WHITE PAPER

Security Fundamentals
for Federal Agencies
Establish and Sustain theFour Essential Pillars of Federal Cybersecurity

FOUNDATIONAL CONTROLS FORSECURITY, COMPLIANCE & IT OPERATIONSCybersecurity experts are urging government agencies to protect theirdata with up-to-date, foundational security controls, and agencies arelistening. But how can they determine where exactly to focus their efforts
to maximize efficiency and ensure a strong security stance? This white
paper details the four key components federal agencies need in order toestablish and maintain a robust security posture.

Policy Compliance
Policy compliance is a broad term thatcan encompass different types of policies such as internal agency standards
or widespread regulatory requirements.
Regardless of which type or types ofpolicies your agency must comply with,auditing will play a central role in thecompliance process.
Audits are the methodology used toassess policy compliance. Even if youragency implements all the required
controls and capabilities required bya policy, you can still fall into noncompliance by failing to achieve a
demonstrable ability to measure yoursystems against that policy.

Differentiate compliance fromcontrols
It’s critical to understand the difference
between the implementation of security
controls and policy compliance itself.
Following the directives of security
controls (such as the CIS Controls,
formeraly known as the Critical Security
Controls) is just one set of actions that
help agencies meet compliance. Policy
compliance products and solutions that
effectively make your control implementation efforts worthwhile possess one ormore of the following capabilities:
Provide: Tools that directly provide a
required control fall into this category. If
an agency has a requirement for vulnerability assessment, the VA tool provides
that control.
Validate: Some tools are specificallydesigned to measure whether anothercontrol is in place and configured correctly. These tools validate a control, butthey don’t provide it directly.

The four pillars of aneffective security strategy»» Policy compliance»» File integrity monitoring»» Log management»» Vulnerability management

Support: There are definitely cases
where a tool or capability doesn’t fulfill
all the requirements of a required control but makes the use of that control
substantially easier or more effective.

the specific policy. Compliance can beleveraged to justify budget.

Speaking in these terms—provide, validate, support—paves a clearer approachto compliance. Selection of a tool thatprovides one control doesn’t necessarily
guarantee validation, so it’s important
to ask how that control will be validated.
At the same time, a powerful tool might
not provide or validate, so it’s important
to assess how other controls are supported. It’s important to avoid confusing
the controls themselves with theirvalidation.

Tripwire® Enterprise is an integrated
cybersecurity solution suite composedof three primary components: Tripwire
File Integrity Manager, Tripwire Policy
Manager and Tripwire Remediation
Manager. Tripwire Policy Manager continuously assesses system changes andreports on your agency’s compliancestatus with out-of-the-box compliancetesting for FISMA, NERC, CIP, SOX,COBIT and many others.

How policy compliance adds value
Policy compliance tools should befocused on validation and justification
for an auditor. Any new policy compliance tool should reduce the time spent
preparing for audits by collecting dataand delivering it in a usable format. In
many cases, that’s a report, but it mightalso include the ability to extract specific data as an auditor requests it. Use
previous audits as a guide to determine
how the tool might help. Tools should
not actually make audits harder to pass.
Policy compliance can also be a budget
driver. Return on investment for security
is difficult because the outcomes are
difficult to predict. Policy compliance isdesigned to pair a risk with a predictableoutcome, usually a fine or other punitive
measures. That creates an environment in which budget can be effectively
allocated.
That predictable outcome can also be
used to secure budget for tools andcapabilities that have benefits beyond

Tripwire Enterprise

Tripwire Enterprise benefits:»» Supports over 1,000 policy andplatform combinations»» Reduces audit preparation time andcost with audit-ready reporting»» Frequently updated to ensure you
always have the coverage you need»» Continuously compares your baseline
configurations to policy standards»» Protects your data with systemhardening and compliance
enforcement»» Automates workflows via integrations
with SIEMs and change managementsystems

File Integrity Monitoring
Each and every security breach correlates to a change within a system.
That’s why IT managers need tounderstand the importance of change
management and file integrity monitoring (FIM). Agency environments requirepreventive and detective controls thatidentify change.

AI, machine learning and active threat
hunting are certainly providing newtactics in the security industry, but theability to pinpoint changes across yourentire environment is where you’ll findthe most value.
Integrity monitoring is nothing new,
but the core capabilities it utilizes have
evolved dramatically in recent years.
Change detection is FIM’s central functionality, and the scope of your overall
integrity management strategy can beeven broader.

Shift to integrity management frombasic FIM
FIM isn’t just for files anymore. It now
encompasses a wider range of tools
and tactics that fall under the umbrellaterm “integrity management.” Integrity
management is composed of four basic
steps:
Secure deployment: Ensure that thesystem’s you’re deploying meet risk
acceptance criteria. First, establish
those criteria so that you can measure
the security performance of your servers, images and containers across allenvironments—be they on-premise,
virtual or cloud.
Baseline deployed systems: If you don’t
have a solid baseline, you can’t identify
changes from it to understand how theyaffect the risk posture of your systems.

Monitor for change: Once your baseline
is established, what process will youragency use to monitor that baseline forchanges? Establish an explicit and rigorous change monitoring process thatyields high visibility into your entire dataecosystem.
Act on important changes: Mostchanges don’t require action, but you
need a reconciliation process that
separates the wheat from the chaff.
IT managers must be able to quickly
assess which changes impact risk andwhich changes are routine.

Integrity management’s critical role
Applying the principles of integrity
management helps agencies prevent,detect and investigate security incidents
in their systems. The core capabilities
of integrity management satisfy a variety of regulatory standards such as
the National Institute of Standards andTechnology’s 800-53 governing security
and privacy protocols (NIST 800-53).
NIST 800-53 requires stringent system
information and integrity controls. It
also calls for the use of “[...] integrity
verification tools to detect unauthorizedchanges” on a number of organization-identified objects. This is included
in control SI-07. While integrity verification is required for SI-07, the ability todetect and reconcile changes delivers
validation of many other controls.

And while integrity management cannot“[...] create, enable, modify, disable andremove information system accounts inaccordance with policy” as the AC-02
account management control calls for,it will provide the ability to capture every
single one of those changes for investigation and audit.

Tripwire File Integrity Manager
Integrity management processes cangenerate staggering amounts of data,
and IT professionals don’t have the time
to pour over that data to see what’s
relevant and what’s merely digital noise.
Available as a stand-alone solution oras part of the Tripwire Enterprise toolsuite, Tripwire File Integrity Manager
brings visibility and business context tothe actionable data you need to focus on.
Consider Tripwire File Integrity Manager
to vastly improve your agency’s integritymanagement.
Tripwire File Integrity Manager
benefits:»» Real-time change intelligence»» Change prioritization from low to highrisk»» Automated reconfiguration for policycompliance»» Integration with change ticketingsystems like ServiceNow»» Details pinpointing the “who, what andwhen” of pertinent events

Log Management
Government agencies must view log
management within the context of
security incident and event management (SIEM). The SIEM market evolved
from collecting log data and correlating
it with other data sources to deliver
deeper analytical capabilities.
This is part of the reason fields like user
behavior analytics and big data analytics have seen so much rapid growth inrecent years. Higher demand for analytics means agencies are struggling todeliver the right data and insights to theright destinations.
Fig. 1 Tripwire Enterprise provides both robust FIM and comprehensive policy
compliance.

From a cost perspective, customers
can find themselves paying for data that
doesn’t need to be in the SIEM or paying
for log storage instead of analytics.
These trends put pressure on federal IT
professionals to spend more efficiently
while strengthening the security of theirlog management practices.

Log management
makes security visible
Security logging and analysis can help
IT teams determine the location ofattackers, identify malicious softwareand track activities on victim machines.
“Even if the victims know that theirsystems have been compromised,without protected and complete logging
records they are blind to the details of
the attacks and to subsequent actions
taken by the attackers,” according to theCenter for Internet Security (CIS).
“Without solid audit logs, an attack may
go unnoticed indefinitely and particulardamages done may be irreversible.” If
IT managers are not collecting, storing
and analyzing log data for every asset
in the organization, they will have significant gaps in their cyber situationalawareness.

Log management
simplifies compliance
It’s compliance concerns—not security—that usually drive IT teams toward log
management investments. The Federal

Information Security Management
Act is one of many regulations thatrequires log management components.
In FISMA’s case, log management isdefined by NIST in SP 800-53.

»» Critical events highlighted on aNIST 800-53 provides the most detailed
exploration of log management requirements available, and it’s certainly
the most applicable to government
agencies. NIST 800-53’s requirements
for logging are listed in the Audit andAccountability section and include defining a process for collecting logs, what
log events need to be captured, what
detail needs to be included in captured
events as well as retention guidance andresponse processes.

data prior to passing SIEM

Tripwire Log Center
The correlation engine in Tripwire Log
Center ® automatically identifies andresponds to events of interest using alogical flow of one or more conditions.
Actions can include creating a workticket, sending a notification email,or running a command. Whether you
collect logs strictly for regulatorycompliance or to increase awarenessof credible cyber threats, Tripwire Log
Center ensures the process is secureand reliable.
Tripwire Log Center benefits:»» Reliable log collection, analysis anddelivery»» Tight integration with your existing
infrastructure

customized dashboard»» Automated remediation and alertingwith triggered scripts»» Reduced noise with pre-processed»» Quicker threat detection with a large
library of correlation rules

Vulnerability Management
Vulnerability management is fundamentally about risk reduction presented
by vulnerabilities within a system
environment. Executive Order 13800
delineates the importance of assessing
vulnerabilities: “Known but unmitigatedvulnerabilities are among the highest
cybersecurity risks faced by executive
departments and agencies.”

Vulnerability management andcompliance
It’s important to consider that meetingcompliance doesn’t always ensure thatyour vulnerability management programis adequately robust. Passing an audit
is not the same as reducing vulnerability risk. If compliance is part of yourorganization’s drive for vulnerability
assessment tools, achieving clarity on
the objectives can help you avoid barriers to success down the road.
Vulnerability management and compliance should work hand in hand.
For example, if you’re part of theDepartment of Defense and subject toCommand Cyber Readiness Inspection(CCRI) audits, then a vulnerability
assessment tool is a key component
in audit preparation. Understanding
which assets are on the network, theirvulnerabilities, and which to fix first is a
crucial part of CCRI preparation.

Vulnerability management is aprocess
The process of reducing risk from vulnerabilities is just that: a process. There
are tools that make that process substantially more efficient, but they don’t
replace the need for the process or thepeople to run it.
Fig. 2 Tripwire Log Center provides reliable log collection, analysis and delivery.

It’s entirely possible to create a complex
workflow diagram for vulnerability management, but at its core, there are reallythree steps:
Discover: You have to start by deploying
a solution that can pinpoint the vulnerabilities you have, and by extension all of
the assets on which you might find thosevulnerabilities. The output of discovery
is some kind of inventory of assets andvulnerabilities.
Report: In order to take action on thatinventory, organizations need reporting
tools. A simple report might just be alist of vulnerabilities found, but in mostcases, there needs to be some scoring
method of prioritization for both the vulnerability and the sensitivity of the asset
on which it resides.
Remediate: Many vulnerability management programs stop with the firsttwo of these three steps and countthemselves as successful, but unlessmeaningful remediation is part of theequation, you haven’t accomplished thecore objective of reduction of risk. The
challenge is that remediation, whether
through applying a patch or some otherstep, is the most complicated step. Thekey question to answer is how you canconnect the prioritized reporting ofvulnerabilities to the most successful
workflow in your organization.

Tripwire IP360️
Tripwire IP360™ serves as a complete
vulnerability management toolkit for
federal agencies. It automatically scoresrisks to help you address significant
vulnerabilities right away, allowing you
to take a look at the granular details
around each risk. It uses a uniquefingerprinting method to produce a comprehensive asset inventory and identify
vulnerabilities across each and every
endpoint connected to your network.
When you apply Tripwire IP360 to yourenvironment, you can expect to reducerisk scores by more than 50 percent.
Tripwire IP360 benefits:»» Faster vulnerability scans with fewer
false positives»» Combines agent-based and agentlessscanning results»» Supports on-premises, cloud andhybrid environments»» Efficient and accurate vulnerability
scoring and prioritization»» Open APIs enable integration withhelp desk and asset management»» Minimizes manual efforts throughintegration with your existing toolsets

Fig. 3 Tripwire IP360 is a complete vulnerability management solution for agencies
of any size.

Summary
Many federal agencies find themselvesin need of a substantial security overhaul. They need advanced tools andtechniques to keep up with both therapid proliferation of cyberattacks andthe requirements of regulatory frameworks meant to stop them. File integrity
monitoring, log management, policy
compliance and vulnerability management are the four security fundamentals
your agency must address, and Tripwireproducts offer the out-of-the-box coverage federal agencies require.

Request a DemoLet us take you througha demo of Tripwire’s
security and vulnerability
management products
and services customized
to your specific IT security
and compliance needs.
Visit tripwire.com/contact/
request-demo/Tripwire is a leading provider of security, compliance and IT operations solutions for enterprises, industrialorganizations, service providers and government agencies. Tripwire solutions are based on high-fidelity
asset visibility and deep endpoint intelligence combined with business context; together these solutions
integrate and automate security and IT operations. Tripwire’s portfolio of enterprise-class solutions
includes configuration and policy management, file integrity monitoring, vulnerability management,
log management, and reporting and analytics. Learn more at tripwire.com
The State of Security: Security News, Trends and Insights at tripwire.com/blog
Follow us on Twitter @TripwireInc » Watch us at youtube.com/TripwireInc©2018 Tripwire, Inc. Tripwire, Log Center/LogCenter and IP360 are trademarks or registered trademarks of Tripwire, Inc.
All other product and company names are property of their respective owners. All rights reserved.

WPSFFA1a1805