reports from   |          |        |                            |
|   | user logs.     |          |        |                            |
+---+----------------+----------+--------+----------------------------+
| 4 | The solution   | Security | 1      | The solution should enable |
| . | should provide |          |        | secure hosting of shared   |
|   | robust         |          |        | resources for example      |
|   | security       |          |        | hosting multiple Agency    |
|   | architecture   |          |        | data securely.             |
|   | to enable a    |          |        |                            |
|   | controlled     |          |        | Security features should   |
|   | sharing of     |          |        | ensure data sharing is     |
|   | appropriate    |          |        | strictly limited to        |
|   | resources.     |          |        | authorized Users only.     |
+---+----------------+----------+--------+----------------------------+
| 5 | The solution   | Security | 1      | The eAuthentication        |
| . | should be able |          |        | initiative will provide    |
|   | to pass single |          |        | the single sign-on and     |
|   | sign-on to     |          |        | authorization. The         |
|   | various        |          |        | solution should have the   |
|   | applications.  |          |        | ability to pass on the     |
|   |                |          |        | single sign-on to various  |
|   |                |          |        | applications integrated    |
|   |                |          |        | with portal.               |
+---+----------------+----------+--------+----------------------------+

# Management Controls

The Management Controls consist of the following:

-   Risk Assessment and Management;

-   Rules of Behavior;

-   Planning for Security in the Lifecycle: and

-   Authorize Processing.

## Risk Assessment and Management

Risk assessment is the study of vulnerabilities, threats, likelihood,
loss or impact, and theoretical effectiveness of security measures. It
is the process of defining the security requirements of each of the
risks with respect to confidentiality, integrity and availability. Risk
assessment also evaluates threats and vulnerabilities to determine
expected loss and establish the degree of acceptable risk for a system.

Risk assessments will be an on-going process across the life cycle of
the eDeployment project to ensure that effective information security
adapts to any changes in the technology or business operations. Risk
Assessments will be completed during the development phase of the
project and directly after the solutions are migrated to production.
Risk Assessments will also be completed after any major implementation
of functionality and every three years once the application is in
maintenance mode.

## Rules of Behavior

The system Rules of Behavior intend to establish ethical and practical
standards in support of the system security policy and the security
training and awareness program requirements. The Rules of Behavior will
be created during the development phase and will be based on the USDA
standard Rules of Behavior. The rules of behavior will delineate
responsibilities and expected behavior of all individuals with access to
the system.

The Rules of Behavior will be made available to users when their user
account is established. Any questions concerning the applicability or
interpretation of any of these standards should be directed to the USDA
point of contact (POC). The Rules of Behavior will be applicable to all
users who access a system within the USDA eDeployment Solution,
including: USDA personnel, Federal employees, and contractors.

Following table provides a sample of rules of behavior and consequences
arising out of non-compliance:

Table 4.2 - Rules of Behavior

+------------+-------------------------+------------------------------+
| **         | **[Behavior             | **                           |
| [User]{.sm | Rules]{.smallcaps}**    | [Consequences]{.smallcaps}** |
| allcaps}** |                         |                              |
+============+=========================+==============================+
| Employee   | All employees should    | Access to information is     |
|            | use their individual    | based on role-based          |
|            | User IDs and passwords  | authorizations assigned to   |
|            | to access the system    | the User ID. The user may    |
|            | (login).                | get unauthorized or lower    |
|            |                         | level of access in case      |
|            |                         | correct User ID is not used. |
+------------+-------------------------+------------------------------+
| Employee   | Employees should not    | Sharing of User ID and       |
|            | share their User Ids    | Password information with    |
|            | and passwords with      | outside parties poses        |
|            | other Employees or      | security risk to the         |
|            | outside parties.        | Department leading to        |
|            |                         | unauthorized access to       |
|            |                         | Departments resources.       |
+------------+-------------------------+------------------------------+
| Employee   | Employees should not    | Unattended workstations      |
|            | leave their             | provide access to            |
|            | workstations without    | unauthorized individuals to  |
|            | locking their           | access the Departmental      |
|            | workstations.           | resources and pose a         |
|            |                         | security risk.               |
+------------+-------------------------+------------------------------+
| Employees  | Employees should follow | Employees should follow the  |
|            | all Password            | set guidelines for Password  |
|            | guidelines.             | setting and change. For      |
|            |                         | example if the guidelines    |
|            |                         | indicate that the new        |
|            |                         | password should not be same  |
|            |                         | as the old password, this    |
|            |                         | should be followed to avoid  |
|            |                         | unauthorized access.         |
+------------+-------------------------+------------------------------+
| Admi       | All administrators      | Improper account and access  |
| nistrators | should follow the       | provisioning presents a risk |
|            | established process and | to the data and systems      |
|            | guidelines for User     | within the Department.       |
|            | set-up and management.  |                              |
+------------+-------------------------+------------------------------+
| Admi       | Administrators with     | Open access to user profiles |
| nistrators | access to User Profile  | violates the privacy laws    |
|            | databases should follow | and also poses a security    |
|            | procedures for          | risk due to unauthorized     |
|            | accessing information.  | access.                      |
+------------+-------------------------+------------------------------+
| M          | Managers/HR should      | Active user accounts for     |
| anagers/HR | immediately inform the  | disgruntled ex-employees can |
|            | concerned authority     | pose a security threat.      |
|            | about personnel         |                              |
|            | transitions and         | In case of personnel         |
|            | turnovers.              | transitions, in case         |
|            |                         | inter-Agency transfers are   |
|            |                         | not followed up, the         |
|            |                         | employee may continue to     |
|            |                         | have access to systems that  |
|            |                         | become unauthorized.         |
+------------+-------------------------+------------------------------+

## Planning for Security in the Life Cycle

During the acquisition and development phases of the system development
lifecycle the following security activities will be conducted:

-   Verify that hardware and software specifications allow for
    installation of USDA standard security software (antivirus, personal
    firewall, etc);

-   Perform Risk Assessment Analysis for system implementation;

-   Perform Business Impact Analysis for system introduction into USDA
    environment; and

-   Ensure that security requirements defined in Section 3 (above) have
    been built into system.

During the implementation phases of the system development lifecycle the
following security activities will be performed:

-   Install USDA standard security software;

-   Enable security software operation;

-   Review and test of security controls and overall USDA environment
    net change in security; and

-   Apply security software upgrades in a timely manner from vendor
    sources.

## Authorize Processing

The system is authorized for processing with the certification and
accreditation of this security plan. Additional systems are authorized
for attachment to this system when authorized for procurement by the
primary or secondary contacts. Interconnections to other systems must be
authorized by the primary or secondary contacts listed above. The system
will be reviewed once it is in the development phase and again during
deployment. The solution will be reviewed every three years after that
time period.

# Operational Controls

The Operational Controls consist of the following:

-   Personnel Security;

-   Physical Security;

-   Production, Input/Output Controls;

-   Contingency Plans and Disaster Recovery;

-   Hardware and Software Maintenance Controls;

-   Data Integrity/Validation Controls;

-   Documentation; and

-   Security Awareness and Training.

## Personnel Security

Personnel security has two components. First the physical security of
the personnel and second the public trust sensitivity levels for
personnel to access sensitive and classified information. The following
considerations should be taken into account:

-   Establish public trust sensitivity levels for all sensitive
    information;

-   Screen employees for public trust sensitivity levels before
    assignment of access to sensitive information;

-   Establish and follow controls around employee public trust
    sensitivity levels and information sensitivity;

-   Conduct background screenings for relevant jobs for example Security
    Personnel;

-   Establish separation of duties and accountability. Controls around
    accountability must be established for all users; and

-   Follow any USDA standardized Personnel Security controls.

## Physical Security

The proposed architecture is based on distributed architecture. This
presents the threat of physical intrusion, vandalism, equipment theft
and natural and man-made disasters at multiple locations.

The following table presents the effects of threats to physical
security:

Table 5.2 -- Physical Security

  ----------------------------------------------------------------------------------------
  **[Threat]{.smallcaps}**   **[Outcome on             **[Countermeasures]{.smallcaps}**
                             success]{.smallcaps}**    
  -------------------------- ------------------------- -----------------------------------
  Unauthorized system access Unauthorized access to    Employees and Contractors need to
  due to unlocked            Department's information  lock their workstation if leaving
  workstations, server rooms may lead to financial     the machine. All server rooms
  and open phone lines.      loss, privacy violation,  should be protected to prevent
                             potential legal           server compromise.
                             liability, system         
                             compromise and            
                             "leapfrogging".           

  Equipment theft and        Equipment theft and       The premises should be secured and
  vandalism.                 vandalism not only        entry to the premises should be
                             compromises the           based on valid User Identification.
                             information stored on the 
                             equipment, but also makes 
                             systems unavailable thus  
                             causing financial losses  
                             and system downtime.      

  Man-made and natural       These disasters lead to   The Department needs to establish
  disasters like floods,     loss of life and          Disaster Recovery and Business
  earthquakes and Acts of    destruction of data       Resumption plans.\
  terrorism etc.             leading to financial      \
                             losses for the            The Department should also mandate
                             organizations.            documentation and blueprinting of
                                                       all systems to enable quick
                                                       recovery.

  Unauthorized access due    Unauthorized users would  Current USDA facility access will
  from external parties.     be able to access the     be followed which includes only
                             physical facilities.      authorized personnel access the
                                                       physical facility. Ensure that all
                                                       USDA employees and contractors
                                                       display all badges upon entry and
                                                       while in the USDA facilities.
  ----------------------------------------------------------------------------------------

## Production, Input/Output Controls

Production and Input/Output controls will be established during the
development phase of the eDeployment solution. Content owners will
establish controls surrounding this individually at the Implementation
stage. Change control, user training materials and Configuration
Management controls will also be established at the Implementation
stage.

## Contingency Plans and Disaster Recovery

A formal contingency and disaster recovery plan will be devised in the
Implementation phase of the eDeployment solution. The following
considerations will be of prime importance in devising the plan:

-   Identify back-up processing procedures. The documentation for
    back-up processing will include the frequency (daily, weekly,
    monthly), location, generation and scope (full, incremental, and
    differential backup);

-   Determine service level agreements with vendors, contractors, and
    hosting facilities;

-   Identify the kind of recovery sites that may be used: hot sites,
    cold sites or mobile sites;

-   Test and document the results for the contingency and disaster
    recovery plans. Procedures around the frequency and mode of testing
    these plans should be devised while developing the plans; and

-   Identify the roles, responsibilities and training needs for
    employees with reference to the emergency, disaster, and contingency
    plans.

It is important to realize here that the Contingency and Disaster
recovery plans will be living documents that will require revisiting at
regular intervals to make provisions for technological and business
requirement changes.

## Hardware and Software Maintenance Controls

Currently no hardware and software has specifically selected for any of
the eDeployment solutions. The hardware and software maintenance
controls will be devised based on the selected software and hardware.

## Data Integrity/Validation Controls

Data integrity controls are used to protect data from accidental or
malicious alteration and to provide assurance that the system data meets
user expectations about its quality and integrity. Critical elements
related to data integrity controls include the installation and
activation of virus detection software on information systems and the
use of data integrity and validation controls to provide assurance that
system data has not been altered and that the system functions as
intended. The eDeployment solution will follow the security architecture
and data integrity/validation controls proposed by the Cyber Security
group for data integrity guidelines and validation controls. The
completed set of data integrity/validation controls will be completed
during the design phase of the solutions.

## Documentation

Documentation for a system includes descriptions of the hardware and
software, policies, standards, procedures, and approvals related to
automated information system security in the application and the support
systems(s). Documentation of Security policy, procedures, standards and
software will be completed during the design phase.

## Security Awareness and Training

An extensive security awareness program will be devised for the
eDeployment solutions. This may include posters, booklets, and email
notification and campaigns. The security program will be an ongoing
practice with an established procedure and responsible Agency within the
Department. The application-specific training will accompany general
support system training provided to employees and contractor personnel
in the form of seminars, workshops, formal classroom, focus groups,
role-based training, and on-the job training.

# Technical Controls

Technical controls form the baseline for platform independent
information security. Updates to the deployed solutions, changes in the
security components and the ever-increasing system vulnerabilities as a
response to the technical environment present a key challenge to the
security team. Therefore the technical controls and guidelines
established by the Department should be able to adapt to the changing
security needs.

The Technical Controls consist of the following:

-   Identification and Authentication;

-   Logical Access Controls;

-   Public Access Controls; and

-   Audit Review and Audit Trails.

## Identification & Authentication

Identification and authentication controls help prevent unauthorized
persons or processes from accessing certain information systems.
Identification is a means by which a user provides an identity to access
the system, while authentication is a means for establishing the
validity of the user's identity. Critical elements of identification and
authentication controls include the information system's ability to
individually authenticate system users and implementation of access
controls that enforce adequate segregation of duties.

The following elements will be included as part of the Identification
and Authentication controls:

-   Passwords: USDA standard password procedures will be followed for
    the eDeployment solutions.

-   Tokens or Smart Cards: Tokens will strengthen the password security
    by frequently changing the password based token code. Similar to
    tokens, Smartcards will also provide extra security to the User
    Password. Smartcards have an embedded microprocessor and electronic
    memory that provides credentials for user authentication.

-   Certificates: Digital certificates will be issued to create
    public-private key pairs. The certificate authority guarantees that
    the system using the unique certificate is who they claim to be.

## Logical Access Controls

USDA network and computer systems must restrict access to the computers
that users can reach within USDA data networks. Access control
mechanisms are widely used and are interdependent with authentication
mechanisms.[^1]

-   Access Controls based on Password/ID;

-   Access control based on Operating System;

-   Firmware (combination of software and hardware for example ROM, PROM
    etc., with programs or data recorded on them);

-   Smart cards and card readers; and

-   Biometrics.

## Public Access Controls

Since the public will be accessing the eDeployment solution, additional
security controls are used to protect the integrity of the application
and the confidence of the public in the application. Such controls
include segregating information made directly accessible to the public
from official agency records. Others public access controls that will be
included are the following:

-   Identification and Authentication;

-   Access control to limit what the user can read, write, modify, or
    delete;

-   Controls to prevent public users from modifying information on the
    system;

-   Digital signatures;

-   CD-ROM for on-line storage of information for distribution;

-   Verification that programs and information distributed to the public
    are virus-free;

-   Audit trails and user confidentiality;

-   System and data availability; and

-   Legal considerations.

## Audit Review and Audit Trails

Auditing mechanisms log and monitor actions and events that can
subsequently be toggled to provide alerts when certain conditions are
satisfied. Real-time monitoring and logging of the USDA environment will
occur at the application, Operating System, and network levels of the
USDA infrastructure. Automated response to security events that occur
within the USDA infrastructure will be incorporated into the solution.
The following activities will be tracked:

-   Operating System usage details;

-   Application usage details;

-   Internet, Extranet or Intranet network activity;

-   Intrusion detection activity;

-   Data for forensic analysis;

-   Data for trending analysis; and

-   Data for report generation.

# Security Technical Architecture

The security architecture describes the security design, tools,
processes, and activities that protect the enterprise environment. The
various components of the Security architecture are listed below:

Table 7: Security Architecture Components

+-------+--------------------+-----------------------------------------+
| **[N  | **[Compon          | **[Sub-component]{.smallcaps}**         |
| umber | ent]{.smallcaps}** |                                         |
| ]{.sm |                    |                                         |
| allca |                    |                                         |
| ps}** |                    |                                         |
+=======+====================+=========================================+
| 1.    | Network            | -   Logging/Auditing of network         |
|       |                    |     devices;                            |
|       |                    |                                         |
|       |                    | -   Firewall (types, management,        |
|       |                    |     procedures);                        |
|       |                    |                                         |
|       |                    | -   Remote Access; and                  |
|       |                    |                                         |
|       |                    | -   Passive intrusion detection.        |
+-------+--------------------+-----------------------------------------+
| 2.    | Ser                | -   Account authorization;              |
|       | vices/Applications |                                         |
|       |                    | -   Account termination;                |
|       |                    |                                         |
|       |                    | -   Accounts Lockout and Password       |
|       |                    |     Settings;                           |
|       |                    |                                         |
|       |                    | -   Intrusion Detection;                |
|       |                    |                                         |
|       |                    | -   Data handling requirements;         |
|       |                    |                                         |
|       |                    | -   Application misuse protection --    |
|       |                    |     viruses, buffer overflows etc.;     |
|       |                    |                                         |
|       |                    | -   CM Controls; and                    |
|       |                    |                                         |
|       |                    | -   Logging/Auditing.                   |
+-------+--------------------+-----------------------------------------+
| 3.    | Platfor            | -   Patch levels and procedures to      |
|       | ms/Servers/Devices |     update as new ones are released;    |
|       |                    |                                         |
|       |                    | -   Account authorization;              |
|       |                    |                                         |
|       |                    | -   Account termination;                |
|       |                    |                                         |
|       |                    | -   Accounts Lockout and Password       |
|       |                    |     Settings;                           |
|       |                    |                                         |
|       |                    | -   Intrusion Detection;                |
|       |                    |                                         |
|       |                    | -   Data handling requirements; and     |
|       |                    |                                         |
|       |                    | -   Logging/Auditing.                   |
+-------+--------------------+-----------------------------------------+
| 4.    | Data handling      | -   Notebooks and laptops;              |
|       |                    |                                         |
|       |                    | -   VPN issues;                         |
|       |                    |                                         |
|       |                    | -   Home workers;                       |
|       |                    |                                         |
|       |                    | -   E-mail encryption; and              |
|       |                    |                                         |
|       |                    | -   Anti-virus.                         |
+-------+--------------------+-----------------------------------------+
| 5.    | Corporate          | -   Internet monitoring;                |
|       | image/liabilities  |                                         |
|       |                    | -   Email monitoring;                   |
|       |                    |                                         |
|       |                    | -   Mail relaying; and                  |
|       |                    |                                         |
|       |                    | -   Spam.                               |
+-------+--------------------+-----------------------------------------+
| 6.    | Other              | -   Incident Response;                  |
|       |                    |                                         |
|       |                    | -   Disaster Recovery Plan;             |
|       |                    |                                         |
|       |                    | -   Backups; and                        |
|       |                    |                                         |
|       |                    | -   Physical Security.                  |
+-------+--------------------+-----------------------------------------+

The development of the eDeployment security architecture will be based
on the strategic goals of the Department and the Cyber Security
Architecture model. The eDeployment security model will also integrate
within the eAuthentication security architecture. The security
architecture will perform the following:

-   Enable modularity, scalability and security;

-   Support fire walling, access management, host security, and
    encryption;

-   Function with its own security policy that follows the Cyber
    Security Policy guidelines; and

-   Provide a balance between restrictive access and productivity.

Figure 8a provides a conceptual model of Security architecture for
eDeployment. Final systems will be designed and it should be expected
that through out the vendor selection, design and development phase,
contents of this section might change and evolve in response to
additional information, vendor product limitation, implementation events
and user requirements. The eDeployment Security architecture will also
evolve based on the Cyber Security Architecture.

# ![](media/image2.png){width="0.75in" height="0.75in"}![](media/image4.png){width="1.3751968503937009in" height="0.7346456692913386in"}![](media/image5.png){width="1.0in" height="0.6374015748031496in"}![](media/image6.png){width="1.3751968503937009in" height="0.8in"}![](media/image7.png){width="1.25in" height="0.5326771653543307in"}![](media/image8.png){width="0.30275590551181103in" height="0.739763779527559in"}![](media/image8.png){width="0.30275590551181103in" height="0.739763779527559in"}![](media/image9.wmf){width="0.6807086614173228in" height="0.7444881889763779in"}![](media/image8.png){width="0.30275590551181103in" height="0.739763779527559in"}Technical Overview

Figure 8a: eDeployment Conceptual Security Architecture

# Appendices

## Acronyms

Table 9.1 -- List of Acronyms

  --------------------------- -----------------------------------------------
  **[Acronym]{.smallcaps}**   **[Definition]{.smallcaps}**

  AES                         Advanced Encryption Standard

  CSA                         Computer Security Act

  DAA                         Designated Approving Authority

  DAC                         Discretionary Access Control

  DES                         Data Encryption Standard

  FedCIRC                     Federal Computer Incident Response Center

  FTP                         File Transfer Protocol

  IPSEC                       Internet Security Protocol

  ISSO                        Information system security officer

  IT                          Information Technology

  ITL                         Information Technology Laboratory

  MAC                         Mandatory Access Control

  NIPC                        National Infrastructure Protection Center

  NIST                        National Institute of Standards and Technology

  OIG                         Office of Inspector General

  OMB                         Office of Management and Budget

  PC                          Personal Computer

  SDLC                        System Development Life Cycle

  SP                          Special Publication

  ST&E                        Security Test and Evaluation
  --------------------------- -----------------------------------------------

## Glossary of Terms

Table 9.2 -- Glossary of Terms

+------------------+---------------------------------------------------+
| **[Ter           | **[Definition]{.smallcaps}**                      |
| m]{.smallcaps}** |                                                   |
+==================+===================================================+
| Accountability   | The security goal that generates the requirement  |
|                  | for actions of an entity to be traced uniquely to |
|                  | that entity. This supports non-repudiation,       |
|                  | deterrence, fault isolation, intrusion detection  |
|                  | and prevention, and after-action recovery and     |
|                  | legal action.                                     |
+------------------+---------------------------------------------------+
| Assurance        | Grounds for confidence that the other four        |
|                  | security goals (integrity, availability,          |
|                  | confidentiality, and accountability) have been    |
|                  | adequately met by a specific implementation.      |
|                  | Adequately met includes (1) functionality that    |
|                  | performs correctly, (2) sufficient protection     |
|                  | against unintentional errors (by users or         |
|                  | software), and (3) sufficient resistance to       |
|                  | intentional penetration or bypass.                |
+------------------+---------------------------------------------------+
| Availability     | The security goal that generates the requirement  |
|                  | for protection against.                           |
|                  |                                                   |
|                  | -   Intentional or accidental attempts to (1)     |
|                  |     perform unauthorized deletion of data or (2)  |
|                  |     otherwise cause a denial of service or data;  |
|                  |     and                                           |
|                  |                                                   |
|                  | -   Unauthorized use of system resources.         |
+------------------+---------------------------------------------------+
| Confidentiality  | The security goal that generates the requirement  |
|                  | for protection from intentional or accidental     |
|                  | attempts to perform unauthorized data reads.      |
|                  | Confidentiality covers data in storage, during    |
|                  | processing, and in transit.                       |
+------------------+---------------------------------------------------+
| Denial of        | The prevention of authorized access to resources  |
| Service          | or the delaying of time-critical operations.      |
+------------------+---------------------------------------------------+
| Due Care         | Managers and their organizations have a duty to   |
|                  | provide for information security to ensure that   |
|                  | the type of control, the cost of control, and the |
|                  | deployment of control are appropriate for the     |
|                  | system being managed.                             |
+------------------+---------------------------------------------------+
| Integrity        | The security goal that generates the requirement  |
|                  | for protection against either intentional or      |
|                  | accidental attempts to violate data integrity     |
|                  | (the property that data has when it has not been  |
|                  | altered in an unauthorized manner) or system      |
|                  | integrity (the quality that a system has when it  |
|                  | performs its intended function in an unimpaired   |
|                  | manner, free from unauthorized manipulation).     |
+------------------+---------------------------------------------------+
| Risk             | The net mission impact considering the following: |
|                  |                                                   |
|                  | -   The probability that a particular             |
|                  |     threat-source will exercise (accidentally     |
|                  |     trigger or intentionally exploit) a           |
|                  |     particular information system vulnerability;  |
|                  |     and                                           |
|                  |                                                   |
|                  | -   The resulting impact if this should occur.    |
|                  |     IT-related risks arise from legal liability   |
|                  |     or mission loss due to:                       |
|                  |                                                   |
|                  | ```{=html}                                        |
|                  | <!-- -->                                          |
|                  | ```                                               |
|                  | -   Unauthorized (malicious or accidental)        |
|                  |     disclosure, modification, or destruction of   |
|                  |     information;                                  |
|                  |                                                   |
|                  | -   Unintentional errors and omissions;           |
|                  |                                                   |
|                  | -   IT disruptions due to natural or man-made     |
|                  |     disasters; and                                |
|                  |                                                   |
|                  | -   Failure to exercise due care and diligence in |
|                  |     the implementation and operation of the IT    |
|                  |     system.                                       |
+------------------+---------------------------------------------------+
| Risk Assessment  | The process of identifying the risks to system    |
|                  | security and determining the probability of       |
|                  | occurrence, the resulting impact, and additional  |
|                  | safeguards that would mitigate this impact. Part  |
|                  | of Risk Management and synonymous with Risk       |
|                  | Analysis.                                         |
+------------------+---------------------------------------------------+
| Risk Management  | The total process of identifying, controlling,    |
|                  | and mitigating information system related risks.  |
|                  | It includes risk assessment; cost-benefit         |
|                  | analysis; and the selection, implementation,      |
|                  | test, and security evaluation of safeguards. This |
|                  | overall system security review considers both     |
|                  | effectiveness and efficiency, including impact on |
|                  | the mission and constraints due to policy,        |
|                  | regulations, and laws.                            |
+------------------+---------------------------------------------------+
| Security         | Information system security is a system           |
|                  | characteristic and a set of mechanisms that span  |
|                  | the system both logically and physically.         |
+------------------+---------------------------------------------------+
| Security Goals   | The five security goals are integrity,            |
|                  | availability, confidentiality, accountability,    |
|                  | and assurance.                                    |
+------------------+---------------------------------------------------+
| Threat           | The potential for a threat-source to exercise     |
|                  | (accidentally trigger or intentionally exploit) a |
|                  | specific vulnerability.                           |
+------------------+---------------------------------------------------+
| Threat-source    | Either (1) intent and method targeted at the      |
|                  | intentional exploitation of a vulnerability or    |
|                  | (2) a situation and method that may accidentally  |
|                  | trigger a vulnerability.                          |
+------------------+---------------------------------------------------+
| Threat Analysis  | The examination of threat-sources against system  |
|                  | vulnerabilities to determine the threats for a    |
|                  | particular system in a particular operational     |
|                  | environment.                                      |
+------------------+---------------------------------------------------+
| Vulnerability    | A flaw or weakness in system security procedures, |
|                  | design, implementation, or internal controls that |
|                  | could be exercised (accidentally triggered or     |
|                  | intentionally exploited) and result in a security |
|                  | breach or a violation of the systems security     |
|                  | policy.                                           |
+------------------+---------------------------------------------------+

#  {#section-3 .unnumbered}

[^1]: USDA, "*Information System Security Architecture Baseline
    Report*", prepared by SAIC, April 24, 2002 Technical Control
    Definitions, p. 14