# Presentation: 678440

## Thoughts, Observations and Brutal Reality

- Brig. Gen. John J. Kelly, Jr., USAF (Ret.)
- Deputy Under Secretary for Oceans and Atmosphere
- January 24, 2007

## Information Security

## Information Security 

- Important
- All about acceptance of prudent risk
- All responsible; not solely CIO function
- NOAA—wide problem

- SES Summit 2007: Thoughts, Observations and Brutal Reality

**Notes:**
Generally speaking, each system owner should reserve 5-15% of the total investment of the asset for the purpose of security costs and C&A activities.  Unexpected security costs may occur when a risk assessment is conducted.  It will cost money to fix the vulnerabilities discovered through that risk assessment.

Based on the management mantra of PLAN – BUILD – RUN:
Plan it securely – Planning and budgeting for security at the beginning of the life cycle is far less costly than as an after thought.
Build it securely – Your mission can be accomplished more efficiently if systems are built securely.
Run it securely – Continual security management practices, such as change control, is critical to maintaining your security posture.

## 	  Importance

- It’s the Law and Administration Policy
- Federal Information Security Act (FISMA)
- OMB Circular A-130
- NOAA-wide 134 IT Systems
- 23 Categorized as High Impact
- HIGH IMPACT
-  “Security breach potentially have severe or catastrophic consequences” (OUR Words)
- Systems may contain Personally Identifiable Information (PII)

- SES Summit 2007: Thoughts, Observations and Brutal Reality

**Notes:**
Address security throughout a system’s life cycle.  

Good security is includes good management practices such as Configuration Management and Contingency Planning.  

Security extends into other management disciplines such as Enterprise Architecture, Capital Planning/Investment Control and Earned Value Management.

## Slide 5

## 	  Importance

- 	  Importance

## Importance

- Veterans Affairs Secretary Jim Nicholson announced several personnel changes yesterday that will include the firing of a senior career data analyst who lost the sensitive personal information of millions of veterans.
- Laptop containing sensitive data, including Social Security numbers, of 13,000 District of Columbia employees and retirees was stolen from the Washington home of an employee of ING U.S. Financial Services.
- Chief Naval Operations “We need to be ruthless in making the hard decisions to turn systems off...  Obsolete applications, servers, and networks need to be terminated and the remainder must all be accredited with full authority to operate.”

- SES Summit 2007: Thoughts, Observations and Brutal Reality

## Problem

- To Operate all IT Systems must be Certified and Accredited (C&A)
- NOAA-wide 134 IT systems
- Recertification required every 3 years
- C&A process not well understood and costly – time & $
- IT Security “material” Weakness in DOC Audit
- A repeated finding

- Wrong Focus
- On OIG review for Audit
- Quantity versus Quality
- Inattention to detail and documentation
- Attitude
- Never satisfy OIG requirements
- Not have sufficient specific $ identified in enacted budget
- Bar keeps changing

- SES Summit 2007: Thoughts, Observations and Brutal Reality

**Notes:**
C&A exposes the risks to allow management to make balanced and sound financial decisions.

Security should not be viewed as a cost center or a compliancy exercise, rather, it enables you and your customers to have confidence in the confidentiality, integrity and availability of the data your system is processing, storing or transmitting.

Security is an enabling technology.  In other words – it’s not a four letter word.

## Problem

- Security of IT Personal Property
- Inadequate Protection of IT Equipment
- 305 Laptops/PDAs lost/stolen between 2001 to 2006
- Lack of Accountability
- Appropriate review not conducted
- No one Held Accountable for loss

- SES Summit 2007: Thoughts, Observations and Brutal Reality

## Risk Management

- C&A = knowledge of risk (threats & vulnerabilities)
- Authorizing Official (AO) accepts the appropriate level of risk
- Must know what risk we are accepting

- SES Summit 2007: Thoughts, Observations and Brutal Reality

## Challenges

- 97 IT Systems with current C&A
- 37 IT Systems Authorization to Operate (ATO) has expired (C&A Over 3 years old)
- 32 IT Systems ATO expire in CY 07
- Current plan will not yield C&A documentation until late CY 07 at earliest or CY 08

- Authority to operate systems—Problematic!!
- Producing _credible_ and defensible C&A packages
- Eliminating IT security material weakness

- SES Summit 2007: Thoughts, Observations and Brutal Reality

**Notes:**
NOTE: 134 total corporate systems less the 30 systems with expired ATO equals 104 systems