Dr. Ron Ross Computer Security Division Information Technology Laboratory

1. Enterprise-Wide Risk ManagementOrganization, Mission, and Information Systems ViewSC World Congress Data Security ConferenceNovember 10, 2010 Dr. Ron Ross Computer Security Division Information Technology Laboratory

2. Information technology is our greatest strength and at the same time, our greatest weakness…

3. Explosive growth and aggressive use of information technology. Proliferation of information systems and networks with virtually unlimited connectivity. Increasing sophistication of threat including exponential growth rate in malware (malicious code). Resulting in an increasing number of penetrations of information systems in the public and private sectors… The Perfect Storm

4. Continuing serious cyber attacks on public and private sector information systems targeting key operations, assets, and individuals… Attacks are organized, disciplined, aggressive, and well resourced; many are extremely sophisticated. Adversaries are nation states, terrorist groups, criminals, hackers, and individuals or groups with hostile intentions. Effective deployment of malware causing significant exfiltration of sensitive information (e.g., intellectual property). Potential for disruption of critical systems and services. The Threat Situation

5. Connectivity Complexity Unconventional Threats to Security

6. We have to do business in a dangerous world… Managing risk as we go.

7. Over 90% of critical infrastructure systems/applications owned and operated by non federal entities. Key sectors: Energy (electrical, nuclear, gas and oil, dams) Transportation (air, road, rail, port, waterways) Public Health Systems / Emergency Services Information and Telecommunications Defense Industry Banking and Finance Postal and Shipping Agriculture / Food / Water / Chemical Need Broad-Based Security Solutions

8. Joint Task Force Transformation Initiative A Broad-Based Partnership — • National Institute of Standards and Technology • Department of Defense • Intelligence Community • Office of the Director of National Intelligence • 16 U.S. Intelligence Agencies • Committee on National Security Systems

9. Unified Information Security Framework The Generalized Model Unique Information Security Requirements The “Delta” C N S S Intelligence Community Department of Defense Federal Civil Agencies Private Sector State/Local Govt • Foundational Set of Information Security Standards and Guidance • Risk management (organization, mission, information system) • Security categorization (information criticality/sensitivity) • Security controls (safeguards and countermeasures) • Security assessment procedures • Security authorization process Common Information Security Requirements National security and non national security information systems

10. STRATEGIC RISK FOCUS TACTICAL RISK FOCUS Enterprise-Wide Risk Management • Multi-tiered Risk Management Approach • Implemented by the Risk Executive Function • Enterprise Architecture and SDLC Focus • Flexible and Agile Implementation TIER 1 Organization (Governance) TIER 2 Mission / Business Process (Information and Information Flows) TIER 3 Information System (Environment of Operation)

11. Integrates information security more closely into the enterprise architecture and system life cycle. Promotes near real-time risk management and ongoing system authorization through the implementation of robust continuous monitoring processes. Provides senior leaders with necessary information to make risk-based decisions regarding information systems supporting their core missions and business functions. Characteristics of Risk-Based Approaches(1 of 2)

12. Links risk management activitiesat the organization, mission, and information system levels through a risk executive (function). Establishes responsibility and accountability for security controls deployed within information systems. Encourages the use of automation to increase consistency, effectiveness, and timeliness of security control implementation. Characteristics of Risk-Based Approaches(2 of 2)

13. Risk Management Process Risk

14. Starting Point CATEGORIZE Information System Define criticality/sensitivity of information system according to potential worst-case, adverse impact to mission/business. MONITOR Security Controls SELECT Security Controls Continuously track changes to the information system that may affect security controls and reassess control effectiveness. Select baseline security controls; apply tailoring guidance and supplement controls as needed based on risk assessment. Security Life Cycle AUTHORIZE Information System IMPLEMENT Security Controls Determine risk to organizational operations and assets, individuals, other organizations, and the Nation; if acceptable, authorize operation. Implement security controls within enterprise architecture using sound systems engineering practices; apply security configuration settings. ASSESS Security Controls Determine security control effectiveness (i.e., controls implemented correctly, operating as intended, meeting security requirements for information system). Risk Management Framework

15. Defense-in-Depth Links in the Security Chain: Management, Operational, and Technical Controls • Risk assessment • Security planning, policies, procedures • Configuration management and control • Contingency planning • Incident response planning • Security awareness and training • Security in acquisitions • Physical security • Personnel security • Security assessments and authorization • Continuous monitoring • Access control mechanisms • Identification & authentication mechanisms (Biometrics, tokens, passwords) • Audit mechanisms • Encryption mechanisms • Boundary and network protection devices (Firewalls, guards, routers, gateways) • Intrusion protection/detection systems • Security configuration settings • Anti-viral, anti-spyware, anti-spam software • Smart cards Adversaries attack the weakest link…where is yours?

16. Joint Task Force Transformation InitiativeCore Risk Management Publications • NIST Special Publication 800-53, Revision 3 Recommended Security Controls for Federal Information Systems and Organizations • NIST Special Publication 800-37, Revision 1 Applying the Risk Management Framework to Federal Information Systems: A Security Lifecycle Approach • NIST Special Publication 800-53A, Revision 1 Guide for Assessing the Security Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans Completed Completed Completed

17. Joint Task Force Transformation InitiativeCore Risk Management Publications • NIST Special Publication 800-39 Enterprise-Wide Risk Management: Organization, Mission, and Information Systems View Projected November 2010 (Public Draft) • NIST Special Publication 800-30, Revision 1 Guide for Conducting Risk Assessments Projected January 2011 (Public Draft)

18. 100 Bureau Drive Mailstop 8930 Gaithersburg, MD USA 20899-8930 Project Leader Administrative Support Dr. Ron Ross Peggy Himes (301) 975-5390 (301) 975-2489 ron.ross@nist.gov peggy.himes@nist.gov Senior Information Security Researchers and Technical Support Marianne Swanson Kelley Dempsey (301) 975-3293 (301) 975-2827 marianne.swanson@nist.gov kelley.dempsey@nist.gov Pat Toth Arnold Johnson (301) 975-5140 (301) 975-3247 patricia.toth@nist.govarnold.johnson@nist.gov Web:csrc.nist.gov/sec-cert Comments:sec-cert@nist.gov Contact Information

19. Implementing Enterprise Security Risk Management Policy: Standards and Practice • Dr. Ronald Ross, • Project Leader – Computer Security Division, NIST • Kirsten Bay Francissen, Principal, KBF-LTD

20. The Holistic View of Security Policy and Standards Implementation Security Policy Implementation vs. Business Process

21. Leveraging Standards and Compliance • Applying broad standards and policy for specific benefit of your business • Utilizing standards to enhance business process • Information security standards and policy can be implemented holistically

22. People, Process, and Technology • Which is the weakest link?

23. Defense-in-Depth: Your Links in the Security Chain • Management, Operational, and Technical Controls: • Develop processes and metrics • Identify opportunities for improvement • Define roles and responsibilities to avoid duplication of effort • Utilize technology for automating baseline functions and providing security controls

24. Understanding Business Process • What are the key information classifications in the organization? • By business unit • Stakeholders • Classification - Information value: • Low : Limited adverse effect on organizational operations, assets, and individuals • Moderate : Serious adverse effect • High : Severe adverse effect

25. Security Enablement of Business Process Process Product Business Administration Architecture Infrastructure Infrastructure

26. Implementation Across Business Units • Create the understanding that information security spans the entirety of the business Build the business case Interface across business units Communicate corporate wide vulnerabilities Create policies versus procedures

27. Questions?

28. Thank You Kirsten Bay Francissen KBF-LTD kbf@kbf-ltd.com +1 312.493.2065