SHIFTING INFORMATION SECURITY LANDSCAPE FROM C&AS TO CONTINUOUS

SHIFTING INFORMATION SECURITY LANDSCAPE FROM C&AS TO CONTINUOUS MONITORING ANDREW PATCHAN JD, CISA ASSOCIATE IG FOR IT, FRB LOUIS C. KING, CPA, CISA, CMA, CFM, CGFM 1 ASSISTANT IG FOR FINANCIAL & IT AUDITS, DOT

CERTIFICATION & ACCREDITATION OMB A-130, Appendix III The authorization/accreditation of a system to process information provides an important quality control. By authorizing processing in a system, a manager assesses and accepts the risk associated with it. Re-authorization should occur prior to a significant change in processing, but at least every three years. 2

C&A PROCESS 3

C&A PACKAGE A typical package will contain: System Security Plan System Test and Evaluation (STE) Report Risk Assessment Contingency Plan Plans of Action and Milestones (POA&Ms) 4

C&A CHANGING PERSPECTIVE 2003 “Going through the formal process of a C&A may seem cumbersome, but the results are well worth it.” – SANS Institute 2009 95% of systems accredited at a estimated cost of 300 million (about 78,000 per system) 2010 “At first, the mandate of FISMA was met by requiring C&A While this approach provided foundational work it did not recognize or respond to the real-time nature of the threats to Federal information systems. Large aspects of FISMA implementation became an additional compliance exercise.” --OMB 5

C&A ISSUES COST In FY 2009, the first year OMB requested cost data, an estimated 300 million was spent on C&As (about 78,000 per system) QUALITY In FY 2009, although 95% had C&As, IGs reported that only twothirds of agencies had compliant processes. EFFECTIVENESS C&As are static; security states are not. Ultimately, even though the vast majority of systems have been accredited, this has not prevented significant information security compromises. 6

C&A TRANSITION In February 2010, NIST issues Revision 1 to 80037, Guide for Applying the Risk Management Framework to Federal Information Systems Rev 1 transforms the C&A process into a sixstep Risk Management Framework. 1. Categorize Information System 2. Select Security Controls 3. Implement Security Controls 4. Assess Security Controls 5. Authorize Information System 6. MONITOR SECURITY CONTROLS 7

CONTINUOUS MONITORING NIST 800-137 “Information Security Continuous Monitoring for Federal Information Systems and Organizations (September 2011) To monitor system risks and security controls defined in NIST Special Publication 800-53 “Recommended Security Controls for Federal Information Systems and Organizations” 8

CONTINUOUS MONITORING (CONT.) Control CA-7 under NIST 800-53: Reduces the level of effort required for the reauthorization of systems Maintains security authorization over time in a highly dynamic operational environment with changing threats, vulnerabilities, technologies, and business processes Promotes situational awareness of the security state of the system 9

CONTINUOUS MONITORING (CONT.) Control CA-7 under NIST 800-53 (cont.): Implementation of continuous monitoring should result in updates to the security plan, security assessment report, and plan of action and milestones (the three key documents in a security reauthorization package) 10

CONTINUOUS MONITORING (CONT.) Manual Processes, e.g. assessments of adequacy of security controls/documentation, and testing And Automated Processes, e.g. vulnerability scanning tools, and network scanning devices 11

CONTINUOUS MONITORING (CONT.) Challenges in Implementing Continuous Monitoring: Developing strategies, policies, and procedures for ISCM across organization components Involvement/buy-in of system owners Updating information on risk assessments, security plan, security assessments, and plan of action and milestones 12

CONTINUOUS MONITORING (CONT.) Challenges in Implementing Continuous Monitoring (cont.) Establishing frequencies for monitoring and assessing security information Sampling of controls Analysis and reporting of findings and determining appropriate response Output information needs to be specific, measurable, actionable, relevant, and timely Plan of action and milestones to ensure remediation Developing metrics to evaluate and control ongoing risk 13

CONTINUOUS MONITORING (CONT.) Status of Implementation of Continuous Monitoring: According to March 2013 OMB report on 2012 FISMA, OIGs in the 24 CFO Act agencies found that: 30% of agencies did not have documented strategies and plans for continuous monitoring 50% had not established and adhered to milestone dates for remediating vulnerabilities or ensuring remediation plans were effective 67% did not have a fully developed patch management process and were not timely remediating findings from vulnerability scans 14