# Presentation: 945664

## DoD IA Education, Training, Awareness Products  

**DISA/GO434, (703) 882-1716**
**DennehyM@ncr.disa.mil **
**March 2004**

**DoD IA Education, Training, Awareness Products  **

##  	Mission
 	Authorities
 	Approach
 	Categories of Products
 	New Products
 	Under Development
 	Videos
 	Order Products Online, POCs

** ****	****Mission**
** ****	****Authorities**
** ****	****Approach**
** ****	****Categories of Products**
** ****	****New Products**
** ****	****Under Development**
** ****	****Videos**
** ****	****Order Products Online, POCs**

**Agenda**

## MISSION

##  	Provide standardized DoD-level IA products for Combatant 	Commands / Services/Agencies to integrate into their IA Education, 	Training & Awareness (ETA) programs

 	Develop products to support the DoD-wide IA career field or 	professional / certification programs

 	Assist other DoD components in developing and / or conducting IA 	training activities

 	Support DoD and Federal IA ETA outreach programs (HSPD-7)

** ****	**Provide standardized DoD-level IA products for Combatant 	Commands / Services/Agencies to integrate into their IA Education, 	Training & Awareness (ETA) programs
-  	Develop products to support the DoD-wide IA career field or 	professional / certification programs
-  	Assist other DoD components in developing and / or conducting IA 	training activities
-  	Support DoD and Federal IA ETA outreach programs (HSPD-7)

**DoD ETA Mission**

**Notes:**
Objective: 
Develop and provide products for DoD components to incorporate into their respective programs. 

Products 	
 Raise the awareness and understanding of new and emerging IA/IT concepts, processes and procedures, and vulnerabilities and threats
 Highlight the roles and responsibilities of personnel performing IA/IT functions

Outreach
DISA supports DoD implementation of HSPD-7  by disseminating DoD IA/IT training and awareness products to other federal Departments and agencies, State and local government, academia, and allies and coalition partners.

"December 17, 2003
Homeland Security Presidential Directive/HSPD-7
Subject:  Critical Infrastructure Identification, Prioritization, and Protection."

## AUTHORITIES

## Authorities

**Authorities**

_*DOD Instruction 8500.01 *_Information Assurance
- 	-Require the Director, DISA to develop and provide IA training  and awareness products.
_*DOD Instruction 8500.02*_  Information Assurance Implementation
- 	-The Director, DISA shall develop and provide IA training and awareness products, and a distributive training capability to support product delivery.
_*CJCSI 6510.01C*_ (1 May 01, Enclosure B, Pg. B-12)
- 	-The Director, DISA will develop an IA and INFOSEC education, training, and awareness program, guidelines, computer-based training and distributive courses and products for use by other DOD components in coordination with other DOD components as required, and assist other DOD components in developing and/or conducting  IA and INFOSEC training activities
_*IA/IT/HR/IPT*_ (February 2000, implemented by DEPSECDEF Memo, 14 Jul 00)
- 	-DISA shall develop baseline IA training courses to meet the IA training requirements stipulated in the IPT certification documents.

## Derivation of Requirements

**Derivation of Requirements**

_*Requirements Gathered From*_
-  ASD (NII), Director, IA, DIAP
-  IA ETA Forums, Working Groups
-  Service HQs IA Program Offices
-  Operators
-  DoD CERT
-  Other DISA entities (e.g., PKI)
-  Feedback from Training Organizations
-  Service schools
-  Service & agency training organizations
-  DISA/FSO trainers

## Prioritization of Requirements

_*Priorities established in coordination with*_
-  ASD(NI2), Director IA, DIAP
-  DISA FSO
_*Prioritization considerations*_
-  Certification requirements
-  Magnitude of need
-  Availability of funding
-  Availability of content
-  Availability of external funding
_*Factors bearing on prioritization*_
-  Command decision
-  Rapid transition to new technology impacting
-     existing media products
-  Emergence of new IA policies/concepts

**Prioritization of Requirements**

**Notes:**
Availability of content can be a scheduling issue.

An example of technology which impacts product development is the change to Windows 2000.  Older products don’t run well on this operating system (Quicktime issue)

Examples of new policies/concepts  
8500
Americans with Disabilities Act (ADA) Section 508, which mandated that our training products are accessible to individuals with disabilities.

## APPROACH

## Approach

-  DOD-centric with focus on commonality across
-     organizational lines
-  Collaborate with other Federal agencies using their dollars
-     to create products that support their unique training
-     programs

**Approach**

**Notes:**
We focus on content that is common across organizations, leaving to the CC/S/As the development of organizationally unique aspects.

Other agencies which have used our products as the baseline to develop their own agency-unique product include 
US Dept of Treasury, 
NASA, 
Dept of Energy 
Dept of Health and Human Services
NATO

## CATEGORIES

**OF**
**PRODUCTS**

## Categories of Products

**Personnel Certification**
- Used by some Combatant Commands/Services/Agencies for various levels of certification for SAs, IAOs, IAMs, etc.**  **
**	****	**
**	****	****Professionalization**
**	****	**Intended for use by IA professionals,
- 		(SA, IAO, IAM) to build professional competence
**Support to Warfighter**
- Present basic concepts to the Warfighter, and to aid the 		Warfighter in becoming more technically sound

**Categories of Products**

**Notes:**
Our training products generally fall into 3 categories, although some of the products cross these boundaries:

Personnel Certification These training products are used by some Combatant Commands/Services/Agencies for various levels of certification for Systems Administrators, IAOs, IAMs, etc.  

Professionalization – These products are intended for use by IA professionals, particularly the SA, IAO, and IAM, to introduce and build professional competence 

Support to the Warfighter – These products are to present basic concepts to the Warfighter, and to aid the Warfighter in becoming more technically sound 

## Personnel Certification

-  DoD Information Assurance Awareness

**Personnel Certification**

-  Information Assurance Policy & Technology (IAP&T) *(formerly OISS)*

-  Windows NT Security

-  UNIX Security

-  CyberProtect

**Notes:**
These training products are used by Combatant Commands/Services/Agencies for various levels of certification for Systems Administrators, IAOs, IAMs, etc.  

## Professionalization

-  Designated Approving Authority (DAA)
-  DITSCAP
-  SSAA Preparation Guide
-  Certifiers Fundamentals
-  Web Security
-  Database Security
-  System Admin Incident Prep & Response – UNIX
-  System Admin Incident Prep & Response – Win NT
-  System Defender

**Professionalization**

**Notes:**
These products are intended for use by IA professionals to introduce and increase various areas of expertise.

DAA CD is being updated to reflect new policy. The DAA Certificate on IASE is the approved version referenced in Mr. Stenbit’s memo

Certifiers Fundamentals
 Section 508 compliant
 Designed to run through a Learning Management System (LMS) to track dates and scores
 Maps 100% to  NSTISSI Standard 4015, “National Training Standard for System Certifiers” 

## Support to the Warfighter

-  Defense in Depth
-  Information Age Technology
-  Computer Network Defense
-  Public Key Infrastructure
-  IA for Auditors & Evaluators
-  Active Defense – An Executive’s Guide to IA
-  Introduction to CIRT Management

**Support to the Warfighter**

## All Products

-  Currently available for ordering via IASE at _[http://iase.disa.mil/](http://iase.disa.mil/eta)__[eta](http://iase.disa.mil/eta)_
-  Web-deliverable
-  ADA Section 508 Compliant
-  Available at no cost
-  Cleared for “Open Release” by DoD

**All Products**

## NEW

**PRODUCTS**

## System Defender

-  Defines training gaps
-  Web-based only
-  Easy to update
-  Tracks students via web server/LMS
-  Compatible with ADA 508 requirements.
-  Audience includes SAs, IAOs, IAMs, Net Admins 				with Level 2 experience.

**System Defender**

- Demo available at
- DISA IA Training Products Booth

**Notes:**
 Lynn Cartwright from CSC will be presenting a demo of System Defender following this briefing.

## IA Policy & Technology (IAP&T)

-  Topics include:
-  Information Security Overview
-  System Modes and Evaluation Criteria
-  Workstation Security
-  Network Security
-  Identifying and Reporting Incidents
-  Protecting Information Systems
-  Managing Information Systems Security
-  Audience is IAOs, IAMs or SAs

- Demo available at
- DISA IA Training Products Booth

**IA Policy & Technology (IAP&T)**

**Notes:**
Product is the update to OISS Volumes 1 & 2

Very well received by the DoD community.  (Available to the Combatant Commands  on a resource-limited basis, as a classroom course)

(Note to briefer:  don’t want to emphasize classroom training in this briefing due to limited resources and big demand – Mike’s guidance)

## SSAA Preparation Guide

- Product is useful for preparation of an SSAA using the National Information Assurance Certification and Accreditation Process (NIACAP), NSTISSI No. 1000
- Provides overview of the DITSCAP
- Uses DITSCAP outline (DoD 8510.1M)
- Audience is IAMs, IAOs, SAs, Auditors

**SSAA Preparation Guide**

- Demo available at
- DISA IA Training Products Booth

## Firewall and Router Basics

**Firewall and Router Basics**

-  Introduction to the security aspects of firewalls and routers
-  Addresses the operation and maintenance of secure information 	systems and networks within a networked environment
-  Audience is SAs, network adminis and users working 		toward obtaining Level 1 SA certification
-  Topics include
-  Internetworking Overview
-  Firewall Fundamentals
-  Router Fundamentals

- Demo available at
- DISA IA Training Products Booth

**Notes:**
Status:

Anticipated release 3rd week of February 04

## UNDERDEVELOPMENT

## Telework

**Telework**

-  Instructs users on current DoD policies and guidelines 		for utilizing the Telework program

## Wireless Networking Security

-  Instructs users on current DoD policies and guidelines 		for utilizing wireless networks

## Windows 2000 System Administrator

**Windows 2000 System Administrator**

-  Security as it pertains to Windows 2000, both server and workstation
-  Shows various ways to secure Windows 2000 systems and addresses 	current vulnerabilities
-  Addresses Gold Standard
-  Audience includes SAs, IAOs, IAMs, and Network Administrators
-  Currently in  Beta Review

**Notes:**
Status:

Anticipated release 3rd week of February 04

## Cyber OPS (Net Builder)

**Cyber OPS (Net Builder)**

_*Net Builder (2 yrs)*_ Players create networks using generic hardware, software, and connection tool suites within allocated resources
_*Net Defender*_ Uses computer-generated attack sequences to test network defenses developed by exercise players
_*Net Assurer*_ Explores the impact of available IA personnel (SAs, IAMs, IAOs, and DAAs) on the efficiency of system operation
_*Net Warrior*_ Red Team – Blue Team exercise play defending or attacking previously created, defended, and staffed networks

-  Multi-year collaborative effort with USMA
-  Modular IA exercise as an academic classroom, technical training and 	information warfare exercise support tool
-  Each module increases depth and realism of exercise play, using a 	building block approach

**Notes:**
Status:
CyberOps Net Builder interface has been developed and approved

Graphics for the system components (playing pieces) are under development

Preliminary draft design document is at the USMA for populating as they develop their programming

## Cyber Law

**Cyber Law**

-  For government lawyers who need to understand legal and policy issues, both 	current and emerging, associated with IA and CIP/Homeland Security
-  Topics include:
-  Basic understanding of the Internet
-  Basic tenets of Information Assurance
-  Definition of Computer Crime
-  Discussion of First and Fourth Amendments
-  Presentation of statutory considerations to be applied during 	investigations
-  Discussion of  four “Lanes in the Road” pertinent to CND
-  References for following evolving areas of the law in cyberspace
-  Audience: Combatant Commands/Components SJA;  Regional JAGs; IA, 	IO, CIP and Intel specialists; SAs, IAOs, DAAs, Red Teams, CERTs, web 	developers

**Notes:**
First of three phases
CyberLaw II will address Computer Crime and CND
CyberLaw III will update changes to caselaw and policies cited in CyberLaw I, and will go into detail on specific issues

Status:
Outline has been apporved by the DOD IA Legal Working Group

Interface has been approved by the DOD IA Legal Working Group

Graphics for CyberLaw I are under development

## Videos

## Compilation Series 1 
Networks at Risk (NCS) (10 min)
The Information Front Line (IC) (10 min)
Bringing Down the House (IC) (11 min)
Computer Security 101 (DOJ) (~10 min)
Computer Security: The Executive Role (DOJ) (~10 min)
Safe Data - Its Your Business (DOL) (18 min)
Think Before You Respond (USGov) (3 min)
Protect Your AIS (USGov) (6 vignettes)
Protect Your AIS -The Sequel (USGov) (30 min) 
Doctor D Stroye (USGov) (7 min)
The Scarlet V (USGov) (7 min)

_*Compilation Series 1 *_
- Networks at Risk (NCS)* (10 min)*
- The Information Front Line (IC)* (10 min)*
- Bringing Down the House (IC)* (11 min)*
- Computer Security 101 (DOJ)* (~10 min)*
- Computer Security: The Executive Role (DOJ)* (~10 min)*
- Safe Data - Its Your Business (DOL)* (18 min)*
- Think Before You Respond (USGov)* (3 min)*
- Protect Your AIS (USGov)* (6 vignettes)*
- Protect Your AIS -The Sequel (USGov)* (30 min) *
- Doctor D Stroye (USGov)* (7 min)*
- The Scarlet V (USGov)* (7 min)*

**IA Videos**

**Notes:**
Networks at Risk - produced by NCS - hackers, intrusions, security in the workplace
Info Front Line - IW-D - information is easy to exchange, difficult to protect
Bringing down the House - hacker intrusions, how they relate to IW
Computer Security 101 - John Walsh, America’s Most Wanted - 3 highlights 1- kind of info to be protected, 2-why computer security is important (risk mgmt) 3- assuming responsibility for protecting info (accountability)
Comp Sec Ex Role - Need to protect at all levels of gov’t, Computer Security Act of 1987
Safe Data - Its Your Business - protecting sensitie but unclassified (medical, personnel), password mgmt
Think Before you Respond - Internet Security - live chat, requests for info
Protect Your AIS, Protect Your AIS, the Sequel - password protection, virus prevention, safeguarding data, user ID security, controlled access
Dr. D Stroye - correct methods for magnetic media destruction with humorous examples of how not to do it
The Scarlet V - virus scanning software necessary to use regularly

## Compilation Series 2 
Ears Looking at You (USGov) (8 min)
Just the Fax (USGov) (7:51 min)
Bits and Pieces (USGov) (4:30 min)
Magnificent Discretion (USGov) (5:02 min)
Sherman on My Mind (USGov)
Identity Theft – Protect Yourself (USN)

Understanding PKI

Solar Sunrise: Dawn of a New Threat* 
(NACIC, NIPC, FBI) (18 min)

Risky Business* 
(NACIC, FBI) (~20 min)

_*Compilation Series 2*__* *_
- Ears Looking at You (USGov)* (8 min)*
- Just the Fax (USGov)* (7:51 min)*
- Bits and Pieces (USGov)* (4:30 min)*
- Magnificent Discretion (USGov)* (5:02 min)*
- Sherman on My Mind (USGov)
- Identity Theft – Protect Yourself* (USN)*
_*Understanding PKI*_
_*Solar Sunrise: Dawn of a New Threat*_***_* *_
- (NACIC, NIPC, FBI)* (18 min)*
_*Risky Business*_***_* *_
- (NACIC, FBI) *(~20 min)*

**IA Videos**

** Government only. All others contact http://www.nacic.gov.**** ***

**Notes:**
Ears Looking at you - vulnerabilities of cell phones, 
Just the Fax - security of fax machines
Bits and Pieces - Humorous account of Agent 000 as he attempts to gain access to proprietary info
Magnificient Discretion - importance of computer security, especially when working from home
Sherman on My Mind –
AIS Misuse
Gambling/baseball pool
Surfing net for non-work related purposes
Printing non-work related files
Using government computers to run a private business on government time

Understand PKI - PKI Concept - how it works, why it’s necessary to protect the NII, DII

## ORDER

**INFORMATION**

##  Order Products Online

*frequently asked questions/product notes:*
-  Web: _[http://iase.disa.mil/infosec](http://iase.disa.mil/infosec)_
- Sign up for automatic e-mail notification of new products
-  E-mail: _[dodiaeta@ncr.disa.mil](mailto:dodiaeta@ncr.disa.mil)_
-  Ms. Emillie Quan
- _QuanE__[@ncr.disa.mil](mailto:olearyk@ncr.disa.mil)_
- (703) 882-1709 COM / 381-1709 DSN
-  Ms. Maryann Dennehy
- _[DennehyM](mailto:dennehym@ncr.disa.mil)__[@ncr.disa.mil](mailto:dennehym@ncr.disa.mil)_
- (703) 882-1716 COM / 381-1716 DSN

** ****Order Products Online**

## DoD IA Education, Training, Awareness Products  

**DISA/GO434, (703) 882-1716**
**DennehyM@ncr.disa.mil **
**March 2004**

**DoD IA Education, Training, Awareness Products  **