1 / 10

Next Generation Risk Management Information Security Transformation for the Federal Government DNSSEC Day FOSE Conferenc

Next Generation Risk Management Information Security Transformation for the Federal Government DNSSEC Day FOSE Conference March 24, 2010. Kelley Dempsey Computer Security Division Information Technology Laboratory. The Threat Situation. Continuing serious cyber attacks on public and private

lluvia
Download Presentation

Next Generation Risk Management Information Security Transformation for the Federal Government DNSSEC Day FOSE Conferenc

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Next Generation Risk ManagementInformation Security Transformation for the Federal GovernmentDNSSEC DayFOSE ConferenceMarch 24, 2010 Kelley Dempsey Computer Security Division Information Technology Laboratory

  2. The Threat Situation Continuing serious cyber attacks on public and private sector information systems, large and small; targeting key operations and assets… • Attacks are organized, disciplined, aggressive, and well resourced; many are extremely sophisticated. • Adversaries are nation states, terrorist groups, criminals, hackers, and individuals or groups with intentions of compromising federal information systems. • Effective deployment of malicious software causing significant exfiltration of sensitive information (including intellectual property) and potential for disruption of critical information systems/services.

  3. What is at Risk? • Federal information systems supporting Defense, Civil, and Intelligence agencies within the federal government. • Information systems supporting critical infrastructures within the United States (public and private sector) including: • Energy (electrical, nuclear, gas and oil, dams) • Transportation (air, road, rail, port, waterways) • Public Health Systems / Emergency Services • Information and Telecommunications • Defense Industry • Banking and Finance • Postal and Shipping • Agriculture / Food / Water / Chemical • Private sector information systems supporting U.S. industry and businesses (intellectual capital).

  4. Federal Government Transformation The newly emerging information security publications begin an historic government-wide transformation for risk management and information security driven by… • Increasing sophistication and operations tempo of cyber attacks. • Convergence of national and non-national security interests within the federal government. • Convergence of national security and economic security interests across the Nation. • Need for unified command in providing effective cyber defenses for the federal government and the Nation.

  5. A Unified FrameworkFor Information Security The Generalized Model Unique Information Security Requirements Intelligence Community Department of Defense Federal Civil Agencies Private Sector State and Local Govt • Foundational Set of Information Security Standards and Guidance • Standardized risk management process • Standardized security categorization (criticality/sensitivity) • Standardized security controls (safeguards/countermeasures) • Standardized security assessment procedures • Standardized security authorization process Common Information Security Requirements National security and non national security information systems

  6. Key Risk Management Publications NIST Special Publication 800-53, Revision 3 Recommended Security Controls for Federal Information Systems and Organizations - August 2009 NIST Special Publication 800-37, Revision 1 Guide for Applying the Risk Management Framework to Federal Information Systems - February 2010 NIST Special Publication 800-53A, Revision 1 Guide for Assessing the Security Controls in Federal Information Systems and Organizations - Projected: April 2010 NIST Special Publication 800-39 Integrated Enterprise-wide Risk Management: Organization, Mission, and Information Systems View - Projected: June 2010 NIST Special Publication 800-30, Revision 1 (Initial Public Draft) Guide for Conducting Risk Assessments - Projected: August 2010

  7. Starting Point FIPS 199 / SP 800-60 FIPS 200 / SP 800-53 CATEGORIZE Information System SELECT Security Controls SP 800-37 / SP 800-53A Define criticality/sensitivity of information system according to potential worst-case, adverse impact to mission/business. MONITOR Security State Select baseline security controls; apply tailoring guidance and supplement controls as needed based on risk assessment. Continuously track changes to the information system that may affect security controls and reassess control effectiveness. Security Life Cycle SP 800-39 SP 800-37 AUTHORIZE Information System SP 800-53A SP 800-70 Implement security controls within enterprise architecture using sound systems engineering practices; apply security configuration settings. Determine risk to organizational operations and assets, individuals, other organizations, and the Nation; if acceptable, authorize operation. ASSESS Security Controls IMPLEMENT Security Controls Determine security control effectiveness (i.e., controls implemented correctly, operating as intended, meeting security requirements for information system). Risk Management Framework

  8. Target Audience for RMF Pubs • System and/or System Security Managers –authorizing officials, CIOs, CISOs, etc. • System Developers - program/project managers, IT product developers, system developers/designers/integrators, etc. • System Security Implementers – system owners, common control providers, system administrators, system security officers, etc. • Security Assessors – Auditors, IGs, system evaluators/assessors/assessment teams, etc.

  9. Transformation… Getting There Current State Lack of reciprocity in authorization and assessment results Resource intensive Redundant and duplicative activities Inconsistent policy and process implementation Lack of automation (for both workflow and testing tools) Lack of standardized documentation and artifacts to facilitate informed decisions Three-year authorization / re-authorization schedule The Very Near Future • Enabled reciprocity and information sharing • Improve security postures (architecture and information) • Streamline processes and improve end-product quality • Uniform set of policies and practices • Consistent implementation and use of automated tools • More effective resource allocation; reduce costs • Continuous monitoring

  10. Contact Information 100 Bureau Drive Mailstop 8930 Gaithersburg, MD USA 20899-8930 Project Leader Administrative Support Dr. Ron Ross Peggy Himes (301) 975-5390 (301) 975-2489 ron.ross@nist.gov peggy.himes@nist.gov Senior Information Security Researchers and Technical Support Marianne Swanson Kelley Dempsey (301) 975-3293 (301) 975-2827 marianne.swanson@nist.gov kelley.dempsey@nist.gov Pat Toth Arnold Johnson (301) 975-5140 (301) 975-3247 patricia.toth@nist.govarnold.johnson@nist.gov Web:csrc.nist.gov/sec-cert Comments:sec-cert@nist.gov

More Related