# Presentation: 109826

## LANL Unclassified Electronic Information Protection Program

- Effective as of April 13, 1999

## Federal Regulations & DOE Orders

- Computer Security Act of 1987
- OMB circular A130, Management of Federal Information Resources (1996)
- DOE Albuquerque A130 interpretation
- LANL position papers on the program
- LANL Protection Program Plan (PPP)
- LANL Unclassified Network Security Plan
- Most of the above are available at S-5 web sitehttp://s-5.lanl.gov/compsec/index.htm

## LANL Roles and Responsibilities

- Information Systems Security Site Manager (ISSM and Alternate ISSM)
- Line Managers
- System Administrators/Network Managers
- Organizational Computer Security Representatives (OCSRs)
- Information Systems Users

## ISSM and AISSM

- Information Systems Security Site Manager (ISSM), Charlene Douglass, S-5 Group Leader
- establishes policy (the protection program);
- determines adequacy of protections and accepts residual risk (reasonable and appropriate protection);
- accredits security plans for General Support Systems and Major Applications;
- establishes computer incident reporting process
- develops training for users, computer security personnel, and line managers to the program

**Notes:**
Lois Sylvia is the AISSM Alternate ISSM

General Support Systems:
Unclassified Network

Major Applications:
Enterprise Applications (Labwide Business Systems)
BRASS (Alarms system) 
LAICS Telephone Switch

## Laboratory Managers

- Ensure that their organizations have sufficient resources to fulfill their responsibilities
- system administrators
- network managers
- OCSRs
- users
- Formally assign OCSRs for their organizations
- Authorize users for system/network access

## Organizational Computer Security Representatives (OCSRs)

- Ensure users are trained
- Report incidents to S-5, the Computer Security Group
- Perform Tier 1 assessments of the program
- Serve as points of contact for their organizations in computer security matters

**Notes:**
Points of contact means, for example, assisting in DOE and other oversight entities audits, surveys, inspections, and assessments.

## System Managers

- Maintain security features on systems for which they are responsible
- Enable only necessary network services
- Install security patches in a timely manner
- Report security incidents to OCSRs or line managers
- Respond to vulnerability assessments

## Information Owners

- Determine sensitivity levels for the information they own
- IA Standard 6304 discusses Information Types
- Establish appropriate protections
- Authentication, Authorization, Encryption
- IA Standard 6303 discusses Protection Regimes
- IA security standards are available at URL http://www.lanl.gov/projects/ia-lanl/area/security/

## Information Systems Users

- Must register as computer users
- URL http://int.lanl.gov/projects/ocsr/register.html
- Must take the computer security training
- URL http://s-5.lanl.gov/compsec/Training.htm
- Report security incidents to OCSRs or line managers

## Information Systems Users

- Know what data you process (is it sensitive?)
- IA Std 6304 discusses sensitive information types
- Understand and implement required protections
- IA Std 6303 discusses appropriate protections
- Protect confidentiality with access controls: authentication, encryption
- Protect integrity and availability with access controls, backups, virus protection, and good system management

**Notes:**
Protections for Confidentiality, Integrity, and Availability

Protect Confidentiality with access controls: authentication, encryption
Protect Integrity and Availability with access controls, backups, virus protection, and good system management

## Information Systems Users (Continued)

- Understand need-to-know sharing requirements
- If you don't know about the data you process, ask the information owner
- If you don't know who owns the data you process, ask your project leader or line manager

**Notes:**
Protections for Confidentiality, Integrity, and Availability

Protect Confidentiality with access controls: authentication, encryption
Protect Integrity and Availability with access controls, backups, virus protection, and good system management

## Unclassified Network

- Protected and Open Unclassified Networks
- Office systems reside in the Blue (Protected)
- Servers reside in the Blue unless authorized to reside in the Green (Open)
- Register Systems and Network Devices
- Systems must be well-managed
- Access controls, security patches, running only necessary services
- External connections to the Blue must be explicitly approved (dial-ups, T1s, T3s, etc.)

**Notes:**
Firewall Approval Team deliberates on Blue modem requests and Green Server requests

Hostmaster is not required for system registrations but is being enhanced to support this requirement

## Auditing and Assessments

- Local information will be monitored and audited
- Network transmissions will be monitored and audited
- Systems will be scanned for vulnerabilities
- Networks will be tested for vulnerabilities
- Scans will detect unauthorized connections