https://www.csiac.org/ eMASS, the True Story Today’s Presenter: Rebecca Onuskanich, Cybersecurity Consultant June 29, 2017 Moderator: Steve Warzala swarzala@quanterion.com
The Risk Management Framework Process Step 6: Step 1: Continuous Categorize Monitoring Step 5: Authorize Step 2: Select Step 4: Step 3: Assess Implement *Derived from requirements in NIST SP 800-37, Rev. 1 and DoDI 8510.01
The Risk Management Framework Process Step 6: Step 1: Continuous Categorize STEP 1: Categorize System Monitoring • No linkage to NIST 800-60 Vol II or guidance in eMass on categorizing. • Categorize the System in accordance with the CNSS 1253 • Initiate the Security Plan – define system description and boundary Step 5: Authorize Step 2: Select • Register system with DoD Component Cybersecurity Program • Assign qualified personnel to RMF roles. Step 4: Step 3: Assess Implement *Derived from requirements in NIST SP 800-37, Rev. 1 and DoDI 8510.01
The Risk Management Framework Process STEP 2: Select Security Controls Step 6: Step 1: • Continuous Categorize The number of CCI’s managed in eMass is overwhelming. Step away from the STEP 1: Categorize System Monitoring computer! • No linkage to NIST 800-60 Vol II or guidance in eMass on categorizing. • Identify the security controls that are provided by the organization as • Categorize the System in accordance with the CNSS 1253 common and document in Security Plan. • Initiate the Security Plan – define system description and boundary Step 5: Authorize Step 2: Select • Select the security controls, apply overlays, and tailor accordingly • Register system with DoD Component Cybersecurity Program • Develop a strategy for the continuous monitoring of security control • Assign qualified personnel to RMF roles. effectiveness and any proposed/actual changes to the information system Step 4: Step 3: and environment of operation. Assess Implement • Review and approve the Security Plan and ConMon Strategy *Derived from requirements in NIST SP 800-37, Rev. 1 and DoDI 8510.01
The Risk Management Framework Process STEP 2: Select Security Controls Step 6: Step 1: STEP 3: Implement Security Controls • Continuous Categorize The number of CCI’s managed in eMass is overwhelming. Step away from the STEP 1: Categorize System Monitoring • Evidence and artifacts are uploaded. Managing these artifacts can computer! • No linkage to NIST 800-60 Vol II or guidance in eMass on categorizing. • Identify the security controls that are provided by the organization as become a Configuration Management headache! • Categorize the System in accordance with the CNSS 1253 common and document in Security Plan. • Implement the security controls specified in the security plan in • Initiate the Security Plan – define system description and boundary Step 5: Authorize Step 2: Select • Select the security controls, apply overlays, and tailor accordingly • Register system with DoD Component Cybersecurity Program accordance with DoD implementation guidance found on the KS. • Develop a strategy for the continuous monitoring of security control • Document the security control implementation in accordance with • Assign qualified personnel to RMF roles. effectiveness and any proposed/actual changes to the information system DoD implementation guidance in the Security Plan Step 4: Step 3: and environment of operation. Assess Implement • Review and approve the Security Plan and ConMon Strategy *Derived from requirements in NIST SP 800-37, Rev. 1 and DoDI 8510.01
The Risk Management Framework Process STEP 2: Select Security Controls Step 6: Step 1: STEP 4: Assess Security Controls STEP 3: Implement Security Controls • Continuous Categorize The number of CCI’s managed in eMass is overwhelming. Step away from the STEP 1: Categorize System • Conducted by the SCA. The control status will be changed to “OFFICIAL” Monitoring • Evidence and artifacts are uploaded. Managing these artifacts can computer! • No linkage to NIST 800-60 Vol II or guidance in eMass on categorizing. • Develop and approve Security Assessment Plan (SAP) • Identify the security controls that are provided by the organization as become a Configuration Management headache! • Categorize the System in accordance with the CNSS 1253 • The Security Controls Assessor (SCA) will assess security controls as common and document in Security Plan. • Implement the security controls specified in the security plan in • Initiate the Security Plan – define system description and boundary Step 5: Authorize Step 2: Select defined in SAP. • Select the security controls, apply overlays, and tailor accordingly • Register system with DoD Component Cybersecurity Program accordance with DoD implementation guidance found on the KS. • Complete Security Assessment Report (SAR) (prepared by Security • Develop a strategy for the continuous monitoring of security control • Document the security control implementation in accordance with • Assign qualified personnel to RMF roles. Control Assessor (SCA) effectiveness and any proposed/actual changes to the information system DoD implementation guidance in the Security Plan • Conduct initial remediation actions Step 4: Step 3: and environment of operation. Assess Implement • Review and approve the Security Plan and ConMon Strategy *Derived from requirements in NIST SP 800-37, Rev. 1 and DoDI 8510.01
The Risk Management Framework Process STEP 5: Authorize System STEP 2: Select Security Controls Step 6: Step 1: STEP 4: Assess Security Controls • STEP 3: Implement Security Controls • Authorization is submitted through eMass to the AO. MUST communicate with your Continuous Categorize The number of CCI’s managed in eMass is overwhelming. Step away from the STEP 1: Categorize System • Conducted by the SCA. The control status will be changed to “OFFICIAL” Monitoring • Evidence and artifacts are uploaded. Managing these artifacts can chain to ensure they are aware of the incoming/pending request. computer! • No linkage to NIST 800-60 Vol II or guidance in eMass on categorizing. • Develop and approve Security Assessment Plan (SAP) • Prepare the Plan of Action and Milestones (POA&M) • Identify the security controls that are provided by the organization as become a Configuration Management headache! • Categorize the System in accordance with the CNSS 1253 • The Security Controls Assessor (SCA) will assess security controls as • Submit Security Authorization package (Security Plan, SAR, RAR, POA&M) to common and document in Security Plan. • Implement the security controls specified in the security plan in • Initiate the Security Plan – define system description and boundary Step 5: Authorize Step 2: Select Authorizing Official (AO) defined in SAP. • Select the security controls, apply overlays, and tailor accordingly • Register system with DoD Component Cybersecurity Program accordance with DoD implementation guidance found on the KS. • AO to determine the risk to organizational operations (including mission, • Complete Security Assessment Report (SAR) (prepared by Security • Develop a strategy for the continuous monitoring of security control • Document the security control implementation in accordance with • Assign qualified personnel to RMF roles. functions, image, or reputation), organizational assets, individuals, other Control Assessor (SCA) effectiveness and any proposed/actual changes to the information system organizations, or the Nation. DoD implementation guidance in the Security Plan • Conduct initial remediation actions Step 4: Step 3: and environment of operation. • AO makes authorization decision (ATO, IATT, DATO Assess Implement • Review and approve the Security Plan and ConMon Strategy *Derived from requirements in NIST SP 800-37, Rev. 1 and DoDI 8510.01
Recommend
More recommend
