# Presentation: 658974

## How to Use NIST SP 800-16“Information Technology Security Training Requirements: A Role- and Performance-Based Model”

- Mark Wilson, CISSP
- Computer Security Division, ITL
- National Institute of Standards and Technology
- -  November 16, 2004  -
- mark.wilson@nist.gov
- (301) 975-3870 (voice)         (301) 975-4007 (fax)
- http://csrc.nist.gov/

## Today’s Menu . . .

- NIST SP 800-16 – an Overview
- Break
- FISMA & OPM Say . . .
- How to Use NIST SP 800-16
- Break
- Exercise
- Wrap Up

## Objectives of This Workshop

- Understand:
- The NIST Special Publication (SP) 800-16 Learning Continuum
- Awareness Versus Training
- Why Role-Based Training
- SP 800-16 Roles
- Relationship Between Cells and Job Functions (Roles)
- Relationship Between Topics & Concepts and Cells
- Be Able to:
- Draft an Outline or Complete Course Structure
- Determine if a Training Course “Meets NIST SP 800-16”

## Security Training Guideline

- Special Publication (SP) 800-16: “Information Technology Security Training Requirements: A Role- and Performance-Based Model”
- Written by a FISSEA Workgroup
- Published in April 1998
- Supersedes NIST SP 500-172 (circa 1989)

## Primary Authors

- Dee de Zafra – DHHS (Ret.)
- Sadie Pitcher - Dept. of Commerce (Ret.)
- John Tressler - Dept. of Education (?)
- John Ippolito - Allied Technology

## Significant Others

- K Rudolph - Native Intelligence
- Vic Maconachy - NSA
- Corey Schou - Idaho State University
- Roger Quane - NSA

## Security Training Guideline

- First printing in loose-leaf
- The plan: binders
- Color graphics
- Section tabs
- On-line at:
- http://csrc.nist.gov/publications/nistpubs/index.html
- http://csrc.nist.gov/ATE/index.html

## Why Role-Based Training?

- Current IT environment is more complex
- SP 500-172 limited to five categories
- Executives
- Program and functional managers
- IRM, security, and audit
- ADP management and operations
- End users
- Roles, not titles, allow fine-tuning
- More than one role per person possible

## The NIST Model

## “NIST Model” Highlights

- Learning Continuum
- Basics and Literacy
- Role-Based Training
- 6 functional specialties
- 3 fundamental training content categories
- 26 job functions (roles)
- 46 training matrix cells
- 12 body of knowledge topics and concepts

## Learning Continuum

- Awareness
- What: Focus attention on IT Security
- Who: All employees
- Training
- What: Provide knowledge, skills, and abilities
- Who: Depends on roles and responsibilities
- Education
- What: Provide long-term understanding
- Who: IT Security professionals

## Basics and Literacy

- Transition from awareness to training
- Provides foundation for training
- Basics
- Core set of IT Security terms & concepts
- “The ABCs” - The IT Security alphabet
- Literacy
- Curriculum framework

## The NIST Model

## Slide 14

## Six Functional Specialties*

- Manage
- Acquire
- Design & Develop
- Implement & Operate
- Review & Evaluate
- Use
- *(Other . . . Expandable)

## Three Fundamental Training Content Categories*

- Laws and Regulations
- The IT Security Program
- System Life Cycle Security
- *(Other - expandable)

## Role-Based Training:26 Job Functions (Roles)

- Auditor, External
- Auditor, Internal
- Certification Reviewer
- Chief Information Officer (CIO)
- Contracting Officer
- Contracting Officer’s Technical Representative (COTR)
- Data Center Manager
- Database Administrator
- Designated Approving Authority (DAA)
- Freedom of Information Act Official
- Senior IRM Official
- Information Resources Manager

- IT Security Program Officer/Manager
- Network Administrator
- Privacy Act Official
- Program Manager
- Programmer/Systems Analyst
- Records Management Official
- Source Selection Board Member
- System Administrator
- System Designer/Developer
- System Owner
- Systems Operations Personnel
- Technical Support Personnel
- Telecommunications Specialist
- User

## IT Security Body of Knowledge Topics and Concepts

- Laws and Regulations
- IT Security Program
- System Environment
- System Interconnection
- Information Sharing
- Sensitivity
- Risk Management

- Management Controls
- Acquisition/ Development/ Installation/ Implementation Controls
- Operational Controls
- Awareness, Training, and Education Controls
- Technical Controls

## Sources of Topics and Concepts

- OMB Circular A-130, Appendix III
- OMB Bulletin 90-08
- NIST SP 800-12 (The NIST Handbook)
- NIST SP 800-14 (GSSPs)
- Material developed during SP 800-16 development

## Slide 20

## Single Course Matrix

## Slide 22

## Slide 23

## Slide 24

## Slide 25

## Slide 26

## Slide 27

## Slide 28

## Slide 29

## Slide 30

## Slide 31

## NIST Model Wrap-up

- Learning Continuum
- Basics and Literacy
- Role-Based Training
- 6 functional specialties
- 3 fundamental training content categories
- 26 job functions or roles
- 46 training matrix cells
- 12 body of knowledge topics and concepts

## From Model To Minutia

- Model

- Training Matrix

- Single Course Matrix

- Body Of Knowledge Topics & Concepts Per Cell

- Cells That Comprise A Course

## Questions?   Comments?Time for a Break?

## FISMA Says . . .

- Each agency shall develop, document, and implement an agencywide information security program . . . that includes . . . security awareness training [we call that “awareness”] to inform personnel, including contractors and other users of information systems that support the operations and assets of the agency . . .

## When We Say “Users” . . .

- “Users” Does Not Mean Only Employees
- Users Include:
- Employees
- Contractors
- Foreign or domestic guest researchers
- Other agency personnel
- Visitors
- Guests
- Other collaborators or associates requiring access

## FISMA Also Says . . .

- The head of each agency shall . . . delegate to the agency Chief Information Officer . . . training and overseeing personnel with ***significant responsibilities for information security*** . . .
- The head of each agency shall . . . ensure that the agency has trained personnel sufficient to assist the agency with complying with . . .

## FISMA: Train People with Significant Responsibilities . . .

- Who?
- CIO?
- CISO & Security Staff?
- System Owners?
- Application Owners?
- Data Owners?
- Contractors?

## FISMA: Train People with Significant Responsibilities . . .

- Who?
- Network Administrators?
- System Administrators?
- Server (e.g., mail, web) Administrators?
- Records Management Officials?
- Law Enforcement Officials?
- General Counsel?

## FISMA: Train People with Significant Responsibilities . . .

- How to Decide?
- Documented in Policy?
- Documented in Position Descriptions?
- Documented in Performance Plans?
- Documented in Security Plans?
- Documented in Contingency Plans, COOPs?
- Documented in IG Reports?  (Wait for IG Report?)
- Just Makes Sense?  Good Security Practice?  (Get Buy-in)

## OPM (June 2004) Says . . .

- Develop awareness and training plan
- All users of federal information systems must be exposed to awareness materials at least annually
- Identify employees with significant information security responsibilities and provide role-specific training in accordance with NIST standards and guidance

## OPM Also Says . . .

- Train:
- Executives
- Program and functional managers
- CIOs, IT security program managers, auditors, and other security oriented personnel (e.g., system and network administrators, and system/ application security officers)
- IT function management and operations personnel

## How to Use SP 800-16

- Select a Job Function (“Role”)
- Identify All Cells that Make Up the Job Function (Role)
- Identify the Body of Knowledge Topics and Concepts that Make Up Each Cell
- Populate Each Cell
- And Then . . .

## How to Use SP 800-16

- Select a Job Function . . . System Owner (See Appendix E)

## How to Use SP 800-16

- Identify All Cells that Make Up the Job Function (System Owner)  (See Page E-13)
- 1F
- 2.1A
- 2.2D
- 3.1A, 3.1B, 3.1C, 3.1E, 3.1F
- 3.2A, 3.2E
- 3.3E, 3.3F
- 3.4A, 3.4B, 3.4E
- 3.5A, 3.5B
- 3.6A

## How to Use SP 800-16

- Identify the Body of Knowledge Topics and Concepts that Make Up Each Cell - Start with Cell 1F (See Pages 69 & 70)
- #1 – Laws and Regulations
- #8 – Management Controls

## How to Use SP 800-16

- Identify the Body of Knowledge Topics and Concepts that Make Up Each Cell - Cell 2.1A   (See Pages 73 & 74)
- All 12 Topics and Concepts Are Used

## How to Use SP 800-16

- Identify the Body of Knowledge Topics and Concepts that Make Up Each Cell - Cell 2.2D  (See Pages 89 & 90)
- All 12 Topics and Concepts Are Used

## How to Use SP 800-16

- Identify the Body of Knowledge Topics and Concepts that Make Up Each Cell - Cell 3.1A  (See Pages 95 & 96)
- #2 – IT Security Program
- #5 – Information Sharing
- #6 – Sensitivity
- #8 – Management Controls
- #9 – Acquisition/Development/Installation/ 		       Implementation Controls

## How to Use SP 800-16

- Identify the Body of Knowledge Topics and Concepts that Make Up Each Cell
- Do This for Each of the 18 Cells in “System Owner” Job Function (Role)
- You Will Eventually Have . . .

## How to Use SP 800-16

## How to Use SP 800-16

- How to Populate Each Cell (Start With 1F):
- Read Definition
- Read Behavioral Outcome
- Select Knowledge Level (Beginning)
- Read Applicable Learning Objective
- Read Applicable Topics and Concepts (p. 70)
- Select Body of Knowledge Details from Applicable Topics and Concepts in Exhibit 4-4 (p. 48 & 51)

## How to Use SP 800-16

- How to Select Body of Knowledge Details from Applicable Topics and Concepts  in Exhibit 4-4 (Start With #1):
- Read Topic and Concept (Laws and Regulations)
- Select Those Details (and/or Add Your Own) *That Allow Audience to Achieve Behavioral Outcome* Shown in Cell 1F
- May Not Use All Detailed Information Shown

## Caveats (Yes, But . . .) to 800-16

- No Departments/Agencies Will Identify All 26 Roles as Having “Significant Responsibilities” (Wilson’s Bet)
- Organization Culture Must be Considered
- Hybrid Courses/Roles Possible
- Add a Cell; Delete a Cell – it’s OK!
- This Methodology is Flexible!!
- Add Your Own Detailed Information to That Which is in Exhibit 4-4

## Questions?  Confusions?  Break, Then Exercise

## Always Time for Exercise

- Pick a Role (System Owner)
- Identify All of the Cells (Appendix E)
- List All Topics and Concepts Used in Each Cell (Chapter 4)
- Select (or Add Your Own) Detailed Information for Each Topic and Concept Used in Each Cell (Exhibit 4-4) *[*We’ll Do This By Table or Group*]*

## Evaluating Training Effectiveness

- Why?  Training Must Be Meaningful?
- “Meaningful” Requires Measurement
- How and What Do We Measure?
- Student Satisfaction (Level 1)
- Learning (Teaching) Effectiveness (Level 2)
- Performance Effectiveness (Level 3)
- Training Program Effectiveness (Level 4)

## Summary

- We Discussed:
- The NIST Special Publication (SP) 800-16 Learning Continuum
- Awareness Versus Training
- Why Role-Based Training
- SP 800-16 Roles
- Relationship Between Cells and Job Functions (Roles)
- Relationship Between Topics & Concepts and Cells

## Summary, Continued

- We Did:
- Select Detailed Information From Topics and Concepts to Match Each Cell
- We Should Be Able to:
- Draft an Outline or Complete Course Structure
- Determine if a Training Course “Meets NIST SP 800-16”

## Questions?  Comments?  Please Complete Evaluation Form- Thank You -

- Mark Wilson, CISSP
- Computer Security Division, ITL
- National Institute of Standards and Technology
- -  November 16, 2004  -
- mark.wilson@nist.gov
- (301) 975-3870 (voice)         (301) 975-4007 (fax)