1 / 18

Federal IT Security Professional - Manager

FITSP-M Module 1. Federal IT Security Professional - Manager. Leadership. Only through diligence and a well-trained workforce will we be able to adequately defend the nation’s vital information resources. - Michael V. Hayden CNSS Secretariat. Overview.

ohio
Download Presentation

Federal IT Security Professional - Manager

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. FITSP-MModule 1 Federal IT Security Professional - Manager

  2. Leadership Only through diligence and a well-trained workforce will we be able to adequately defend the nation’s vital information resources. - Michael V. Hayden CNSS Secretariat

  3. Overview • Section A: Objectives, Expectations, & Introductions • FISMA Compliance Defined • Expectation & Goals • Target Audience • Introductions • Section B: Security Certifications Exams • Federal IT Security Institute • FITSP – Manager Certification • Section C: FITSP-M Courseware Logistics • Course Outline • Course Materials • Course Evaluation

  4. Section A Objectives, Expectations, & Introductions

  5. In Accordance with FISMA… • Secretary of Commerce shall, on the basis of standards and guidelines developed by NIST, prescribe standards and guidelines pertaining to federal information systems. • FISMA requires that federal agencies comply with FIPS standards • Federal agencies must follow NIST Special Publications mandated in FIPS. • Other security-related publications are mandatory only when specified by OMB. • Compliance schedules are established by OMB (and now the DHS - e.g., annual FISMA Reporting Guidance)

  6. Course Expectations & Goals • Clear Understanding of FISMA Compliance, via NIST Risk Management Framework, based on : • Governmental Laws and Regulations • OMB/DHS Policies, Directives, Or Memoranda • NIST Special Publications • NIST Federal Information Processing Standards (FIPS) • NIST Interagency Reports • Further Education, Training & Certification • IT Security Workforce Training is Critical to the FISMA Mandate

  7. Target Audience[Excerpt from SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems] • Individuals associated with the design, development, implementation, operation, maintenance, and disposition of federal information: • Ownership Responsibilities • Development and Integration Responsibilities • Oversight Responsibilities • Assessment and Monitoring Responsibilities • Security Implementation and Operational Responsibilities

  8. Introductions • Introducing Your Instructor Student Information • Experience • Auditors • Operators • Managers • Employer • DoD, NSA • Civilian Agency • Other • Education • IT/IA Degrees • MBA • Certifications • FITSP/CAP • SANS • CISSP • Security+ • Expectations • Starting from 0? • What’s New (800-37r1)

  9. Section B IT Security Training and Certification

  10. Federal IT Security Institutehttp://www.FITSI.org "To help secure the Nation's Federal Information Systems by certifying that Federal Workforce members understand and can apply appropriate Federal IT security standards.“ - Jim Wiggins, FITSI Executive Director 2010 FISSEA Educator of the Year

  11. Federal IT Security Professional

  12. Federal IT Security Professional Domains & Security Topics • Domain 1 – NIST Special Publications • Domain 2 – NIST Federal Information Processing Standards (FIPS) • Domain 3 – NIST Control Families • Domain 4 – Governmental Laws and Regulations • Domain 5 – NIST Risk Management Framework • Domain 6 – NIST Interagency Reports

  13. Section C FITSP-M Courseware Logistics

  14. All About the RMF • Categorize the information system based on a FIPS 199 impact analysis; • Select an initial set of baseline security controls for the information system based on system impact level and apply tailoring guidance, as needed; • Implement the security controls and document the design, development, and implementation details for the controls; • Assess the security controls to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system; • Authorize information system operation based on a determination of risk to organizational operations and assets, individuals, other organizations, and the Nation resulting from the operation and use of the information system and the decision that this risk is acceptable; and • Monitor the security controls in the information system and environment of operation on an ongoing basis…

  15. FITSP–M Course Outline • US Government Laws • Risk Management Framework Overview • Gap Analysis • Categorization • Security Control Selection • Security Control Implementation • Security Control Assessment • Authorization • Continuous Monitoring

  16. Course Material • FITSI Authorized Training Workbook • http://www.amazon.com • Public Domain Reference Documents • http://csrc.nist.gov/ • http://www.whitehouse.gov/omb/memoranda_default • http://www.dhs.gov/files/programs/fns-announcements-resources.shtm • Activity Files and Other Miscellaneous: • 2011 FISMA Report, • 2012 Reporting Metrics for • CIOs/OIGs, /SAOPs/Micro Agencies • Relative OMB Memos (listed and unlisted) • FedRAMPConOps http://www.federalcybersecurity.org/downloads.html

  17. Course Evaluation • Continuous Monitoring of Student Feedback • Good – What did you like about today’s session? • Bad – What would you like to see different in tomorrow’s session? • Opportunity – This is your class! Frequent input allows for corrective action to mitigate the risk of disappointment. • End of Course Survey

  18. Questions? Next Module: US Government Laws

More Related