# Presentation: 674046

## Building More Secure Information Systems A Strategy for Effectively Applying the Provisions of FISMA

*Dr. Ron Ross*
*Computer Security Division*
*Information Technology Laboratory*

## The Global Threat

- Information security is not just a paperwork drill...there are dangerous adversaries out there capable of launching serious attacks on our information systems that can result in severe or catastrophic damage to the nation’s critical information infrastructure and ultimately threaten our economic and national security...

## U.S. Critical InfrastructuresDefinition

- “...systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health and safety, or any combination of those matters.”
- 	***--  USA Patriot Act (P.L. 107-56)***

## U.S. Critical InfrastructuresExamples

- Energy (electrical, nuclear, gas and oil, dams)
- Transportation (air, road, rail, port, waterways)
- Public Health Systems / Emergency Services
- Information and Telecommunications
- Defense Industry
- Banking and Finance
- Postal and Shipping
- Agriculture / Food / Water
- Chemical

## Critical Infrastructure Protection

- The U.S. critical infrastructures are over 90% owned and operated by the private sector
- Critical infrastructure protection must be a partnership between the public and private sectors
- Information security solutions must be broad-based, consensus-driven, and address the ongoing needs of government and industry

## Threats to Security

## Why Standardization?Security Visibility Among Business/Mission Partners

## Legislative and Policy Drivers

- Public Law 107-347 (Title III)
- 	***Federal Information Security Management Act of 2002***
- Public Law 107-305
***	******Cyber Security Research and Development Act of 2002***
- Homeland Security Presidential Directive #7
- 	***Critical Infrastructure Identification, Prioritization, and Protection ***
- OMB Circular A-130 (Appendix III)
- 	***Security of Federal Automated Information Resources***

## FISMA LegislationOverview

-   “Each federal agency shall develop, document, and implement an agency-wide information security program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source...”
- 				**--**** Federal Information Security Management Act of 2002**

## FISMA Implementation ProjectCurrent and Future Activities

- Phase I:	Development of FISMA-related security 			standards and guidelines
- 	Status:	Currently underway and nearing completion
- Phase II:	Development of accreditation program for 			security service providers
- 	Status:	Projected start in 2006; partially funded
- Phase III:	Development of validation program for 			information security tools
- 	Status:	Projected start 2007-08; currently not funded

## FISMA Implementation Project Standards and Guidelines

- FIPS Publication 199 (Security Categorization)
- FIPS Publication 200 (Minimum Security Requirements)
- NIST Special Publication 800-18, Rev 1 (Security Planning)
- NIST Special Publication 800-26, Rev 1 (Reporting Formats)
- NIST Special Publication 800-30 (Risk Management)
- NIST Special Publication 800-37 (Certification & Accreditation)
- NIST Special Publication 800-53 (Recommended Security Controls)
- NIST Special Publication 800-53A (Security Control Assessment)
- NIST Special Publication 800-59 (National Security Systems)
- NIST Special Publication 800-60 (Security Category Mapping)

## FISMA Implementation

- 	Why is FISMA so challenging to implement?
- We are building a solid foundation of information security across the largest information technology infrastructure in the world based on comprehensive security standards.
- We are establishing a fundamental level of “security due diligence” for federal agencies and their contractors based on minimum security requirements and security controls.
- Federal agencies are at various levels of maturity with respect to assimilating the new security standards and guidance; an extensive and important investment that will take time to fully implement.

## FISMA Implementation

- 	Why is FISMA so challenging to implement?
- There is no consistency in the evaluation criteria used by auditors across the federal government when assessing the effectiveness of security controls in federal information systems; thus results vary widely.
- We (collectively) underestimate the complexity and the enormity of the task of building a higher level of security into the federal information technology infrastructure; expectations and measures of success vary.

## Categorization StandardsFISMA Requirement

- Develop standards to be used by federal agencies to categorize information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels
- Publication status:
-  	Federal Information Processing Standards (FIPS)  	Publication 199, “Standards for Security Categorization 	of Federal Information and Information Systems”
- 	Final Publication: February 2004

## FIPS Publication 199

- FIPS 199 is critically important to enterprises because the standard—
- Requires prioritization of information systems according to potential impact on mission or business operations
- Promotes effective allocation of limited information security resources according to greatest need
- Facilitates effective application of security controls to achieve adequate information security
- Establishes appropriate expectations for information system protection

## FIPS 199 Applications

- FIPS 199 should guide the rigor, intensity, and scope of all information security-related activities within the enterprise including—
- The application and allocation of security controls within information systems
- The assessment of security controls to determine control effectiveness
- Information system authorizations or accreditations
- Oversight, reporting requirements, and performance metrics for security effectiveness and compliance

## Security Categorization

| 
FIPS Publication 199 | 
Low | 
Moderate
 | 
High |
| --- | --- | --- | --- |
| 
Confidentiality | The loss of confidentiality could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.  | The loss of confidentiality could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.  | The loss of confidentiality could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.  |
| 
Integrity | The loss of integrity could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.  | The loss of integrity could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.  | The loss of integrity could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.  |
| 
Availability | The loss of availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.  | The loss of availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.  | The loss of availability could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. |

***Example: An Enterprise Information System***

**Guidance for Mapping Types of Information and Information Systems to FIPS Publication 199 Security Categories**

## Security Categorization

| 
FIPS Publication 199 | 
Low | 
Moderate
 | 
High |
| --- | --- | --- | --- |
| 
Confidentiality | The loss of confidentiality could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.  | The loss of confidentiality could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.  | The loss of confidentiality could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.  |
| 
Integrity | The loss of integrity could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.  | The loss of integrity could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.  | The loss of integrity could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.  |
| 
Availability | The loss of availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.  | The loss of availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.  | The loss of availability could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. |

***Example: An Enterprise Information System***

**Guidance for Mapping Types of Information and Information Systems to FIPS Publication 199 Security Categories**

**Minimum Security Controls for High Impact Systems**

## Mapping GuidelinesFISMA Requirement

- Develop guidelines recommending the types of information and information systems to be included in each security category defined in FIPS 199
- Publication status:
- NIST Special Publication 800-60, “Guide for  Mapping Types of Information and Information Systems to Security Categories”
- Final Publication: June 2004

## Minimum Security RequirementsFISMA Requirement

- Develop minimum information security requirements for information and information systems in each security category defined in FIPS 199
- Publication status:
-  	Federal Information Processing Standards (FIPS)  	Publication 200, “Minimum Security Requirements for 	Federal Information and Information Systems”
-  	Final Publication: March 2006

## Minimum Security Controls

- Develop minimum security controls (management, operational, and technical) to meet the minimum security requirements in FIPS 200
- Publication status:
-  NIST Special Publication 800-53, “Recommended
- 	 Security Controls for Federal Information Systems”
-  Final Publication:  February 2005*
-  * SP 800-53, Revision 1(Initial public draft) published in February 2006.

## Minimum Security Controls

- Minimum security controls, or baseline controls, defined for low-impact, moderate-impact, and high-impact information systems—
- Provide a ***starting point*** for organizations in their security control selection process
- Are used in conjunction with ***tailoring guidance*** that allows the baseline controls to be adjusted for specific operational environments
- Support the organization’s ***risk management process***

## Security Control Baselines

## Tailoring Security ControlsScoping, Parameterization, and Compensating Controls

## Requirements Traceability

## Security Control AssessmentsFISMA Requirement

- Conduct periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices (including management, operational, and technical security controls)
- Publication status:
- NIST Special Publication 800-53A, “Guide for Assessing the Security Controls in Federal Information Systems”
- Second Public Draft:  April 2006

## Certification and AccreditationSupporting FISMA Requirement

- Conduct periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices (including management, operational, and technical security controls)
- Publication status:
- NIST Special Publication 800-37, “Guide for the Security Certification and Accreditation of Federal Information Systems”
- Final Publication: May 2004

## Putting It All Together

***Question***
- How does the family of FISMA-related publications fit into an organization’s
-  information security program?

## An Integrated Approach

***Answer***
- NIST publications in the FISMA-related
- series provide security standards and
- guidelines that support an enterprise-wide
- risk management process and are an
- integral part of an agency’s overall
- information security program.

## Information Security Program

- Adversaries attack the weakest link...where is yours?

-  Risk assessment
-  Security planning
-  Security policies and procedures
-  Contingency planning
-  Incident response planning
-  Security awareness and training
-  Physical security
-  Personnel security
-  Certification, accreditation, and
-     security assessments

-  Access control mechanisms
-  Identification & authentication mechanisms
-     (Biometrics, tokens, passwords)
-  Audit mechanisms
-  Encryption mechanisms
-  Firewalls and network security mechanisms
-  Intrusion detection systems
-  Security configuration settings
-  Anti-viral software
-  Smart cards

- Links in the Security Chain: Management, Operational, and Technical Controls

## Managing Enterprise Risk

- Key activities in managing enterprise-level risk—risk resulting from the operation of an information system:
**Categorize** the information system
**Select** set of minimum (baseline) security controls
**Refine **the security control set based on risk assessment
**Document** security controls in system security plan
**Implement** the security controls in the information system
**Assess** the security controls
**Determine** agency-level risk and risk acceptability
**Authorize** information system operation
**Monitor** security controls on a continuous basis

## The Risk Framework

***Starting Point***

## FISMA Implementation Tips

- 	**Key strategies for successful implementation—**
- Conduct FIPS 199 ***impact analyses*** as a corporate-wide exercise with the participation of key officials (e.g., Chief Information Officer, Senior Agency Information Security Officer, Authorizing Officials, System Owners).
- 	Rationale: The agency is heavily dependent upon its information systems and information technology infrastructure to successfully conduct critical missions.  Therefore, the protection of those critical missions is of the highest priority.  An incorrect information system impact analysis (i.e., incorrect FIPS 199 security categorization) results in the agency either over protecting the information system and wasting valuable security resources or under protecting the information system and placing important operations and assets at risk.

## FISMA Implementation Tips

- 	**Key strategies for successful implementation—**
- For each security control baseline (low, moderate, or high) identified in NIST Special Publication 800-53, apply the ***tailoring guidance*** to adjust set of controls to meet the specific operational requirements of the agency.
- 	Rationale: Application of the tailoring guidance in Special Publication 800-53 can eliminate unnecessary security controls, incorporate compensating controls when needed, specify agency-specific parameters in the controls, and add controls when greater mission-protection is required.  Tailoring is an essential activity to ensure the final, agreed upon set of security controls for the information system provides adequate security.  Tailoring activities and associated tailoring decisions should be well documented with appropriate justifications and rationale capable of providing reasoned arguments to auditors.

## FISMA Implementation Tips

- 	**Key strategies for successful implementation—**
- Conduct the selection of ***common security controls*** (i.e., agency infrastructure-related controls or controls for common hardware/software platforms) as a corporate-wide exercise with the participation of key officials (e.g., Chief Information Officer, Senior Agency Information Security Officer, Authorizing Officials, System Owners).
- 	Rationale: The careful selection of common security controls can save the agency significant resources and facilitate a more consistent application of security controls enterprise-wide.  Agency officials must assign responsibility for the development, implementation, and assessment of the common controls and ensure that the resulting information is available to all interested parties.

## The Desired End StateSecurity Visibility Among Business/Mission Partners

## New Initiatives

- Applying FISMA security standards and guidance to Industrial Control/SCADA Systems—
- Completed two-day workshop at NIST involving major federal entities with Industrial Control/SCADA systems or having significant interest in those types of systems (e.g., Bonneville Power Administration, Tennessee Valley Authority, Western Area Power Administration, Federal Energy Regulatory Commission, Department of Interior Bureau of Land Management)
- Analyzed the impact of applying the security controls in NIST SP 800-53 to Industrial Control/SCADA Systems; soliciting recommendations for additional security controls and/or developing control interpretations.

## The Golden RulesBuilding an Effective Enterprise Information Security Program

- Develop an enterprise-wide information security strategy and game plan
- Get corporate “buy in” for the enterprise information security program—effective programs start at the top
- Build information security into the infrastructure of the enterprise
- Establish level of “due diligence” for information security
- Focus initially on mission/business case impacts—bring in threat information only when specific and credible

## The Golden RulesBuilding an Effective Enterprise Information Security Program

- Create a balanced information security program with management, operational, and technical security controls
- Employ a solid foundation of security controls first, then build on that foundation guided by an assessment of risk
- Avoid complicated and expensive risk assessments that rely on flawed assumptions or unverifiable data
- Harden the target; place multiple barriers between the adversary and enterprise information systems
- Be a good consumer—beware of vendors trying to sell “single point solutions” for enterprise security problems

## The Golden RulesBuilding an Effective Enterprise Information Security Program

- Don’t be overwhelmed with the enormity or complexity of the information security problem—take one step at a time and build on small successes
- Don’t tolerate indifference to enterprise information security problems
- 	***And finally...***
- Manage enterprise risk—don’t try to avoid it!

## FISMA Implementation Project

- FISMA-related standards and guidelines tightly coupled to the suite of NIST Management and Technical Guidelines
- Described within the context of System Development Life Cycle (SDLC)

**http://csrc.nist.gov/SDLCinfosec**

## Contact Information

**100 Bureau Drive  Mailstop 8930**
**  ****Gaithersburg, MD USA 20899-8930**
***	******	******Project Leader******	*****	****	*****Administrative Support***
*	**	***Dr. Ron Ross****	****	****	****Peggy Himes**
**	****	****(301) 975-5390****	****	****	****(****301) 975-****2489****	****	****	****ron.ross@nist.gov ****	****	****	****peggy.himes@nist.gov**
***	******	******Senior Information Security Researchers and Technical Support***
**	****	****Marianne Swanson****	****	**** ****	****Dr. Stu Katzke ****	**
**	****	****(301) 975-3293****	****	**** ****	****(301) 975-4768 ****	**
**	****	****marianne.swanson@nist.gov****	****	****skatzke@nist.gov****	*****	***
- 		**Pat Toth****	****	****	****	****Arnold Johnson**
**	****	****(301) 975-5140****	****	****	****(301) 975-****3247 ****	****	****	****patricia.toth@nist.gov**** ****	****	****arnold.johnson@nist.gov**
**	****	****Curt Barker****	****	****	****Information and Feedback**
**	****	****(301) 975-4768****	****	****	****Web:**** ****csrc.nist.gov/sec-cert**
**	****	****wbarker@nist.gov ****	****	****	****Comments:**** ****sec-cert@nist.gov**