For Security Professionals

1. INFORMATION SYSTEM SECURITY ForSecurity Professionals

2. Objectives • Discuss the principles of Computer Security • Identify required IS security documentation • Identify the purpose of a System Security Plan (SSP)

3. C I A Foundations of Computer Security Confidentiality Integrity Availability Paragraph 8-401 NISPOM

4. CONFIDENTIALITY PROTECTION OF DATA IN OR PROCESSED BY THE COMPUTER SYSTEM FROM DISCLOSURE

5. INTEGRITY Protection of data software used or processed on classified systems. FROM: • MANIPULATION • DELETION

6. AVAILABILITY Protecting the computer from malicious logic or natural disasters

7. Protection LevelsNISPOM 8-402 PL-1 Dedicated PL-2 System High PL-3 Compartmented

8. Protection Level (PL) 1Dedicated Security Mode • Clearance, N-T-K and, if applicable, all formal access approvals for all information TS TS

9. TS TS Protection Level (PL) 2 System High Security Mode • Clearance and access approvals for all information but with different N-T-K b a

10. Protection Level (PL) 3Compartmented Security Mode • Clearance for most restrictive information, but different formal access approvals NATO CRYPTO TS-NATO TOP SECRET CNWDI SAP

11. Confidentiality Matrix TABLE 5 - Protection Profile Table for Confidentiality

12. Levels of Concern 8-403Confidentality

13. Integrity Matrix Must be contractually imposed.

14. Levels of Concern 8-403Integrity Must be contractually imposed.

15. Availability Matrix Must be contractually imposed.

16. Levels of Concern 8-403Availability Must be contractually imposed.

17. Cognizant Security Agency • Agencies of the Executive Branch authorized to establish an Industrial Security program The agencies are: DoD, DoE, CIA, and NRC. 8-101a, NISPOM

18. Cognizant Security Office The entity designated by the Head of a CSA to administer industrial security on behalf of the CSA. Performs oversight, program review, training, and certification and accreditation of ISs used by its contractors 8-101a, NISPOM

19. Contractor Role • Publish and promulgate an IS Security Policy • Appoint and train an Information Systems Security Manager (ISSM) 8-101b, NISPOM

20. IS Security Manager (ISSM) • Not necessarily theFacility Security Officer(FSO) • Designated by Management • The CSA’s point ofcontact for IS security • Generally a very nice guy

21. IS Security Officer (ISSO) • Appointed by ISSM in facilities with multiple accredited IS • Assists in day-to-day IS security operations • Has PCL, NTK, and formal access approvals for all information processed on accredited IS • Not so nice

22. Security Documentation8-610 NISPOM • System Security Plan • Profile • Configuration Plan • Risk Acceptance Letter • Memorandum of Understanding • Protected Distribution System

23. Basis for Accreditation

24. System Security Plan • Defines Security Policy • Includes Configuration Management Plan • Covers the life-cycle of system • Target audience includes users, system administrative, government, and security staff • Best single security tool 8-610

25. Self-Certification Master/Profile Concept Master/Profile System Security Plan

26. Self-Certification ConceptProfile Requirements Approved TD Approved Periods Processing Approved Mobile Systems Approved Test Equipment • Same classification • Same PL level • Same Level of Concern • Same Environment • Approved O/S • Same system type

27. Self-Certification ConceptNot Authorized • SIPRNET • WAN self-certs • Systems requiring variances • Audit variances • Alternate TD procedures • Legacy O/S

28. SSP INCLUDES System requirements Personnel Clearance Level of Users Need to Know of Users Protection Level Physical controls Marking requirements • System Identification • Purpose • Security personnel • System description • Mission or purpose • Architecture • Classification Level • Formal Access Approvals 8-610a.(1)(a)

29. SSP-Protection Measures • Audit Capabilities • Access Controls • Resource Controls • System Recovery • Security Testing • Data Transmission • I & A • Session Controls • System Assurance • Physical Security

30. SSP-Protection Measures • Trusted Downloading • Software controls • Media controls • Maintenance • Clearing and sanitization • Self Inspections

31. SSP-Variances and RAL letters • Description of approved variances from protection measures • Attach documentation • Documentation of any unique threat or vulnerabilities to system • Document if none exists

32. SSP-May Also Include • MOU for connections to separately accredited networks & systems • Special purpose type systems • embedded systems • Other contractual issues

33. Audit Records • Who fills out what? • ISSOs & Users • What logs are required? - Manual • Maintenance • Hardware & Software • Upgrade/Downgrade • Sanitization • Weekly Audit Log • Seal Log (If Applicable) • Receipt/Dispatch (If Applicable)

34. Audit Records - cont’d • What logs are required - Automated • if technically capable • Successful and unsuccessful logons and logoffs • Unsuccessful accesses to security-relevant objects and directories, including: • creation • open • modification and deletion

35. Audit Records - cont’d • Changes in user authenticators, i.e., passwords • Denial of system access resulting from an excessive number of unsuccessful logon attempts. • If not technically capable, the Authorized Users list will be retained as an audit record

36. Re-Accreditation &Protection Measures • Re-Accreditation • Every Three Years • Major Changes • If no changes updated • SSP may not be required.

37. Passwords • Minimum 8* Characters • Classified to the highest level of the system • Changed at least every 365* days • Changed when compromised • Automated generation when possible

38. DoD Warning Banner • Required • Positive User Action • Prominently displayed

39. Login Attempts • Maximum of 5* attempts • Lockout for 15* minutes

40. Special CategoriesSection 5, Chapter 8May not meet all NISPOM Requirements • Single-users Stand-alones • Only one users accesses system • Pure Servers • No user code on system • Tactical, Embedded Special-Purpose Systems • Configured as directed by customer Customer can require additional requirements above NISPOM

41. Clearing and Sanitization

42. Clearing Removal of data from an IS, its storage devices and other peripheral devices with storage capacity, in such a way that the data may not be reconstructed using normal system capabilities (i.e., keyboard strokes). DCID 6/3

43. Sanitization The process of removing information from media or equipment such thatdata recovery using any known technique or analysis is prevented, as well as the removal of all classified labels and markings.DCID 6/3

44. Clearing and Sanitization Matrixwww.dss.mil • Hard drives • May be degaussed or destroyed at end of life cycle • CPUs • Remove power for one minute • Printers • Print one page (font test) then power down

45. Configuration Management Plan • Formal change control procedures for security-relevant hardware and software • Management of all documentation • Implement, test and verify CM plan

46. CM Plan Documents: • Procedures to identify and document type, model and brand of IS hardware • Procedures to identify and document product names and version or release numbers and location of security relevant software • System connectivity 8-311

47. Periods Processing • Separate Sessions • Different Classification • Levels • Different Need-To-Know • Removable Media for each processing session

48. Summary • Principals of Computing Security • System Security Plan • Purpose • Contents • NISPOM = What • SSP = How