# Presentation: 516440

## IT Security Policy for Remote System Scanning and Patching 

- IT Security Committee
- Presented to the CIO Council
- February 6th, 2007

## 		Outline

- Purpose
- Issue
- Background
- Alternatives
- Recommendation
- Backup Slides

## Purpose

- Present results of the ITSC review of current IT Security policy to ensure that is sufficient for securing remote devices.
- Options for additional policy for “on-access” scanning of remote devices when they connect to NOAA networks
- Implementation assessment of additional policy (including cost and potential benefits)

## Background

- Carl Staton and the NOAA CIO Council tasked IT Security Committee with evaluation of additional vulnerability scanning requirements on 08/22/06
- Presentation to CIO Council due 01/16/07 moved back due to CIO Council scheduling considerations until 02/06/07

## 		Issue

- Current vulnerability scanning requirements require remote devices to be scanned, but do not include “on-access” vulnerability scanning
**  g)      Remote Devices – Devices that connect indirectly to NOAA local area networks or NOAA-controlled wide area networks.  Typically include dial-up modems and 3**rd** party Internet connections to access NOAA networks. *
*i.            All remote devices shall have corrective actions performed within time frame set by the vulnerability priority level.*
*ii.            Devices that cannot have corrective action performed within the allocated time frame should be denied access until such time as corrective action is performed.*
*iii.            Access to corrective action resources may be allowed if the connection established is limited by system controls to only those resources necessary to perform the required corrective action.*

** Draft NOAA IT Security Manual update to NAO212-1300*

## 		Alternatives

- Status Quo –
- Quarterly vulnerability scanning of all devices including remote device
- Alternative One – Broad Policy
- Implement NOAA policy requiring ALL remote devices to be scanned for vulnerabilities before establishing *tier two** connections to NOAA Networks & provide a licensing for scanning software
- Alternative Two – Targeted Policy
- Implement NOAA policy requiring remote devices for “High” and “Moderate” impact systems to be scanned for vulnerabilities before establishing *tier two** connections to NOAA Networks & allow each system to implement scanning software as appropriate

- * Tier 2 remote access is define by the DOC IT Security Program Policy Appendix D, section 4 as that where, “basic user privileges are allowed to access systems processing or storing non-national security information _inside the inner DOC firewalls and internal to the DOC computing environment _

## Status Quo

- The current version of the Draft NOAA IT Security Manual requires quarterly vulnerability scanning of all devices including remote devices
- Scanning is not required before remote devices access NOAA Networks
- Pros
- Current policy draft has been vetted through all levels of the organization over the last three months
- No additional resources requested
- All DOC owned devices are required to be scanned quarterly
- Cons
- Systems are not scanned for vulnerabilities before connection to NOAA Networks
- Corrective actions may not be validated in an automated fashion within the time frame for responding to a vulnerability (corrective actions may have been perform with manual validation)
- Personally owned equipment used for remote access is not scanned at all

## Alternative One – Broad Policy

- Implement NOAA policy requiring ALL remote devices to be scanned for vulnerabilities before establishing tier two connections to NOAA Networks & provide a licensing for scanning software
*iv.            All remote devices shall be scanned for vulnerabilities before accessing NOAA networks to validate that corrective actions have performed as required.*
- Pros
- Validation of corrective actions before potentially vulnerable systems are connected to NOAA networks
- Software for performing “On Access” vulnerability scanning generally provides additional security benefits (see Backup Slide 1)
- Validation of controls applied to all NOAA systems
- Cons
- Additional Software costs ~$313k (see Backup Slide 1)
- Policy and Tool implementation time and resources
- Running a scanning tool may affect performance of the end user device

## Alternative Two – Targeted Policy

- Implement NOAA policy requiring remote devices for “High” and “Moderate” impact systems to be scanned for vulnerabilities before establishing tier two connection to NOAA Networks & allow each system to implement scanning software as appropriate
*iv.            All remote devices for “High” and “Moderate” impact systems shall be scanned for vulnerabilities before accessing NOAA networks to validate that corrective actions have performed as required.*
- Pros
- Validation of corrective actions before potentially vulnerable systems are connected to “High” or “Moderate” impact NOAA networks
- Software for performing “On Access” vulnerability scanning generally provides additional security benefits (see Backup Slide 1)
- Resources applied to systems with a greater level of security sensitivity
- Cons
- Additional Software costs ~$265k (see Backup Slide 1)
- Policy and Tool implementation time and resources
- Running a scanning tool may affect performance of the end user device

## Recommendation

- Maintain Status Quo
- Meets for current DOC and NOAA Policy requirements
- Current policy requirement to scan all devices quarterly
- IT Security priorities focusing on C&A and 800-53 controls
- Minimal reduction of risk to systems (low % of incidents)
- Recommendation for more comprehensive identification of Remote Access concerns to be addressed (inventory, authentication, auditing, and PII)
- Recommendation approved by NOAA IT Security Committee
- All LO representatives present agreed on the recommendation
- NMAO and NESDIS were not present for the vote
- No dissenting opinions

## Backup Slide 1 – “On Access” Scanning Software

- Several “On Access” vulnerability scanning software packages available including products by Harris, Cisco, SAINT, & BigFix
- For cost estimate purposes we used _Blink by eEye Digital_
- eEye’s Retina Vulnerability Scanning product in use by the IG
- _[http://eeye.com/html/products/blink/index.html](http://eeye.com/html/products/blink/index.html)_
**	****   ****Capabilities**				**Cost**

- Protocol based intrusion prevention
- Anti-spyware technology
- Anti-Phishing and Identity theft protection
- System & Application firewall
- Local vulnerability assessment based on
-  eEye's _[Retina® Network Security Scanner](http://eeye.com/html/products/retina/index.html)_
- Policy-based application and process control
- Policy-based control over USB and other
- removable storage devices
- Attack and event reporting to _[REM Management Console](http://eeye.com/html/products/REM/index.html)_

- - Broad Policy assumes coverage for 13,000 laptops based on laptop numbers reported for encryption effort
- - Targeted Policy assumes coverage for 11,000 laptops based on the percentage of High and Moderate systems within NOAA (111 out of 134)