# Presentation: 261779

** **

**United States Department of the Interior**

**Federal Information Security Management Act (FISMA) ****April 2008**** ****Larry Ruffin ****& ****Joe Seger**

**Notes:**
Introductions
Poll the audience
How many know what FISMA is and are familiar with the OMB requirements and NIST standards and guidelines relating to IT Security?

How many have a role and responsibility relating to an IT system that supports a mission/business function?

Point out: Everyone has a role/responsibility in one form or the other in the protection of information; whether you are a system owner, IT specialist, or an end-user; if you have access to or handle any sensitive agency information, including Personally Identifiable Information (PII).

You have responsibilities such as:
Providing input to functional requirements for an IT system that has potential security implications that need to be considered and addressed,
Reporting all incidents to DOI-CIRC through your respective Bureau/Office IT Security Program’s incident response team,
Call the help desk if you don’t know who else to contact.

## Agenda 

**FISMA - It’s about enabling mission success through the protection of our sensitive agency information.**
- Federal Legislation & Directives
- BIG PICTURE
**Roles and Responsibilities**
- Mission Executives & Chief Information Officers
- System Owners & Information System Security Managers
**Certification & Accreditation**
- Assessments, Audits, Evaluations and Testing
- Plans of Actions and Milestones
**Enabling Efficient Mission Delivery and Success**
- Mission Efficiency through Business and Information Technology Integration
- Integrating Risk Management into the Enterprise

**Notes:**
First on the agenda is why security is important and what’s in it for me (WIIFM), security is based on the organization’s mission and enabling business objectives.
 Security is federally mandated, but its purpose is to ensure missions are executed effectively with efficiency, accuracy, and accountability.

Next we’ll provide a brief summary of responsibilities for executives, system owners, and the CIOs and the IT Security Specialists

Third on the agenda is a high-level view of the current C&A documentation requirements, their role in enabling your mission, and a summary of the guidance from the National Institutes of Standards and Technology (NIST)
The C&A procedure requires knowledge of the roles of individuals in our organization and how they work to accomplish a C&A
Also very important is the categorization of systems as high, moderate or low and control selection based on that level (risk-based)
Then we’ll briefly look at the steps in the C&A process to determine the flow and who is responsible for each step

Finally, we will show the dependencies of risk management, and how critical it is to integrate “every day” business processes with IT security and the efficiencies that may be gained

## Federal Legislation & Directives- Driving IT Security Improvements - 

**E-Government Act of 2002 - Public Law 107-347**
- Enhance management and promote e-Gov services/processes
**Title III - FISMA**
- Development and maintain minimum controls to protect Federal systems
**Section 208 – Privacy Provisions**
- Protect the privacy of personal information
**OMB Circular A-130**
- Policy for the management of Federal information resources.
- Requires protection commensurate with risk and magnitude of harm
- Requires security’s role be explicit in IT investments and capital programming
**Appendix III - Security of Federal Automated Information Resources**
- Minimum set of controls for Federal information security programs
- Requires a security plan for information systems
- Requires reviews of security controls

**Notes:**
This is a list of the major drivers for IT security.  Of course the true drivers are protecting the mission and ensuring confidentiality of Federal and personal information.

All business processes are dependent on information systems in one form or another.  Whether is it simple e-mail, word processing, spreadsheets, or major IT systems that automate essential functions of a business process.

These laws and directives are intended to ensure your business processes are performed in a confidential environment that is available when needed with the highest level of integrity.  More simply, your sensitive information is protected, there when you need it, and you can be sure it has not been altered.

E-Gov – Framework of measures of the enhancement to the business processes and report progress

FISMA – Framework for security implementation, minimum protection of resources, and standards to meet

A-130 – Framework for managing IT risk to business processes, commensurate with harm

Appendix III – Framework for implementing comprehensive security, security plans, and reviews

## Big Picture

**Federal Information Security ****Management Act**

**E-Government Act**

**Presidential Management ****Agenda**

- C&A

- CIRT

- SATE

- PM

- Assess-ments

- CIP

- EA (IS)

- Capital Planning

- Patch Mgmt

- System & Program
- POA&Ms

- Asset Inventory

- Security Program

**E-Gov: **
-  Enhance management and promote electronic Government services and processes
-  Establish a Federal CIO in OMB
-  Establish a framework of measures
-  Enhance citizen access to Government information and services

**FISMA (Title III of E-gov): **
-  Comprehensive framework to ensure effectiveness of system controls
-  Recognize highly networked nature of Federal computing
-  Minimum controls required to protect Federal Information

**PMA: **
-  Strategic management of human capital
-  Budget and performance integration
-  Competitive sourcing
-  Electronic-Government
-  Improved financial management

**Notes:**
FISMA – Programs that make a comprehensive security program.
Protecting our Critical Infrastructure, responding quickly to incidents, educating the community, assess ourselves, Planning for security from the start, and of course documenting proof of what we have done and performing risk analysis and management through C&A.  These are just a few of the elements that FISMA mandates, but how do we know it’s effective?

E-Gov – It measures how well we are managing our e-business, and how well is our business serving the U.S. citizens.  E-Govs mandates the reporting how well we are managing electronic services, but how do we know we are working toward the same goal as the rest of the Federal Government?

PMA – Managing human capital, budget and performance, competitive sourcing, and the financial services we provide is essential to carrying out an efficient, accurate, and effective mission, for which we are accountable.  The electronic-Government mission is the common thread that runs through all missions.  It supports them all, so it must be planned for, properly implemented, protected, and reviewed periodically, all in an efficient manner.

Integration is the key to making this all work together, and to optimize resources.

## Roles & Responsibilities

**Mission Executives ****(Business Process Owners)**
- Responsible to ensure security controls commensurate with risk (control the budget and the requirements)
- Missions require the deployment of systems before relevant IT security disciplines are defined, integrated, and standardized
**Chief Information Officers **
- Ensure compliance with security requirements while enabling the mission
- Provide assurance of security effectiveness

**Notes:**
Mission Executives or business process owners must understand and take responsibility for the risk management.  They can’t do that if they are not fully aware of mission risks, security implications, and the impacts their decisions make to their process and the process of other connected missions.  With the mission in mind, security must be made a true priority in the protection of resources.  Time and money are scarce, so working together to protect vital assets supporting the mission will derive a stable environment.

The CIO is the link between mission and security.  The IT community services all missions, so they must rely on business process owners to convey priority services, IT impacts to missions, and support requirements.  While CIOs do not own all IT systems, they are responsible to ensure that they comply with the law, support the mission, and are securely implemented. This is where they must have a relationship between their security program and system owners.

## Roles & Responsibilities

**System owner**
- Procures, implements, and integrates information systems
- Represents mission priorities and security requirements to the Designated Approving Authority (DAA) supporting risk-based decisions
- Makes judgments on independent advise of reasonable risk
**Information System Security Manager**
- Ensures systems are Certified and Accredited
- Implements agency policies and standards
- Coordinates with system owners and business process owners
- Balances mission risk in consideration of IT Security Risks

**Notes:**
System owners are responsible for acquiring and maintaining the systems, representing the system security status to the DAA, and providing him/her with the enough information to make risk-based decisions.

Then of course the ISSM is the individual that plans and implements the security measures required by the system, ensures owners are aware of the costs in all stages of development, and ensures assessments of controls are performed.

## Certification and Accreditation

**Accountability for:**
- Adequate safeguards and countermeasures are employed within information systems.
- Information system safeguards and countermeasures are effective in their application.
- Risk to organizational operations, assets, individuals, other organizations, and the Nation is explicitly understood and accepted by leaders at all levels.

**Notes:**
C&A is all about awareness and accountability.

	Are controls in place and adequate?

	Are they effective?

	Are all levels of management aware of AND willing to accept residual risk due to lack of capability to implement controls at the time of system implementation?

Measuring mission risk (operations/assets/individuals) as related to the risks to the information system

## Certification and Accreditation

**Federal Information Systems**
- An information system used or operated by an executive agency (of the federal government), by a contractor of an executive agency, or by another organization on behalf of an executive agency.
- Federal information systems process, store, and/or transmit *federal* information.
- Authorization decisions for federal information systems are an inherently *federal* responsibility and cannot be delegated to other than federal officials.

**Notes:**
Self explanatory – the decision to put federal information at risk, and the acceptance of that risk, is a federal responsibility

## Certification and Accreditation

**Accreditation Boundary**
- All components of an organizational information system to be *accredited* by an authorizing official; excludes separately accredited systems, to which the information system is connected.
- Defines the *scope of protection* for the organizational information system (i.e., what the organization agrees to protect under its direct control).
- Includes the *people, processes, and technologies* that are part of the information system supporting enterprise missions and business processes.

**Notes:**
Again, C&A is all about awareness and accountability.

The understanding of the scope of what is to be protected is paramount in determining necessary controls, your reliance on common controls available to all systems (LAN infrastructure), and the level to which the system and its information must be protected.  This determination MUST be completed accurately and clearly documented to reduce redundant efforts between systems and to realize where efficiencies can be gained through common controls or services available, eliminating redundant efforts or costs.

## Certification and Accreditation

**Four Phase C&A Process**
- Initiation Phase
- Certification Phase
- Accreditation Phase
- Continuous Monitoring Phase
***	******	******Expressed within the context of the NIST Risk***
***	******	******	****** ******Management Framework as follows...***

**Notes:**
The four phases of the accreditation process are intended to synchronize with the development of the system, providing security and assurance to the systems integrity from inception to disposal.

## C&A Risk Management Framework

***Starting Point***

**Notes:**
This the framework by which the phases are carried out
Initiation Phase
Determining to what level it must be protected
Select controls to implement and adjust controls to fit local environment
Document the security of the system
Identify planning and implementation resources, and responsibilities
Review, analysis, and acceptance of the security plan
Certification Phase
Assess the management, operational, and technical security controls
Prepare the plan of action and milestones
Certify the level of security implemented and the residual risks
Accreditation Phase
Determine risk to DOI operations/assets/individuals; is risk acceptable 
Make risk based decisions and document acceptance of risks
Continuous Monitoring Phase
Configuration management and control; security control monitoring; and status reporting and documentation.

## Types of Controls

| Management Controls | Security Planning |
| --- | --- |
|  | Risk Assessment |
|  | System and Services Acquisition |
|  | Certification, Accreditation, and Security Assessments |
| Operational Controls | Security Awareness and Training |
|  | Configuration Management |
|  | Contingency Planning |
|  | Media Protection |
|  | Physical and Environmental Protection |
|  | System and Information Integrity |
|  | Incident Response |
|  | System Maintenance |
|  | Personnel Security |
| Technical Controls | Access Control |
|  | Auditing and Accountability |
|  | Identification and Authentication |
|  | System and Communications Protection |

**Types of Controls**

**Notes:**
Management Controls:

Safeguards that focus on the management of risk and the management of information system security. 	

Operational Controls:

Safeguards that primarily are implemented and executed by people (as opposed to systems).

Technical Controls:

Safeguards that are primarily implemented and executed by the information system through mechanisms contained in the hardware, software, or firmware components of the system

## Assessments, Audits, Evaluations and Testing Part of IT Security Program

**Notes:**
Purpose
Improve Mission performance through the validation of the control effectiveness as they relate to key business processes, and to ensure privacy controls are protecting sensitive agency information, including Personally Identifiable Information (PII) within information systems

Sources
C&A Security Test & Evaluations (ST&Es)
OIG, GAO, and other audit entities
Financial systems audits (e.g., KPMG)
Internal Control Reviews (ICRs)
Annual IT Security Self-Assessments
Vulnerability Scanning and Penetration Testing Programs
Security Configuration Compliance Monitoring
Other C&A Continuous Monitoring Program elements

Components (Criteria, Condition, Cause, Effect, Recommendations)

Findings (OIG & other auditor Reports and Notice of Findings & Recommendations (NFR), C&A ST&E Reports, etc.)

## Plans of Actions and Milestones

**Audit or Assessment Findings:**
- Identified vulnerabilities and weaknesses
- Documented on program- or system-level POA&Ms
- Corrective/mitigating action plans tracked to resolution

**I found a weakness!**

**Notes:**
A plan of action and milestones (POA&M) is a tool to manage tasks that need to be accomplished.  
The purpose of a POA&M is to assist in identifying, assessing, prioritizing, and monitoring the progress of corrective efforts for security weaknesses found in programs and systems. 
The POA&M details resources required to accomplish the elements of the plan, milestones in meeting the task, and scheduled completion dates.

## IT System Lifecycle

**Plan**

**Design**

**Build**

**Test**

**Deploy**

**Operate**

**Dispose**

**Notes:**
Planning early for security costs will save money

The lifecycle is the comprehensive system planning model which can be used to promote the understanding of costs associated with information systems

Retrofitting security to meet compliance requirements while maintaining business processes requires more resources

Planning business processes and security requirements together and early in the lifecycle leverages overall lower cost of ownership

Planning integration means alignment of goals, priorities, and resources

## IT Security Lifecycle

**Identify Risks**

**Implement Controls**

**Inspect Controls**

**Capital Planning**
**& **
**Investment**

**Resolve Weaknesses**

**Dispose**

**Monitor & Respond**

**Notes:**
Continuous Planning for Security

Proper planning and cooperation is an iterative process.  
Planning, investing, and assessing does not end when the information system enters the operations phase

Each of the lifecycle steps are repeated in smaller fashion for each version release, upgrade, or major change request that is processed.

Continuous communication must be emphasized between the investment stakeholders to realize efficient operations and avoid delayed responses to security deficiencies while the system is operational

Systems must be re-assessed on a continuous basis to ensure the mission, operations, assets, and individuals are protected, effective, and efficient.

Repeat Risk Assessment Frequently!
Nature of IT Systems to pursue change (e.g. incremental releases, more features, more interconnectivity / integration, standard architecture, etc.)
Each period of time has fixes, patches, and new releases
Tends to erode the validity of the risk assessment over time

## Enabling Efficient Mission Delivery and Success 

**“****Baking-in” IT Security & Privacy Protections**
- Information security requirements must be considered *first order requirements* and are *critical to mission and business success*.
- An effective organization-wide information security program helps to ensure that security considerations are specifically addressed in the *enterprise architecture* for the organization and are integrated early into the *system development life cycle*.

**Notes:**
By planning business needs and IT security needs with constant communications, standardization of implementations can occur, security concerns don’t have to be completely re-addressed each time a similar system is developed, common controls can be optimized and redundancies eliminated, and alignment mission oriented goals will yield efficiencies.

## Enabling Mission Efficiency through Information Technology

**Mission – Provide what’s needed to get the job done**
**Challenge – Meet mission and security needs and remain effective**
- Critical assets are frequently updated and customized
- Business solutions require interconnections to internal and external systems
- Security of interconnections relies on cooperation and integration

**Notes:**
Goals
Initiate communications between business process owners, CIOs, system owners, and IT security professionals
Ensure security is addressed early in system development
Raise awareness of changing environments and evolving vulnerabilities
Addressed security issues in a common venue to reduce mission impacts/costs

## NIST Computer Security Division & OMB Sites

**Computer Security Resource Center (CSRC) library **
- _[http://csrc.nist.gov/index.html](http://csrc.nist.gov/index.html)_
**Federal Information Processing Standard (FIPS) publications**** **
- FIPS 199 and 200
- _[http://csrc.nist.gov/publications/fips](http://csrc.nist.gov/publications/fips)_
**Special Publications (SP) **
- 800 Series (primarily 800-18, 34, 37, 47, 53, 53A and 60)
- _[http://csrc.nist.gov/publications/nistpubs/index.html](http://csrc.nist.gov/publications/nistpubs/index.html)_
**OMB Memoranda **
- Memoranda M07-19, 06-19, 05-15, 04-25 and 03-19
- _[http://www.whitehouse.gov/omb/memoranda/index.html](http://www.whitehouse.gov/omb/memoranda/index.html)_

**Notes:**
This list of publication sources gives the primary guidelines used to plan for, document, implement, and report on information system security development.

Federal mandates are in place to ensure our mission and the public's information are protected
Efficiency
	Eliminate redundant efforts through integrated efforts
	Ensure we get value for the IT products and services we pay for
	Balance security measures needed based on the sensitivity of the information
	Allocate resources necessary for success
Accuracy
	Protect mission integrity (unaltered product)
	Provide measures to regularly prove security is effective
	Audit controls to ensure they remain in place and effective
Accountability
	Provide clear documentation about the system (sensitivity, controls, problems)
	Accept responsibility for the operation of IT systems
	Plan for corrective actions and resources needed

## 
Thanks for your  time and attention

Lawrence_Ruffin@ios.doi.gov
&
Joseph_Seger@ios.doi.gov

**Thanks for your  time and attention**
**Lawrence_Ruffin@ios.doi.gov**
**&**
**Joseph_Seger@ios.doi.gov**

**Any Questions?**

**Had Enough?**