BRIEFING SLIDES

COMMISS'ION MEETING

DISCUSSION OF SECURITY ISSUES

JANUARY 12, 2006
IT Systems

Certification and Accreditation

January U, 2006
CIII 1 A."I

J*rnTP'* AGENDA

* Background

* IG Review Results

* Progress to Date

X Chaffrman s Tasokin g Mem,| o

* Lessons Learned

* Path Forward

* Challenges

January 12, 2006 2
,+ 0

0

0o t~r BACKGROUND

* System Accreditation Activities

* FY 2005 OIS Program Brief

* Closed Commission Brief on IT Security

a o~oxr Donor~p Ad- 1Tr: -:, -..#q I 1 I I I anaI VII I I C% #U1IILY I 

January 12, 2006 3
4e 0

o0

'~" 71 I '0 at it

SYSTEM ACCREDITATION

ACTIVITIES

* An assessment of system for Privacy Act

information

* NRC Electronic Information Systems Records

Scheduling Survey (NRC Form 637)

* An assessment of the sensitivity of the

information being processed by the system

* Assessment of the level of authentication

required to access the system

* An assessment of the risk posed to the

information being processed, to the NRC, and to

the nation along with proposed risk mitigation

January 12, 2006 4
SYSTEM ACCREDITATION

ACTIVITIES (Cont'd)

@ Identification of the information system security controls

* Tests that ensure that the IT security controls

are implemented as documented, operating as

* Contingency Plan, Contingency Test and Test

Report

* All identified high risk issues have been resolved

* A plan and schedule to resolve lower risk

January , 12. _ , 2006 5
.0 R f(a 4 ,

4' 0

~O.

%0 IG REVIEEW RESULTS

* Evaluation of Certification and Accreditation

Efforts

* Evaluation of Implementation of FISMA

* Evaluation of Security - - - - --. Cnntrnk. - I * * *' for 

O U. " I 

-Stand-ane '% %.%. a . . -

Laptops For Handling Unclassified, Safeguards,

or Classified Information

January 12, 2006 6
FEEDBACK FROM OMB

M Scores on OMB Exhibit 300s lower than last

year

* Security is one of the primary reasons

* Interim Authority To Oneratr (IATn0ql nowA.

penalized in scoring by OMB (change from

previous years)

* Caused staff to propose change in approach to

Certification and Accreditation (C&A)

January 12, 2006 7
+4 0

00 PROGRESS TO DATE

* Information System Security (ISS) Program

* Status of C&A

* Resolved vulnerabilities

o Trvc-t-# of r. ovg

January 12, 2006 8
IInformation Systems Security

Program

* Completing templates for C&A documents (Artifacts)

* Documenting instructions for developing C&A

information and completing templates

- using RPS as pilot

- ensuring repeatable process

* C&A activities focused on highest priority systems

- SafeSource -- WBL (internal and external) & NSTS

- Financial systems - Cost Accounting System, FEES,

legacy HRMS

- Agency's infrastructure components supporting these

high priority systems

January 12, 2006 9
* ~0.1

t4,

* ** 49

STATUS OF C&A

* Financial systems (estimated ATO date: FY 2006 Q2)

* WBL (estimated ATO date: FY 2006 - Q3)

* NSTS (estimated ATO date: FY 2007 - Q1)

* Infrastructure (LAN/WAN) (estimated ATO

rY 2007 -Qi)

date:

RPS (estimated ATO date: FY 2006 - Q2)

January 12, 2006 10
t RESOLVED VULNERABILITIES

Examples

* Transmission of usernames and passwords

encrypted

Stored sensitive emnlovey infnrmtfinn

encrypted

* Password expiration periods enforced

January 12, 2006 11
+ 0

~A

0

00

*'. C 0z

CHAIRMAN'S TASKING MEMO

* Approved change in focus of C&A effort

* Approved Independent Study

* Provided additional funding

January 12, 2006 13
LESSONS LEARNED

* IT security needed more attention, support, and

decisions from senior OIS and agency management

* Enterprise approach (agency-wide) to security

necessar y

d Security has to be built in during development

* Previous testing was not comprehensive, focused on external threats

* Improved communication on IT Security

r % e I-1 J£ ILA :4.kt :hl r I 0A . .w. y:s.LL al 

January 12, 2006 14
a0

.. 0C

0 * 4

PATH FORWARD

* Established OIS SES Lead for ISS

Program

* Dedicated staff to completing and

documenting ISS Program

* Established two dedicated teams for C&A - One dedicated to the WBL and NSTS - One dedicated to the financial systems - Each team

underlying

supporting

responsible for the respective Agency's infrastructure components the hiah-nriority systems

January 12, 2006 15
tAaabl R 4

J(41

o CHALLENGES

* NIST 800-53 is significantly more prescriptive in

controls and documentation

* Limited knowledgeable resources available

inside and outside NRC

/I IFIoe L1I IV VVJI RIUoIU

V Providing appropriate training to staff

* Resistance to change

* Acknowledgment of potential risk

January 12, 2006 16
CMO POA

'~4,1* i41

NEXT STEPS

* OIS will work with the offices to extend IATO's for existing

systems - expired or expiring within the next 12 months

* OIS will work with the offices to identify priorities based on their

business needs for the remaining systems

* Information Technology Advisory Council will be asked to

ensure that the prioritization of C&A activity for the remaininq

systems supports the agency's business needs

* OIS will communicate impacts on remaining systems as a result

of supporting the agency's path forward

- Delay in review of business cases for new systems

- Delay in review of C&A artifacts for lower priority systems

- Limited OIS support for review during development of C&A artifacts - Possibility that C&A artifacts developed for the remaining systems

may need further revision to meet security and documentation

requirements

January 12, 2006 17