# Presentation: 109820

## Point 1 :  Classified Computing Stand-Down, Training and                          	   Policy/Procedure Review

Status
Stand-down began 4/2/99; over 85% back online including the ICN 
~3000 employees trained in classified computer security awareness
Groups performed self-assessments and policy and procedures reviews
Established process for approving foreign national access to supercomputing
Authorization process for restart in use

	  	   Path Forward
Finalize foreign national list and deny unapproved supercomputing access
Extend application of restart process to startup of new classified systems

**Status**
**Stand-down began 4/2/99; over 85% back online including the ICN **
**~3000 employees trained in classified computer security awareness**
**Groups performed self-assessments and policy and procedures reviews**
**Established process for approving foreign national access to supercomputing**
**Authorization process for restart in use**
- 	  	   **Path Forward**
**Finalize foreign national list and deny unapproved supercomputing access**
**Extend application of restart process to startup of new classified systems**

**Status Review of the InfoSec Action Plan**

## Point 2:  Enhanced Ongoing Training and Threat Awareness
Status
Rolling Restart Process
All personnel who are involved in classified information processing have received the InfoSec computer security /threat awareness training before restarting
Each organization has performed a self-assessment of all practices and procedures relating to classified computing in accordance with D-Division guidance 
FY-99 Computer Security Annual Training
Explicitly addresses threats to information in all electronic forms
CIAC/CERT/NMUG/OCSR bulletins
Path Forward
Initial on-line computer user training will be separated into explicit classified and unclassified packages
Each Division is identifying mixed computing work areas and developing methods to keep users aware of co-located classified/unclassified processing separations
On-line training that provides:
Centralized training and tracking
Mechanism for management to identify training based on specific job assignments

**Status**
**Rolling Restart Process**
**All personnel who are involved in classified information processing have received the InfoSec computer security /threat awareness training before restarting**
**Each organization has performed a self-assessment of all practices and procedures relating to classified computing in accordance with D-Division guidance**** **
**FY-99 Computer Security Annual Training**
**Explicitly addresses threats to information in all electronic forms**
**CIAC/CERT/NMUG/OCSR bulletins**
**Path Forward**
**Initial on-line computer user training will be separated into explicit classified and** **unclassified packages**
**Each Division is identifying mixed computing work areas and developing methods to keep users aware of co-located classified/unclassified processing separations**
**On-line training that provides:**
**Centralized training and tracking**
**Mechanism for management to identify training based on specific job assignments**

**Status Review of the InfoSec Action Plan**

## Point 3:   Physically Impossible Within a Work Area
Status 
Clarified requirements for restart on a work area basis with case description, procedures, and requirements map
Guidance emphasizes inadvertent attempts and removable media
Each division/organizational unit is tailoring implementation to meet their needs and resuming on a work-area-by-work area basis

Issues
Does not yet address work-area-to-work-area transfers
Inconsistency in application necessary due to legacy computing systems
Work areas usually defined to accommodate existing physical boundaries
Transition phase is necessary to reconcile historical classified media

Path Forward
Develop long-term strategy for “engineered security”

**Status **
**Clarified requirements for restart on a work area basis with case description, procedures, and requirements map**
**Guidance emphasizes inadvertent attempts and removable media**
**Each division/organizational unit is tailoring implementation to meet their needs and resuming on a work-area-by-work area basis**
**Issues**
**Does not yet address work-area-to-work-area transfers**
**Inconsistency in application necessary due to legacy computing systems**
**Work areas usually defined to accommodate existing physical boundaries**
**Transition phase is necessary to reconcile historical classified media**
**Path Forward**
**Develop long-term strategy for “engineered security”**

**Status Review of the InfoSec Action Plan**

## Point 4:  Rigorous New Unclassified-File Transfers

Status
Defined as a specific type of work area, guidance being developed for “transfer stations” 
Generally disallowed any process for moving from classified to unclassified using electronic media for the purpose of resuming classified computing
Paper is necessary intermediate-media for any transfer

Path Forward
Identify transfer volume by platform & type, concentrate on a vital few
Develop controlled methods based on need/volume and technical ??
Identify new tools to accommodate routing use of classified tools for unclassified work

**Status**
**Defined as a specific type of work area, guidance being developed for “transfer stations” **
**Generally disallowed any process for moving from classified to unclassified using electronic media for the purpose of resuming classified computing**
**Paper is necessary intermediate-media for any transfer**
**Path Forward**
**Identify transfer volume by platform & type, concentrate on a vital few**
**Develop controlled methods based on need/volume and technical ??**
**Identify new tools to accommodate routing use of classified tools for unclassified work**

**Status Review of the InfoSec Action Plan**

## Point 5:  Unclassified Computer System Audits and Automated 		 Monitoring
Status
Initiated monitoring of outbound unclassified e-mail “Watcher”
Initiated review of archived unclassified data by division
Developed a plan for scanning unclassified CFS archives: “TAP”

Path Forward
Develop a Tri-Lab approach to “Issues”
Replace “Watcher” with “Session Wall” to capture outbound email, ftp, and telnet file transfers
Develop performance metrics (e.g., false positives vs. detection rate) for planned approaches
Investigate methods to enhance performance

**Status**
**Initiated monitoring of outbound unclassified e-mail “Watcher”**
**Initiated review of archived unclassified data by division**
**Developed a plan for scanning unclassified CFS archives: “TAP”**
**Path Forward**
**Develop a Tri-Lab approach to “Issues”**
**Replace “Watcher” with “Session Wall” to capture outbound email, ftp, and telnet file transfers**
**Develop performance metrics (e.g., false positives vs. detection rate) for planned approaches**
**Investigate methods to enhance performance**

**Status Review of the InfoSec Action Plan**

## Point 6:  Need-to-know (NTK) Criteria Access and Detection 
Status
DOE Orders are general and high level  (NN/DP/DOE 0471.2A & DOE M472.1-1)
NTK is not uniformly implemented, among divisions, as well as intradivision
NTK mechanisms: sigma levels; split network; UNIX file permission (UGO)
Individual (owner) determination—line management

Path Forward
Implement encryption (for example, ssh, Kerberos) for all network access to classified information

**Status**
**DOE Orders are general and high level  (NN/DP/DOE 0471.2A & ****DOE M472.1-1)**
**NTK is not uniformly implemented, among divisions, as well as intradivision**
**NTK mechanisms: sigma levels; split network; UNIX file permission (UGO)**
**Individual (owner) determination—line management**
**Path Forward**
**Implement encryption (for example, ssh, Kerberos) for all network access to classified information**

**Status Review of the InfoSec Action Plan**

## Point 7:  Technical Measure against Insider Threats        	 (closely tied to NTK separation in point 6 and 			   intrusion/anomaly detection in 8)

Status 
Goal to eliminate threat of network eavesdropping 
Encrypt sessions, star topology/switched networks
Integrate token cards into Kerberos (eliminate re-usable passwords)
Review classified network configuration management
Enhance anomaly detection (add more client systems) 
Path Forward
Work closely with SNL and LLNL (share and trade)
Continue to bring in outside experts in anomaly detection (for example, Stephanie Forrest)

**Status **
**Goal to eliminate threat of network eavesdropping **
**Encrypt sessions, star topology/switched networks**
**Integrate token cards into Kerberos (eliminate re-usable passwords****)**
**Review classified network configuration management**
**Enhance anomaly detection (add more client systems)**** **
**Path Forward**
**Work closely with SNL and LLNL (share and trade)**
**Continue to bring in outside experts in anomaly detection (for example, Stephanie Forrest)**

**Status Review of the InfoSec Action Plan**

## Point 8:   Three-Level ICN Protection, VA, And Intrusion Detection
Status
Firewall implemented March 15 to separate unclassified network into Blue and Green partitions, with additional firewall for X Division electronic vault
Yearly independent vulnerability assessment and regular CPAT test
NADIR deployed for Crays, KNSC, CFS; in progress for HPSS an Mercury; and planned ASCI Blue Mountain
SHADOW deployed inside firewall; deployment planned outside firewall

Path Forward
Planned deployment of computer security tools on X Division LAN
Lab-wide evaluate, leverage, and increase deployment of COTS and GOTS security tools
Conduct R&D to fulfill current and future need
Enhance system administrator training and development of a certification program

**Status**
**Firewall implemented March 15 to separate unclassified network into Blue and Green partitions, with additional firewall for X Division electronic vault**
**Yearly independent vulnerability assessment and regular CPAT test**
**NADIR deployed for Crays, KNSC, CFS; in progress for HPSS an Mercury; and planned ASCI Blue Mountain**
**SHADOW deployed inside firewall; deployment planned outside firewall**
**Path Forward**
**Planned deployment of computer security tools on X Division LAN**
**Lab-wide evaluate, leverage, and increase deployment of COTS and GOTS security tools**
**Conduct R&D to fulfill current and future need**
**Enhance system administrator training and development of a certification program**

**Status Review of the InfoSec Action Plan**

## Point 9:  Senior Technical Computer Policy Board and Enhanced 		Ongoing Red Team 
Status
Established Senior Technical InfoSec Policy Board chaired by Bill Press
Red Team conducted initial assessment and provided Lab-wide briefing for mandatory security training (week of April 5)
Scheduled CIAC penetration evaluation of the firewall

Path Forward
Increase number of security professionals in CIC and S Divisions
Tri-Lab R&D in computer security to address current and future vulnerabilities 

**Status**
**Established Senior Technical InfoSec Policy Board chaired by Bill Press**
**Red Team conducted initial assessment and provided Lab-wide briefing for mandatory security training (week of April 5)**
**Scheduled CIAC penetration evaluation of the firewall**
**Path Forward**
**Increase number of security professionals in CIC and S Divisions**
**Tri-Lab R&D in computer security to address current and future vulnerabilities**** **

**Status Review of the InfoSec Action Plan**

## Status Review of the InfoSec Action Plan