# Presentation: 688658

## FISMA Implementation ProjectThe Associated Security Standards and Guidelines 

*Stu Katzke; PhD*
*Computer Security Division*
*Information Technology Laboratory*

## Assurance in Information Systems

***Building more secure systems requires --***
- Well defined system-level security requirements and security specifications
- Well designed component products
- Sound systems security engineering practices
- Competent systems security engineers
- Appropriate metrics for product/system testing, evaluation, and assessment
- Comprehensive system security planning and life cycle management

## Supporting Tools and Programs

***Building more secure systems is enhanced by:***
- Standardized Security Requirements and Specifications
**NIAP/NSA Common Criteria protection profile development project**
**Private sector protection profile contributions**
**BITS functional packages**
**Smart Card Security Users Group (SCSUG)**
**Process Control Security Requirements Forum (PCSRF)**
- IT Component-level Product Testing and Evaluation Programs
-  **Common Criteria Evaluation and Validation Schemes (CCRA)**
** ****Cryptographic Module Validation Program (U.S. NIST/Canada CSE)**
- Security Implementation Guidance
**Security Technical Implementation Guides**
**Security Reference Guides**
- System Certification and Accreditation

## Supporting Tools and Programs

**Operational Environment**

***Accreditation Authority***

-  **Standards**
** ****Guidelines**

-  **Certification**
** ****Accreditation**

- Real World Threats and Vulnerabilities

-  Risk Management
-  Security Policies
-  System Security Plan

-  Personnel Security
-  Procedural Security
-  Physical Security

**Laboratory Environment**

- Implementation Guidance

## Security Certification (of an IT system)

- The comprehensive assessment of the management, operational, and technical security controls in an information system
- Assessment supports the security accreditation process
- Assessment performed by security expert (may be contractor)
- Assesses (in a particular environment of operation) the extent to which the implemented security controls are:
- Correctly implemented?
- Operating as intended?
- Producing the desired outcome with respect to meeting the system’s security requirements

## Security Certification (of an IT system)(continued)

- Determines remaining vulnerabilities in the information system based on the assessment.
- The results of a security certification are used to reassess the risks and update the system security plan
- Provides the factual basis for an authorizing official to render a security accreditation decision

## Security Accreditation (of an IT system)

- Official management decision to authorize operation of a system :
- Made by a senior agency official
- Is applicable to a particular environment of operation of the IT system
- Explicitly accepts the level of residual risk to agency:
- Operations (including mission, functions, image or reputation),
- Assets, &
- Individuals
- that remain after the implementation of an agree upon set of security controls in the IT system.

## Security Accreditation (of an IT system)(continued)

- Authorizing agency official accepts:
- Responsibility for system’s security
- Accountability for adverse impacts of security breaches

## A: Assess residual risk; Make authorization to operate  determination; Accept risk, responsibility, & accountability

**System Security Activities (Inside) within  the System Development Life Cycle (Outside)**

***Information Security***
***Activities***

**Risk Assessment**

**Security Planning**
- Determine Security Requirements
- Select  Security Controls

**Security**** ****Accreditation**

**Continuous Monitoring of  Security**
**Control Effectiveness**

**Technical Security Control **
**Development &**
**Implementation**

**Developmental Security Test & Evaluation**
- Develop Security Test Plan
- Test & Evaluate Security Controls

**Configuration Management and control**

**Initiation**

**Disposal**

**Development/Acquisition**

**    ****Operation/ Maintenance**

- A: Assess residual risk; Make authorization to operate  determination; Accept risk, responsibility, & accountability

- C: Determine if controls implemented correctly & operating as intended;   Determine & document residual vulnerabilities;

- C: Assess residual vulnerabilities;   A: Assess residual risk

**Categorize System**

**System Security**
**Installation &**
**Implementation**

**Implementation**

**Development/Acquisition**

- C =  Certification
- A =  Accreditation

**Control selection**

## FISMA LegislationOverview

-   “Each Federal agency shall develop, document, and implement an agency-wide information security program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source...”
- 				**--**** Federal Information Security Management Act of 2002**

## FISMA Tasks for NIST

- Standards to be used by Federal agencies to categorize information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels
- Guidelines recommending the types of information and information systems to be included in each category
- Minimum information security requirements (management, operational, and technical security controls) for information and information systems in each such category

## Project Objectives

- _Phase I_: To develop standards and guidelines for:
- Categorizing Federal information and information systems
- Selecting and specifying security controls for Federal information systems; and
- Assessing the effectiveness of security controls in Federal information systems
***	***_Phase II_: To create a national network of accredited organizations capable of providing cost effective, quality security assessment services based on the NIST standards and guidelines

## Significant Benefits

- More consistent and comparable specifications of security controls for information systems
- More consistent, comparable, and repeatable system-level assessments of information systems
- More complete and reliable security-related information for authorizing officials
- A better understanding of complex information systems and associated risks and vulnerabilities
- Greater availability of competent security certification services

## FISMA-Related  Guidance

**AGENCY INFORMATION**
**AND INFORMATION SYSTEM**

-  **SP 800-37       SP 800-53A**

**Security Control Assessment ****(Certification)**

- Determines extent to which security controls are implemented correctly, operating as intended, and producing the desired outcome in meeting security requirements.

- Defines categories of information and information systems according to levels
- of impact for confidentiality, integrity, and availability; maps information types to security categories.

**Categorization ****& Mapping**** of Information and Information System**

-  **FIPS 199****       SP 800-60**

- Documents the security requirements and security controls planned or in place for the protection of information and information systems

**Security Planning**

-  **SP 800-18**

- Analyzes the threats to and vulnerabilities in information systems and the potential impact or magnitude of harm that the loss of confidentiality, integrity, or availability would have on an agency’s operations and assets.

**Risk Assessment**

-  **SP 800-30**

**System Authorization ****(Accreditation)**

- Authorizes information systems to process, store, or transmit information; granted by a senior agency official, based on risk to agency operations and assets.

-  **SP 800-37**

**Security Control Selection and Implementation**

- Implements management, operational, and technical controls (i.e., safeguards and countermeasures) planned or in place to protect information and information systems.

-  **FIPS 200**

-  **SP 800-53 (Interim)**

- Completed

- In Progress (OMB/FISMA general requirement)

- In Progress (FISMA Requirement for NIST)

## Significance of NIST’s activities to the commercial sector (1)

- Guidance applicable to both government and commercial sector organizations
- NIST working with IEEE to establish industry standards/guidelines based on NIST standards/guidelines
- Minimum control sets/baselines incorporate security controls from many public and private sector sources:
- CC Part 2
- ISO/IEC 17799
- COBIT
- GAO FISCAM
- NIST SP 800-26 Self Assessment Questionnaire
- CMS (healthcare)
- D/CID 6-3 Requirements
- DoD Policy 8500
- BITS functional packages

## Significance of NIST’s activities to the commercial sector (2)

- Control sets mapped to threat coverage
- Can be adjusted to widen/reduce threat coverage
- Can be adjusted based on risk analytic process
- Unique, ambitious attempt by NIST to do control mapping
- Control sets adaptable and adoptable by other communities
- Control catalogue provides a rich set of controls to meet many needs
- Communities can tailor control sets/baselines according to their needs
- Healthcare (to demonstrate HIPPA compliance)
- Other communities

## Significance of NIST’s activities to the commercial sector (3)

- Based on expectations of wide adoption by US government agencies, NIST standards/guidelines may become de facto “due diligence” for commercial sector
- Will result in accredited individuals/organizations competent to perform system security evaluations
- NIST invites industry review and comment on applicability of NIST standards/guidelines to commercial sector systems
- NIST and IEEE invite participation in security standardization activities

## Using the CC to Support System Security Evaluation & Accreditation: Today

- IT component-level evaluation (hw, sw, firmware)
- Generic system evaluations (fixed grouping of integrated IT components evaluated in a laboratory environment)
- Composite evaluations (e.g., smart cards)
- Early/experimental  use of  “system level” PPs & use of the CC for system evaluation
- CC lacks functional requirements for the non-IT aspects of the IT system (e.g., physical, administrative, personnel, training)
- CEM has analogous shortcomings

## Using the CC to Support System Security Evaluation & Accreditation: Future

- Expansion of CC to include non-IT functional requirements of the operational environment (e.g.,  physical, administrative, procedural, personnel) as found in ISO 17799 and other control documents
- Expansion of CEM to include assessment of the non-IT functional requirements of the operational environment
- ISO/IEC JTC 1/SC 27 WG 3 New Work Item: Operational System Evaluation (Haruki Tabuchi, Mike Nash)
- NIST C&A project will submit its results to SC 27 WG 3 as a US contribution
- Candidate functional requirements & corresponding evaluation methodology for the non-IT aspects of the operational environment
- Accreditation of organizations to perform system evaluations

## ISO/IEC 17799

- Under consideration for expanding the Common Criteria to include non-IT functional requirements required for system evaluation (work item in ISO/IEC SC 27 WG 3)
- System security-related aspects incorporated  into NIST’s minimum security requirements/baselines

## Categorization StandardsNIST FISMA Requirement #1

- Develop standards to be used by Federal agencies to categorize information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels
- Publication status:
-  	Federal Information Processing Standards (FIPS)  	Publication 199, “Standards for Security Categorization 	of Federal Information and Information Systems”
-   Public Review Period: May 16th—August 16th 2003
-  	Final Publication: December 2003
-   Federal Standard 199:  February 2004

## FIPS Publication 199

- Establishes standards to be used by Federal agencies to ***categorize*** information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels
- Will be linked to the Federal Enterprise Architecture to show ***security traceability*** through reference models

## Security Categorization

|  | Low | Moderate | High |
| --- | --- | --- | --- |
| 
Confidentiality | The unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.  | The unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. | The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. |
| 
Integrity | The unauthorized modification or destruction of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.  | The unauthorized modification or destruction of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.  | The unauthorized modification or destruction of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.  |
| 
Availability |   The disruption of access to or use of information or an information system could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.  | The disruption of access to or use of information or an information system could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.  | The disruption of access to or use of information or an information system could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.  |

***An Example: Mission Critical Information and Information System***

**Guidance for Mapping Types of Information and Information Systems to FIPS Pub 199 Security Categories**

## Security Categorization

|  | Low | Moderate | High |
| --- | --- | --- | --- |
| 
Confidentiality | The unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.  | The unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. | The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. |
| 
Integrity | The unauthorized modification or destruction of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.  | The unauthorized modification or destruction of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.  | The unauthorized modification or destruction of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.  |
| 
Availability |   The disruption of access to or use of information or an information system could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.  | The disruption of access to or use of information or an information system could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.  | The disruption of access to or use of information or an information system could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.  |

***An Example: Mission Critical Information and Information System***

**Guidance for Mapping Types of Information and Information Systems to FIPS Pub 199 Security Categories**

**Baseline Security Controls for High Impact Systems**

## Mapping GuidelinesNIST FISMA Requirement #2

- Develop guidelines recommending the types of information and information systems to be included in each category described in FIPS Publication 199
- Publication status:
- NIST Special Publication 800-60, “Guide for  Mapping Types of Information and Information Systems to Security Categories”
- Initial Public Draft (December 2003)

## Minimum Security RequirementsNIST FISMA Requirement #3

- Develop minimum information security requirements (i.e., management, operational, and technical security controls) for information and information systems in each such category—
- Publication status:
-  	Federal Information Processing Standards (FIPS)  	Publication 200, “Minimum Security Controls for 	Federal Information Systems”*****
-  	Final Publication December 2005
*****	NIST Special Publication 800-53, “Recommended Security Controls for Federal Information Systems”, (Initial public draft, October 2003), will provide interim guidance until completion and adoption of FIPS Publication 200.

## Special Publication 800-53Recommended Security Controls for Federal Information Systems

- Provides a master catalog of security controls for information systems (incorporated from many sources including NIST SP 800-26, DoD Policy 8500, D/CID 6-3, ISO/IEC 17799, GAO FISCAM, HHS-CMS)
- Recommends baseline (minimum) security controls for information systems in accordance with security categories in FIPS Publication 199
- Provides guidelines for agency-directed tailoring of baseline security controls

## Applicability

- Applicable to all Federal information systems other than those systems designated as national security systems as defined in 44 U.S.C., Section 3542
- Broadly developed from a technical perspective to complement similar guidelines issued by agencies and offices operating or exercising control over national security systems

## Security Controls

- The management, operational, and technical controls (i.e., safeguards or countermeasures) prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information.
**	****-- [FIPS Publication 199, December 2003]**

## Key Questions

- What security controls are needed to adequately protect an information system that supports the operations and assets of the organization?
- Have the selected security controls been implemented or is there a realistic plan for their implementation?
- To what extent are the security controls implemented correctly, operating as intended, and producing the desired outcome?

## Catalog of Security Controls

- Contains 166 entries currently
- Organized by classes and families
- Includes three levels of security control strength (basic, enhanced, and strong) when appropriate and technically feasible
- Dynamic in nature allowing revisions and extensions to security controls to meet changing requirements and technologies

## Security Control Structure

- Section I:  *Control Objective*
- Provides the overall objective for the particular security control when applied to an information system
- Section II:  *Control Mapping*
- Lists source documents considered during development of the control catalog that have similar security controls, (e.g., FISCAM, DoD 8500, ISO 17799, NIST SP 800-26, DCID 6/3, HHS CMS)
- Section III: *Control Description*
- Provides the specific control requirements and details of each control

## Security Control ExampleClass: Management              Family: Security Control Review

**CR-2****	****VULNERABILITY SCANNING**
**	****	**_Control objective_: In accordance with organizational policy, detailed procedures 	are developed, documented, and effectively implemented to periodically scan for 	vulnerabilities in the information system.
- 		_Control mapping_: [NIST 800-26: 2.1.4; ISO-17799: 12.2.2; DCID 6/3: 	SysAssur3-b; DOD 8500: VIVM-1]
**CR-2.b**	_Basic control_: Vulnerability assessment tools are implemented by the 	organization and personnel are trained in their use. The organization conducts 	periodic testing of the security posture of the information system by scanning the 	system with vulnerability detection tools every [*Assignment: time period (e.g., **	**every 6 months)*].

## Security Control ExampleClass: Management              Family: Security Control Review

**CR-2****	****VULNERABILITY SCANNING**
**	****	**_Control objective_: In accordance with organizational policy, detailed procedures 	are developed, documented, and effectively implemented to periodically scan for 	vulnerabilities in the information system.
**CR-2.e**	_Enhanced__ control_: Vulnerability assessment tools are implemented by the 	organization and personnel are trained in their use. The organization conducts 	periodic testing of the security posture of the information system by scanning the 	system with vulnerability detection tools every [*Assignment: time period (e.g., **	**every 6 months)*]. Vulnerability scanning tools include the capability to readily 	update the list of vulnerabilities scanned. The list of vulnerabilities scanned is 	updated periodically, at least prior to each periodic scan. Vulnerability scanning 	procedures include vulnerability list update and vulnerability scan when a 	significant, new vulnerability is announced. Procedures include checks to be 	performed and assigned responsibilities for conducting these checks to 	periodically ensure that the procedures are being correctly applied and 	consistently followed.

## Security Control ExampleClass: Management              Family: Security Control Review

**CR-2****	****VULNERABILITY SCANNING**
**	****	**_Control objective_: In accordance with organizational policy, detailed procedures 	are developed, documented, and effectively implemented to periodically scan for 	vulnerabilities in the information system.
**CR-2.s**	_Strong__ control_: Vulnerability assessment tools are implemented by the 	organization and personnel are trained in their use. The organization conducts 	periodic testing of the security posture of the information system by scanning the 	system with vulnerability detection tools every [*Assignment: time period (e.g., **	**every 6 months)*]. Vulnerability scanning tools include the capability to readily 	update the list of vulnerabilities scanned. The list of vulnerabilities scanned is 	updated periodically, at least prior to each periodic scan. Vulnerability scanning 	procedures include vulnerability list update and vulnerability scan when a 	significant, new vulnerability is announced. Vulnerability scanning procedures 	include means to ensure adequate scan coverage, both vulnerabilities checked 	and information system components scanned. Procedures include checks to be 	performed and assigned responsibilities for conducting these checks to 	periodically ensure that the procedures are being correctly applied and 	consistently followed.

## Security Controls

- Management Controls
- Safeguards and countermeasures employed by an organization to manage the security of the information system and the associated risk to the organization’s assets and operations
- Operational Controls
- Safeguards and countermeasures employed by an organization to support the management and technical security controls in the information system (typically executed by people, not systems)
- Technical Controls
- Safeguards and countermeasures (typically described as security mechanisms) employed within the information system’s hardware, software, or firmware to protect the system and its information from unauthorized access, use, disclosure, disruption, modification, or destruction

## Management ControlsFamilies of Controls

- Risk Assessment
- Security Planning
- System and Services Acquisition
- Security Control Review
- Processing Authorization

## Operational ControlsFamilies of Controls

- Personnel Security
- Physical and Environmental Protection
- Contingency Planning and Operations
- Configuration Management
- Hardware and Software Maintenance

## Operational ControlsFamilies of Controls

- System and Information Integrity
- Media Protection
- Incident Response
- Security Awareness and Training

## Technical ControlsFamilies of Controls

- Identification and Authentication
- Logical Access Control
- Accountability (Including Audit)
- System and Communications Protection

## Baseline Security Controls

- Three sets of baseline (minimum) security controls defined for security categories in accordance with FIPS Publication 199
- Each set of security controls in the respective baselines (i.e., low, moderate, high) provides an estimated threat coverage
- For identifiable threat sources, security controls in the baselines provide: (i) full coverage; (ii) partial coverage; or (iii) no coverage

## Baseline Security Controls

- Baseline security controls provide a *starting point* for organizations and communities of interest in their security control selection process
- The security control set can be tailored by organizations based on results of risk assessments and/or specific security requirements (e.g., HIPAA, Gramm-Leach-Bliley)
- The final agreed upon set of security controls is documented in the system security plan

## Threat Characteristics

- Special Publication 800-53 characterizes threat sources by:
-  Type
-  Capabilities
-  Resources
-  Intentions

## Threat CharacteristicsType of Attack

- Local
- The physical presence of the attacker is required at the site of the attack where the information system resides
- Network
- The physical presence of the attacker is not required at the site of the attack where the information system resides—rather the attacker initiates the attack from the network

## Threat CharacteristicsCapability of the Attacker

- Sophistication of the Attack
**Low:**** **The attacker has common IT skills and limited knowledge about the information system being attacked and does not use attack tools
**High:** Either (or both) of the following: (i) the attacker uses sophisticated attack tools (includes publicly available tools); or (ii) the attacker uses advanced IT attack skills
- Access to the Information System
**Insider:**** **The attacker is a non-user of the information system, a non-privileged user of the system or a privileged user of the system
**Outsider:**** **The attacker is either a non-user of the information system or a public user of the information system

## Threat CharacteristicsIntent of the Attacker

- Non-malicious
- The attacker has no intent to do damage to the information system or to cause harm to the organization but pursues the attack due to curiosity, boredom, or for the intellectual challenge
- Malicious
- The attacker has clear intent to do damage to the information system and to cause harm to the organization adversely affecting the organization’s operations or assets

## Threat CharacteristicsResources of the Attacker

- Minimal
- The attacker is:
- self-directed and self-motivated
- operates independently (as an individual or in a small group) without outside influences, direction, or guidance
- carries out attack with minimal resources (typically less than one million dollars)

## Threat CharacteristicsResources of the Attacker

- Moderate
- The attacker is:
- part of a group or organization not involving a nation-state (e.g., a company engaged in commercial espionage or an entity engaged in criminal or terrorist activity)
- operates with significant direction and guidance from the leadership of the group or organization and is subject to the influences of the group or organization
- carries out attack with moderate resources (typically less than ten million dollars)

## Threat CharacteristicsResources of the Attacker

- Substantial
- The attacker is:
- part of a group or organization involving a nation-state (e.g., a country engaged in intelligence gathering activities, information warfare, or state-sponsored terrorism)
- operates with significant direction and guidance from the leadership of the group or organization and is under the direct authority of the group or organization
- carries out attack with substantial resources (typically greater than ten million dollars)

## Control Selection Process

- Establish security
- category of information system
**FIPS Publication 199**

- Select minimum
- security controls
**SP 800-53**
**FIPS Publication 200**

- Factor in local
- conditions; adjust
- security controls
**SP 800-30**

- Document security
- controls in
- security plan
**SP 800-18**

## Certification and Accreditation

- Conduct periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices (including management, operational, and technical controls)
- Publication status:
- NIST Special Publication 800-37, “Guide for the Security Certification and Accreditation of Federal Information Systems”
- NIST Special Publication 800-53A, “Assessing the Security Controls in Federal Information Systems”

## Special Publication 800-37Guide for the Security Certification and Accreditationof Federal Information Systems

- Establishes guidelines (including tasks and subtasks) to certify and accredit information systems supporting the executive branch of the Federal government
- Applicable to non-national security information systems as defined in the Federal Information Security Management Act of 2002
- Replaces Federal Information Processing Standards (FIPS) Publication 102

## Special Publication 800-53AAssessing the Security Controls in Federal Information Systems

- Provides standardized assessment methods and procedures to determine the extent to which the security controls in an information system are:
- Implemented correctly
- Operating as intended
- Producing the desired outcome with respect to meeting system security requirements
- Allows additional methods procedures to be applied at the discretion of the agency

## FISMA Implementation Project Standards and Guidelines

- FIPS Publication 199 (Security Categorization)
- NIST Special Publication 800-37 (C&A)
- NIST Special Publication 800-53 (Security Controls)
- NIST Special Publication 800-53A (Assessment)
- NIST Special Publication 800-59 (National Security)
- NIST Special Publication 800-60 (Category Mapping)
- FIPS Publication 200 (Minimum Security Controls)

## NIST Standards and Guidelines

***Are intended to promote and facilitate—***
- More consistent, comparable specifications of security controls for information systems
- More consistent, comparable, and repeatable system evaluations of information systems
- More complete and reliable security-related information for authorizing officials
- A better understanding of complex information systems and associated risks and vulnerabilities
- Greater availability of competent security certification services

## Contact Information

**100 Bureau Drive  Mailstop 8930**
**  ****Gaithersburg, MD USA 20899-8930**
***	******	******Project Manager******	*****	****	*****Assessment Program***
*	**	*Dr. Ron Ross			Arnold Johnson
**	****	**(301) 975-5390			(301) 975-3247
- 		**rross@nist.gov** 			**arnold.johnson@nist.gov**
***	******	******Special Publications******	******	******Organization Accreditations***
- 		Joan Hash			Patricia Toth
- 		(301) 975-3357			(301) 975-5140
- 		joan.hash**@nist.gov****	****	****patricia.toth@nist.gov**
***	******	******Gov’t and Industry Outreach******	******Technical Advisor***
- 		Dr. Stu Katzke			Gary Stoneburner
- 		(301) 975-4768			(301) 975-5394
- 		**skatzke@nist.gov****	****	****	****gary.stoneburner@nist.gov**
**Comments to: ****sec-cert@nist.gov**
**World Wide Web: ****http://csrc.nist.gov/sec-cert**

## Today’s Climate

- Highly interactive environment of powerful computing devices and interconnected systems of systems across global networks
- Federal agencies routinely interact with industry, private citizens, state and local governments, and the governments of other nations
- The complexity of today’s systems and networks presents great security challenges for both producers and consumers of information technology

## The Advantage of the Offense

- Powerful attack tools now available over the Internet to anyone who wants them
- Powerful, affordable computing platforms to launch sophisticated attacks now available to the masses
- Little skill or sophistication required to initiate extremely harmful attacks
*	**Result: The sophistication of the *_*attack*_* is growing, but the sophistication of the *_*attacker*_* is not.*

## Today’s Challenges

- Adequately protecting information systems within constrained budgets
- Changing the current culture of:
*	****“******Connect first...ask security questions later”***
- Bringing standards to:
- Security controls for information systems
- Verification procedures employed to assess the effectiveness of those controls

## The Security Chain

- Links in the Chain
- (Technology based examples)
-  Access control mechanisms
-  Identification & authentication mechanisms
-  Audit mechanisms
-  Encryption mechanisms
-  Firewalls
-  Smart cards
-  Biometrics

- Links in the Chain
- (Non-technology based examples)
-  Security policies and procedures
-  Risk management
-  Security planning
-  Contingency planning
-  Incident response planning
-  Physical security
-  Personnel security

- Adversaries attack the weakest link...where is yours?